You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 8ba3d02
Browse filesBrowse the repository at this point in the historyBrowse files
ci: short names, one setup action, aligned pins, explicit secrets
Naming
- Workflow files: test-build -> checks, migrations -> migrate, deploy-trigger-dev ->
trigger-dev, docs-embeddings -> docs, companion-pr-check -> companion, stickydisk-gc
-> disk-gc. ci.yml, helm.yml and codeql.yml keep their paths: they sign or analyze, and
the path is part of the signer identity and code-scanning key.
- Composite actions: setup-workspace -> setup, cache-mount -> cache, docker-build -> image.
- Every workflow and job display name is a short lowercase id, matching the job id, with
any matrix value in parentheses: ci / checks / integration (push, 1/4), image-amd64 (app).
Duplicates
- Nine hand-written Setup Bun + actions/cache + bun install blocks use the setup action.
It gains node-version (empty keeps the runner's Node, as those jobs had) and registry-url
(npm publishing). This also ends restoring node_modules from another lockfile through the
`${runner.os}-bun-` prefix restore key.
- The runner expression is anchored once per file and aliased after.
Consistency
- One SHA per action: checkout v6 (helm was on v4, codeql on v5), setup-node v6 (desktop
on v4), cache v5 (desktop-release on v4), softprops/action-gh-release v3.0.3 (was v1,
Node 16). Redis 8.2 everywhere.
- secrets: inherit replaced by the secrets each callee reads; the checks workflow reads none.
The dev migration gets only DEV_DATABASE_URL, and staging/production never see it.
- Timeouts on the three macOS desktop-e2e jobs (none before, so a hang billed 6 hours),
and a cache for their Electron, electron-builder and Playwright downloads.
- Publish workflows: values moved from ${{ }} in run blocks to env, concurrency on the
npm/PyPI publishers, persist-credentials: false on checkouts that never push.
- Dependabot for github-actions (one grouped weekly PR), and actionlint in the lint job.
Fixes
- PyPI version check matched substrings (0.1.1 "existed" once 0.1.10 did) and treated a
PyPI outage as "not published". It now asks PyPI for the exact version and fails on
anything but 200 or 404.
Job wiring (runner, if, needs, permissions, timeout, outputs) is unchanged: verified by
loading the old and new ci.yml, checks.yml and helm.yml and comparing every job.
Copy file name to clipboardExpand all lines: .agents/skills/ship/SKILL.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -66,7 +66,7 @@ When the user runs `/ship`:
66
66
67
67
**Do NOT blanket-run the domain generators here.** `mship:generate` (`generate-mship-contracts.ts`) is an **umbrella** that drives all nine mothership contract generators (`mship-contracts`, `billing-protocol-contract`, `mship-tools`, the four `trace-*`, `metrics-contract`, `vfs-snapshot-contract`) and biome-formats `apps/sim/lib/mothership/generated/` — never run it *and* its constituents (they write the same files and corrupt each other in parallel), and never run it on an ordinary ship: it reads an **external** copilot-contract source that isn't checked out in most worktrees, so it hard-fails with `ENOENT` and would abort ship for an unrelated reason. `generate:pi-model-catalog` (under `apps/sim`) likewise regenerates from the installed Pi package, not repo source. `scripts/generate-docs.ts` rewrites the integration docs and client-safe catalog; run it when this PR changes their block/icon/landing-content inputs or when `integration-catalog:check` reports drift, then review its broad generated diff. Only when **this PR's diff actually touches** a domain generator's input do you regenerate it deliberately and run its matching `:check` (`bun run mship:check` / the individual `*:check`) — with the external source present.
68
68
69
-
**Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
69
+
**Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/checks.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
70
70
```bash
71
71
# autofix formatting first (mutating; not parallel-safe with the audits). Gate its exit too —
72
72
# a non-zero lint (unfixable errors) must abort before the audits run, not be ignored.
Copy file name to clipboardExpand all lines: .github/actions/setup/action.yml
+16-6Lines changed: 16 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,23 @@
1
-
name: Setup Workspace
1
+
name: setup
2
2
description: Install the pinned Bun and Node toolchain, mount the dependency (and optionally Turbo) caches, and install workspace dependencies.
3
3
4
4
inputs:
5
5
provider:
6
-
description: The CI_PROVIDER repo variable, forwarded to cache-mount.
6
+
description: The CI_PROVIDER repo variable, forwarded to the cache action.
7
7
required: false
8
8
default: ''
9
9
turbo-cache-key:
10
10
description: Suffix for a Turbo cache mounted at ./.turbo. Empty skips the mount. Jobs that write Turbo entries need distinct suffixes, or last-writer-wins commits evict each other's entries.
11
11
required: false
12
12
default: ''
13
+
node-version:
14
+
description: Node version to install. Empty keeps the runner's preinstalled Node, for jobs that only ever ran Bun.
15
+
required: false
16
+
default: '24'
17
+
registry-url:
18
+
description: npm registry to write an .npmrc for, so `npm publish` reads NODE_AUTH_TOKEN. Empty writes none.
19
+
required: false
20
+
default: ''
13
21
14
22
# Cache keys are scoped by event name, and fork PRs get their own namespace on
15
23
# top: untrusted fork runs must never share a cache with push runs (whose caches
0 commit comments