[UPMERGE] 5.1 -> 2026.x#3108
Open
github-actions[bot] wants to merge 17 commits into
Open
Conversation
Bumps the github-actions group with 1 update: [actions/cache](https://github.com/actions/cache). Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v5...v6) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…github-actions-6d1c06d137 Bump actions/cache from 5 to 6 in the github-actions group
[UPMERGE] 5.0 -> 5.1
Bumps the github-actions group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…github-actions-eefdb6dedd Bump actions/setup-node from 6 to 7 in the github-actions group
…itor CoreShop's resource-backed document editables (coreshop_filter, coreshop_index, coreshop_country, coreshop_currency, coreshop_store, coreshop_carrier, ...) were not rendered by the new Studio document editor — the select fell back to a plain text input because no dynamic type was registered for them. ResourceBundle: - Add a generic DynamicTypeDocumentEditableCoreShopSelect. It extends the framework's DynamicTypeDocumentEditableAbstract (not the concrete select type, which is not part of the public SDK surface on all Studio versions) and renders an antd Select from the editable's config.store. getPopupContainer keeps the dropdown inside the editable container so it stays visible in the document editor iframe overlay. - Add a registerCoreShopDocumentEditableSelects(types) helper. Feature bundles (index, address, currency, payment, store, taxation, shipping): - Register their own editable type(s) via the helper in onInit and tag the bundle for the document editor iframe. The main-app-only plugin logic (object editor dynamic types, widgets, StudioForm/rule registries) is guarded so the bundles still load in the reduced iframe app. StudioFormBundle: - Initialize with a low priority and tag it for the document editor iframe, so its WidgetRegistry is bound before the dependent bundles resolve it.
…ditables [Studio] Render CoreShop document editables in the Studio document editor
Switch fork-checkout CI workflows from pull_request_target to pull_request so untrusted fork code no longer runs with secrets and a writable token. Restrict frontend-build (auto-commit, write token) to same-repo branches. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[Security] fix pull_request_target workflow injection (pwn request)
[CI] Rebuild Studio frontend bundles
Two changes that keep built Studio assets out of pull request diffs. Deterministic build ids: the output directory of a bundle was a fresh uuid on every build, so each build was a full delete/add of all 858 asset files in git even when nothing changed. It is now a hash over the bundle's sources, the sources of its `file:` dependencies and the root build configuration, so an unchanged bundle keeps its directory. Cache busting is preserved: the id still changes whenever an input changes. Build on push instead of in the pull request: pull requests now only type-check and build to verify, and the assets are committed once per push to the release branch. That commit is what the monorepo split picks up, so consumers keep getting prebuilt assets. It deliberately carries no `[skip ci]` marker, which would skip the split as well; the push trigger uses `paths-ignore` instead. Also fixes stale build directories piling up (every bundle currently ships two, so `WebpackEntryPointProvider` globs and loads each remote twice). The previous `file_pattern` glob was expanded by the shell against the working tree, so directories that no longer existed never reached `git add` as deletions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Workflow-level permissions in the reusable workflow override what the calling job grants, which would have left the build job read-only on the push build. Also gate the committing job on the push event so a manual run on a feature branch verifies instead of committing assets to it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
[CI] derive Studio build ids from sources, build PRs without committing
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR has been generated automatically.
Remember! The upmerge should always be merged with using
Merge pull requestbutton.In case of conflicts, please resolve them manually with usign the following commands: