From da27a34b7dbb281b1012a78fb8c0b1646c556058 Mon Sep 17 00:00:00 2001 From: kanad Date: Fri, 23 Oct 2026 14:40:29 +0000 Subject: [PATCH 1/2] ci: bump toolchains and upgrade mise-action to v5 (#7285) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Toolchain bumps - Bumps pnpm, node, bun, and mise. `mise.lock` and `pnpm-lock.yaml` are updated to match. - Updates the mise version pinned in each GitHub Actions workflow. - Drops `pnpm exec` from `bun` commands. The toolchain setup already puts bun on `PATH`, so running it through pnpm only added a process hop and a pnpm lookup. Calling bun directly removes that overhead and complexity. ## Workflow changes ### flaky-check installs bun with `oven-sh/setup-bun` Its plan and report jobs only need bun. setup-bun restores a 34 MB cache with just the bun binary. mise-action restored a 68 MB mise data directory and then ran a locked install and a listing on top, which took about twice as long on a cache hit. Every other bun-only step in the repository already uses setup-bun, so this makes them consistent. ### `jdx/mise-action` moves from v4.3.0 to v5.2.2 What we gain: - **The mise binary is verified before it runs.** A downloaded binary is checked against the release's signed manifest, and a binary restored from cache is checked against the signed release checksums. Before, a cached binary could run unchecked. - **The job's GitHub token stays inside the action.** v4 wrote it to the environment of every later step. Now only the action sees it. - **Caches rebuild every 30 days.** GitHub never evicts a cache that keeps getting hits, so a busy repository could keep the same tools for months. The default key now rolls over on a schedule. What does not change for us: every step pins a mise version, so the new release-age default does not apply, and the pinned mise ships the signed manifest the action now requires. One thing to expect: the default cache key format changed, so each mise cache misses once after this lands. The sync check job runs `mise install` in a later step. It no longer gets the token, but it fetches release metadata through mise's own relay and downloads assets directly from GitHub releases, so it never used the token. ### The shared setup action drops its custom `cache_key` The custom key hashed `mise.toml`, `mise.lock`, `.node-version`, `.bun-version`, and `package.json`. mise-action's default key already covers `mise.toml` and `mise.lock`, plus the requested tool subset, the runner image, and the mise version. The lockfile pins the node, bun, and pnpm versions the version files select, and a locked install refuses any version the lockfile does not have. So the extra hashes could not catch anything the lockfile hash misses, and the default key is strictly better. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude --- .bun-version | 2 +- .github/actions/setup/action.yml | 5 +- .github/workflows/apply-release-notes.yml | 2 +- .github/workflows/build-cli-artifacts.yml | 4 +- .github/workflows/cli-go-ci.yml | 5 +- .github/workflows/flaky-check.yml | 14 +- .github/workflows/mirror-template-images.yml | 2 +- .github/workflows/propose-release-notes.yml | 2 +- .../publish-preview-cli-packages.yml | 2 +- .github/workflows/release-config.yml | 4 +- .github/workflows/release-shared.yml | 12 +- .github/workflows/sync-branches.yml | 4 +- apps/cli/docs/release-process.md | 6 +- apps/cli/package.json | 2 +- apps/cli/scripts/build.ts | 2 +- apps/cli/scripts/refresh-e2e-timings.ts | 2 +- apps/cli/scripts/sync-versions.ts | 2 +- apps/cli/scripts/upload-release-assets.ts | 2 +- ...1-cli-release-and-distribution-strategy.md | 4 +- mise.lock | 166 +++++++++--------- mise.toml | 2 +- package.json | 2 +- pnpm-lock.yaml | 124 ++++++------- 23 files changed, 182 insertions(+), 190 deletions(-) diff --git a/.bun-version b/.bun-version index 9df886c42a..1c99cf0e80 100644 --- a/.bun-version +++ b/.bun-version @@ -1 +1 @@ -1.4.2 +1.4.4 diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 8e503fe8f6..eebbb5d160 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -126,11 +126,10 @@ runs: commit: ${{ steps.sticky.outputs.commit }} - name: Install toolchains - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2 with: - version: 2026.9.0 + version: 2026.10.17 install_args: ${{ inputs.tools }} - cache_key: ${{ inputs.tools != '' && format('mise-{0}-{1}-{2}-{3}', runner.os, runner.arch, inputs.tools, hashFiles('mise.toml', 'mise.lock', '.node-version', '.bun-version', 'package.json')) || '' }} - name: Resolve pnpm store path if: inputs.dependency-cache == 'true' diff --git a/.github/workflows/apply-release-notes.yml b/.github/workflows/apply-release-notes.yml index b9858b3428..753028e5cc 100644 --- a/.github/workflows/apply-release-notes.yml +++ b/.github/workflows/apply-release-notes.yml @@ -99,7 +99,7 @@ jobs: exit 1 fi echo "==> Applying notes for $tag" - pnpm exec bun apps/cli/scripts/apply-release-notes.ts --tag "$tag" + bun apps/cli/scripts/apply-release-notes.ts --tag "$tag" release_url="https://github.com/${{ github.repository }}/releases/tag/${tag}" gh pr comment "$PR_NUMBER" --repo "${{ github.repository }}" --body \ "Applied to [${tag}](${release_url}) after approval by @${APPROVER}." diff --git a/.github/workflows/build-cli-artifacts.yml b/.github/workflows/build-cli-artifacts.yml index 2e8c2a32db..818f238b37 100644 --- a/.github/workflows/build-cli-artifacts.yml +++ b/.github/workflows/build-cli-artifacts.yml @@ -104,11 +104,11 @@ jobs: rcodesign --version - name: Sync versions - run: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${VERSION}" + run: bun apps/cli/scripts/sync-versions.ts --version "${VERSION}" - name: Build CLI artifacts timeout-minutes: ${{ inputs.build_timeout_minutes }} - run: pnpm exec bun apps/cli/scripts/build.ts --version "${VERSION}" + run: bun apps/cli/scripts/build.ts --version "${VERSION}" - name: Verify build artifacts run: | diff --git a/.github/workflows/cli-go-ci.yml b/.github/workflows/cli-go-ci.yml index a4e60bfab4..2ae77eac79 100644 --- a/.github/workflows/cli-go-ci.yml +++ b/.github/workflows/cli-go-ci.yml @@ -91,10 +91,9 @@ jobs: with: persist-credentials: false - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2 with: - version: 2026.9.0 - install: true + version: 2026.10.17 install_args: >- go golangci-lint diff --git a/.github/workflows/flaky-check.yml b/.github/workflows/flaky-check.yml index 73a547d9a1..54c9bdfbfc 100644 --- a/.github/workflows/flaky-check.yml +++ b/.github/workflows/flaky-check.yml @@ -76,12 +76,9 @@ jobs: persist-credentials: false - name: Install Bun - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - version: 2026.9.0 - install: true - install_args: bun - working_directory: .flaky-tooling + bun-version-file: .flaky-tooling/.bun-version - name: Plan runs id: plan @@ -204,12 +201,9 @@ jobs: persist-credentials: false - name: Install Bun - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: - version: 2026.9.0 - install: true - install_args: bun - working_directory: .flaky-tooling + bun-version-file: .flaky-tooling/.bun-version - name: Download results uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/mirror-template-images.yml b/.github/workflows/mirror-template-images.yml index dabc95430e..1b45c64493 100644 --- a/.github/workflows/mirror-template-images.yml +++ b/.github/workflows/mirror-template-images.yml @@ -66,7 +66,7 @@ jobs: # are skipped, so a re-run produces an empty list. - name: Detect images missing from the mirror id: detect - run: pnpm exec bun apps/cli/scripts/detect-unmirrored-images.ts + run: bun apps/cli/scripts/detect-unmirrored-images.ts mirror: name: Mirror image diff --git a/.github/workflows/propose-release-notes.yml b/.github/workflows/propose-release-notes.yml index c459fdcf8c..04f9359071 100644 --- a/.github/workflows/propose-release-notes.yml +++ b/.github/workflows/propose-release-notes.yml @@ -82,4 +82,4 @@ jobs: - name: Propose release notes env: GH_TOKEN: ${{ steps.app-token.outputs.token }} - run: pnpm exec bun apps/cli/scripts/propose-release-notes.ts --tag "${TAG}" --apply + run: bun apps/cli/scripts/propose-release-notes.ts --tag "${TAG}" --apply diff --git a/.github/workflows/publish-preview-cli-packages.yml b/.github/workflows/publish-preview-cli-packages.yml index 73e2477257..9f5ce2057f 100644 --- a/.github/workflows/publish-preview-cli-packages.yml +++ b/.github/workflows/publish-preview-cli-packages.yml @@ -82,7 +82,7 @@ jobs: - name: Prepare package files run: | set -euo pipefail - pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${PREVIEW_VERSION}" + bun apps/cli/scripts/sync-versions.ts --version "${PREVIEW_VERSION}" pnpm --dir apps/cli build:shim find packages -path '*/bin/supabase*' -type f -exec chmod +x {} + diff --git a/.github/workflows/release-config.yml b/.github/workflows/release-config.yml index 3ab2d2ac0a..2b79a91614 100644 --- a/.github/workflows/release-config.yml +++ b/.github/workflows/release-config.yml @@ -91,7 +91,7 @@ jobs: resume_token="$(openssl rand -hex 16)" echo "::stop-commands::${resume_token}" trap 'echo "::${resume_token}::"' EXIT - pnpm exec bun packages/config/scripts/release-plan.ts --notes-out "$RUNNER_TEMP/config-release-notes.md" + bun packages/config/scripts/release-plan.ts --notes-out "$RUNNER_TEMP/config-release-notes.md" # Build/gate/pack also run on private-blocked pushes (should_release=false, version set): # if `private` is ever flipped back on, the plan half of the release train is already @@ -127,7 +127,7 @@ jobs: mkdir -p "$RUNNER_TEMP/config-release-gate-local" tar -xzf "$RUNNER_TEMP/config-release-artifact/supabase-config-${VERSION}.tgz" \ -C "$RUNNER_TEMP/config-release-gate-local" --no-same-owner --no-same-permissions - pnpm exec bun tools/config-release-gate.ts --version "$VERSION" \ + bun tools/config-release-gate.ts --version "$VERSION" \ --local-dist "$RUNNER_TEMP/config-release-gate-local/package/dist" - name: Upload release artifact diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml index 50f3f57213..1f0e0a13c9 100644 --- a/.github/workflows/release-shared.yml +++ b/.github/workflows/release-shared.yml @@ -318,10 +318,10 @@ jobs: fail-on-cache-miss: true - name: Sync versions - run: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${VERSION}" + run: bun apps/cli/scripts/sync-versions.ts --version "${VERSION}" - name: Publish to npm - run: pnpm exec bun apps/cli/scripts/publish.ts --tag "${NPM_TAG}" + run: bun apps/cli/scripts/publish.ts --tag "${NPM_TAG}" - name: Configure git for release pushes run: | @@ -389,13 +389,13 @@ jobs: - name: Upload release assets env: GH_TOKEN: ${{ github.token }} - run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}" + run: bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}" # Publishing makes the release immutable, so require every expected asset to be uploaded first. - name: Verify release assets env: GH_TOKEN: ${{ github.token }} - run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}" + run: bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}" - name: Publish GitHub Release (immutable) env: @@ -514,7 +514,7 @@ jobs: git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" - name: Update Homebrew formula - run: pnpm exec bun apps/cli/scripts/update-homebrew.ts --version "${VERSION}" --name "${BREW_NAME}" + run: bun apps/cli/scripts/update-homebrew.ts --version "${VERSION}" --name "${BREW_NAME}" env: GH_TOKEN: ${{ steps.app-token.outputs.token }} GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} @@ -575,7 +575,7 @@ jobs: git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" - name: Update Scoop manifest - run: pnpm exec bun apps/cli/scripts/update-scoop.ts --version "${VERSION}" --name "${SCOOP_NAME}" + run: bun apps/cli/scripts/update-scoop.ts --version "${VERSION}" --name "${SCOOP_NAME}" env: GH_TOKEN: ${{ steps.app-token.outputs.token }} GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/sync-branches.yml b/.github/workflows/sync-branches.yml index 5058c163f2..5eefcfbae3 100644 --- a/.github/workflows/sync-branches.yml +++ b/.github/workflows/sync-branches.yml @@ -198,9 +198,9 @@ jobs: bun-version-file: trusted/.bun-version # Installs mise only; the script installs the merged tree's own toolchain. - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2 with: - version: 2026.9.0 + version: 2026.10.17 install: false working_directory: work diff --git a/apps/cli/docs/release-process.md b/apps/cli/docs/release-process.md index 5b949f3ef9..de73842ecb 100644 --- a/apps/cli/docs/release-process.md +++ b/apps/cli/docs/release-process.md @@ -497,8 +497,8 @@ Keep two to three stable majors supported at the same time, roughly six to twelv `**build` (ubuntu-latest):\*\* -1. `[pnpm exec bun apps/cli/scripts/sync-versions.ts --version X.Y.Z](../scripts/sync-versions.ts)` — writes the release version into every `package.json` (umbrella + eight platform packages) and resolves the umbrella's `workspace:`\* `optionalDependencies` to `X.Y.Z`. -2. `[pnpm exec bun apps/cli/scripts/build.ts --version X.Y.Z](../scripts/build.ts)` — cross-compiles the Bun SFE for all eight targets (including windows-arm64), cross-compiles the Go sidecar, **ad-hoc signs the macOS binaries** (see [Code signing (macOS)](#code-signing-macos)), builds the six Linux packages via `nfpm`, produces the tar/zip archives, and writes `dist/checksums.txt`. +1. `[bun apps/cli/scripts/sync-versions.ts --version X.Y.Z](../scripts/sync-versions.ts)` — writes the release version into every `package.json` (umbrella + eight platform packages) and resolves the umbrella's `workspace:`\* `optionalDependencies` to `X.Y.Z`. +2. `[bun apps/cli/scripts/build.ts --version X.Y.Z](../scripts/build.ts)` — cross-compiles the Bun SFE for all eight targets (including windows-arm64), cross-compiles the Go sidecar, **ad-hoc signs the macOS binaries** (see [Code signing (macOS)](#code-signing-macos)), builds the six Linux packages via `nfpm`, produces the tar/zip archives, and writes `dist/checksums.txt`. 3. `actions/upload-artifact` preserves `packages/cli-*/bin/` and `dist/` for the downstream jobs. `**smoke-test` (matrix: `ubuntu-latest`, `macos-latest`, `macos-15-intel`, `windows-latest`):\*\* @@ -510,7 +510,7 @@ The matrix does not yet include `windows-11-arm` (gate 6) or an Alpine musl runn `**publish` (ubuntu-latest, `if: !inputs.dry_run`):\*\* 1. Re-runs `sync-versions.ts` (download-artifact restores file modes but not JSON mutations). -2. `[pnpm exec bun apps/cli/scripts/publish.ts --tag .stable>](../scripts/publish.ts)` — publishes the eight platform packages in parallel via OIDC trusted publishing (`bun publish --provenance`, no `NPM_TOKEN`), then the umbrella package last so `optionalDependencies` resolve cleanly at install time. +2. `[bun apps/cli/scripts/publish.ts --tag .stable>](../scripts/publish.ts)` — publishes the eight platform packages in parallel via OIDC trusted publishing (`bun publish --provenance`, no `NPM_TOKEN`), then the umbrella package last so `optionalDependencies` resolve cleanly at install time. 3. `softprops/action-gh-release` creates an **empty draft** Release `v` on `supabase/cli`. 4. `[upload-release-assets.ts upload](../scripts/upload-release-assets.ts)` uploads the archives, packages, `checksums.txt`, unversioned aliases, and `install` script **one asset at a time** with `gh release upload --clobber`, up to three attempts each with a five-minute timeout. `gh` itself retries 5xx responses and dropped connections three times within a second; the outer loop covers longer stalls and the `--clobber` delete, which `gh` does not retry. `uploads.github.com` fails single uploads often enough that this is routine: in September 2026 one beta release hit a multi-hour backend degradation and another lost one connection on a healthy backend. The asset list, retry policy, and timeout handling are covered by the unit and integration tests next to the script. 5. `upload-release-assets.ts verify` compares `gh release view --json assets` with the expected asset names. The job fails if any asset is missing or not `uploaded`, so a partial set is never published. diff --git a/apps/cli/package.json b/apps/cli/package.json index a9a6612162..9b1810b186 100644 --- a/apps/cli/package.json +++ b/apps/cli/package.json @@ -29,7 +29,7 @@ "build:binary": "bun scripts/build-binary.ts", "build:shim": "bun build src/shared/cli/bin.ts --outfile dist/supabase.js --target node", "docs:spec": "bun scripts/generate-docs-spec.ts", - "dev": "pnpm exec bun src/main.ts", + "dev": "bun src/main.ts", "gen:feedback-types": "pnpm dev -- gen types typescript --project-id xguihxuzqibwxjnimxev --schema public > src/shared/feedback/database.types.ts", "test": "pnpm run test:unit --coverage.enabled && pnpm run test:integration --coverage.enabled && pnpm run test:e2e", "test:unit": "pnpm exec turbo run supabase#test:unit:run --", diff --git a/apps/cli/scripts/build.ts b/apps/cli/scripts/build.ts index 52ee98efff..3d7f9db378 100644 --- a/apps/cli/scripts/build.ts +++ b/apps/cli/scripts/build.ts @@ -35,7 +35,7 @@ const packageJsonPath = path.join(root, "apps/cli/package.json"); const packageVersion = JSON.parse(await readFile(packageJsonPath, "utf8")) as { version?: string }; const version = values.version ?? packageVersion.version; if (!version) { - console.error("Usage: pnpm exec bun apps/cli/scripts/build.ts [--version ]"); + console.error("Usage: bun apps/cli/scripts/build.ts [--version ]"); process.exit(1); } if (values.version === undefined) { diff --git a/apps/cli/scripts/refresh-e2e-timings.ts b/apps/cli/scripts/refresh-e2e-timings.ts index a52667501c..1fbf485426 100644 --- a/apps/cli/scripts/refresh-e2e-timings.ts +++ b/apps/cli/scripts/refresh-e2e-timings.ts @@ -109,7 +109,7 @@ function readResultsCaches(dir: string): VitestResultsCache[] { }); } -const usage = `Usage: pnpm exec bun apps/cli/scripts/refresh-e2e-timings.ts --run [--repo supabase/cli] +const usage = `Usage: bun apps/cli/scripts/refresh-e2e-timings.ts --run [--repo supabase/cli] Downloads the e2e-timings-* artifacts of a test workflow run and rewrites apps/cli/tests/e2e-timings.json from them.`; diff --git a/apps/cli/scripts/sync-versions.ts b/apps/cli/scripts/sync-versions.ts index c94429bc4c..1f4cfe4fb5 100644 --- a/apps/cli/scripts/sync-versions.ts +++ b/apps/cli/scripts/sync-versions.ts @@ -24,7 +24,7 @@ const { values } = parseArgs({ const version = values.version; if (!version) { - console.error("Usage: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "); + console.error("Usage: bun apps/cli/scripts/sync-versions.ts --version "); process.exit(1); } diff --git a/apps/cli/scripts/upload-release-assets.ts b/apps/cli/scripts/upload-release-assets.ts index d0edef1a35..a0138e12ed 100644 --- a/apps/cli/scripts/upload-release-assets.ts +++ b/apps/cli/scripts/upload-release-assets.ts @@ -153,7 +153,7 @@ export function missingAssets(expected: string[], uploaded: string[]): string[] return expected.filter((name) => !present.has(name)).sort(); } -const usage = `Usage: pnpm exec bun apps/cli/scripts/upload-release-assets.ts --version +const usage = `Usage: bun apps/cli/scripts/upload-release-assets.ts --version upload Upload every release asset to the draft release v, one at a time with retries. verify Fail unless every expected asset is present on v and reported as uploaded.`; diff --git a/docs/adr/0011-cli-release-and-distribution-strategy.md b/docs/adr/0011-cli-release-and-distribution-strategy.md index 1f04627fbd..80b55ec853 100644 --- a/docs/adr/0011-cli-release-and-distribution-strategy.md +++ b/docs/adr/0011-cli-release-and-distribution-strategy.md @@ -208,8 +208,8 @@ Draft, upload, verify, and finalize by the shared workflow: tag_name: v${{ inputs.version }} draft: true prerelease: ${{ inputs.prerelease }} -- run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}" -- run: pnpm exec bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}" +- run: bun apps/cli/scripts/upload-release-assets.ts upload --version "${VERSION}" +- run: bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}" - run: gh release edit v${VERSION} --draft=false ``` diff --git a/mise.lock b/mise.lock index 1f30d585a7..83da59b571 100644 --- a/mise.lock +++ b/mise.lock @@ -1,55 +1,55 @@ # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html -lockfile_version = 1 +lockfile_version = 3 [[tools.bun]] -version = "1.4.2" +version = "1.4.4" backend = "core:bun" -specifiers = ["1.4.2"] +specifiers = ["1.4.4"] [tools.bun."platforms.linux-arm64"] -checksum = "sha256:54328bbc2d9c8e0c9f892c544d66c57a83b84139e34909e5ee81758f1ac8fda7" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-aarch64.zip" +checksum = "sha256:baa6bb36f51d6e58561e02bbea825038a9df454f673d6d776e8bbf86f8c7850e" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-aarch64.zip" [tools.bun."platforms.linux-arm64-musl"] -checksum = "sha256:71760b6c8ea30623b81a4907cb815d48e2ea266f2e73e751534a44a0607950df" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-aarch64-musl.zip" +checksum = "sha256:57f01b02ac7113c61c935f28f38c2eab849e3c970dab21f8b640a87b1ef65009" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-aarch64-musl.zip" [tools.bun."platforms.linux-x64"] -checksum = "sha256:36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-x64.zip" +checksum = "sha256:bf8ccbfb2b0b80159e0f9a6d15c55317add8077534dbc6130a3edb52fccb395c" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-x64.zip" [tools.bun."platforms.linux-x64-baseline"] -checksum = "sha256:c678040f14fe0440eb839d37cbd0ce4c051a32da72806ac97de6a6aab6bf728f" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-x64-baseline.zip" +checksum = "sha256:e0446eb55995772eb9894bebae9a6be368d985a8b9271ee124486f9946eedd76" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-x64-baseline.zip" [tools.bun."platforms.linux-x64-musl"] -checksum = "sha256:4835eca59d6da70f4674f5642f6e459dcadab773695b2ed9922d131057989742" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-x64-musl.zip" +checksum = "sha256:a5a8ccc5e74dcb883fe974f125a7bdb3b41e5195ed1b870e73f17effd3eb2b2d" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-x64-musl.zip" [tools.bun."platforms.linux-x64-musl-baseline"] -checksum = "sha256:76e1db84e98f22f78de0a87e309bfbbf297732847f9720db36750646c85c8c18" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-linux-x64-musl-baseline.zip" +checksum = "sha256:6e9c37098b293920aed28bfb51ab240e26d23bfdd9bbfecb3ad428ac166549bc" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-linux-x64-musl-baseline.zip" [tools.bun."platforms.macos-arm64"] -checksum = "sha256:90987a3a16d7db556d886ac3d551e7b6d3edf0a1cf43acaed622e8676be1d12f" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-darwin-aarch64.zip" +checksum = "sha256:c240d7f0ccb90c263a849fcdb09b7ee62630d921348ed6aafda86b9d577bc510" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-darwin-aarch64.zip" [tools.bun."platforms.macos-x64"] -checksum = "sha256:80520d7e17526308c9185d261679ac6d27798d3803a0e9f7ff9121ab8affb012" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-darwin-x64.zip" +checksum = "sha256:50a3491f73abc2fe81673171a85762d3bc2cc1680ccecadd983de99adf77977e" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-darwin-x64.zip" [tools.bun."platforms.macos-x64-baseline"] -checksum = "sha256:bad5bbd6cf14d0980d115f5954c9ff904df619d5e994d2da1ffccd3f316300b0" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-darwin-x64-baseline.zip" +checksum = "sha256:d4a155adfbfd09155eb3ba05c9e3a544f39297d7a68616d3c7759f67ab5c47dc" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-darwin-x64-baseline.zip" [tools.bun."platforms.windows-x64"] -checksum = "sha256:ce4c17497b2f29712a99d3d53f028de28cd42e3bacb8589599e7f000e49b6405" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-windows-x64.zip" +checksum = "sha256:cd2c0fccc78f3ede1f50ca827a15f063eda13d4d150a3d0674f4f6e323d864a5" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-windows-x64.zip" [tools.bun."platforms.windows-x64-baseline"] -checksum = "sha256:78c221c2376f79731ccf4e4af0b3bb46d81fefa3296c5abee09ad8a1b21e68c6" -url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.2/bun-windows-x64-baseline.zip" +checksum = "sha256:0f20ce6674d4f2dbcc8c5d59fdf99f7ba45f8c3b367e0f5781cbfa30a1c78d99" +url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.4/bun-windows-x64-baseline.zip" [[tools.go]] version = "1.26.5" @@ -243,123 +243,123 @@ url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/61133861 provenance = "github-attestations" [[tools.node]] -version = "24.21.0" +version = "24.22.1" backend = "core:node" specifiers = ["24"] [tools.node."platforms.linux-arm64"] -checksum = "sha256:724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-arm64.tar.gz" +checksum = "sha256:33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-arm64.tar.gz" [tools.node."platforms.linux-arm64-musl"] -checksum = "sha256:3048b0811e158ca0d8672b59c839861763e144492980d8d29b369dfee45747e4" -url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-arm64-musl.tar.gz" +checksum = "sha256:8254125825a3e5e834bd8a260dab4c8303f720464a741506ec27989b9ba1769b" +url = "https://unofficial-builds.nodejs.org/download/release/v24.22.1/node-v24.22.1-linux-arm64-musl.tar.gz" [tools.node."platforms.linux-x64"] -checksum = "sha256:6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-x64.tar.gz" +checksum = "sha256:eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz" [tools.node."platforms.linux-x64-baseline"] -checksum = "sha256:6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-x64.tar.gz" +checksum = "sha256:eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz" [tools.node."platforms.linux-x64-musl"] -checksum = "sha256:01a713e34da98e7b4d2a3191ee7ca3f93dd0384d1a2ef23c379b2161ee6e133a" -url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-x64-musl.tar.gz" +checksum = "sha256:0a9eddce2d2e8f3addbe94fa46d751325b2d74f7fd1ce63296164d36b6dfc6e5" +url = "https://unofficial-builds.nodejs.org/download/release/v24.22.1/node-v24.22.1-linux-x64-musl.tar.gz" [tools.node."platforms.linux-x64-musl-baseline"] -checksum = "sha256:01a713e34da98e7b4d2a3191ee7ca3f93dd0384d1a2ef23c379b2161ee6e133a" -url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-x64-musl.tar.gz" +checksum = "sha256:0a9eddce2d2e8f3addbe94fa46d751325b2d74f7fd1ce63296164d36b6dfc6e5" +url = "https://unofficial-builds.nodejs.org/download/release/v24.22.1/node-v24.22.1-linux-x64-musl.tar.gz" [tools.node."platforms.macos-arm64"] -checksum = "sha256:bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz" +checksum = "sha256:89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-arm64.tar.gz" [tools.node."platforms.macos-x64"] -checksum = "sha256:1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-x64.tar.gz" +checksum = "sha256:d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-x64.tar.gz" [tools.node."platforms.macos-x64-baseline"] -checksum = "sha256:1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-x64.tar.gz" +checksum = "sha256:d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-x64.tar.gz" [tools.node."platforms.windows-x64"] -checksum = "sha256:158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-win-x64.zip" +checksum = "sha256:d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-x64.zip" [tools.node."platforms.windows-x64-baseline"] -checksum = "sha256:158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541" -url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-win-x64.zip" +checksum = "sha256:d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5" +url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-x64.zip" [[tools.pnpm]] -version = "12.8.1" +version = "12.15.0" backend = "aqua:pnpm/pnpm" -specifiers = ["12.8.1"] +specifiers = ["12.15.0"] [tools.pnpm."platforms.linux-arm64"] -checksum = "sha256:75c5e34d3164fe3d3549580b1b1b59c9dd16543e558dec722b686193cdb7dfa1" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-linux-arm64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935899" +checksum = "sha256:d7ce93a2c7d847d3a34bd3f559b60c14f578b1320c17cc352a2c5c5fdf956117" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-linux-arm64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173352" provenance = "github-attestations" [tools.pnpm."platforms.linux-arm64-musl"] -checksum = "sha256:27ad77bdf5368c1747f46fff0d0ee213ed6185aaf69e13342964f5f7cc3f8714" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-linux-arm64-musl.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935889" +checksum = "sha256:1188ef8a57bfc5786f3f739a98067242e531a4636e3f52e9e9ddc75564ea804d" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-linux-arm64-musl.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173342" provenance = "github-attestations" [tools.pnpm."platforms.linux-x64"] -checksum = "sha256:db3906881f63e41b655e3b97d473603dc26326c2470d0b1b8083689e1bcbd1e8" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-linux-x64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935887" +checksum = "sha256:55b5ed0092bd11176c1669598e231ae52e7cedac59de6efd0d415730f37d0598" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-linux-x64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173360" provenance = "github-attestations" [tools.pnpm."platforms.linux-x64-baseline"] -checksum = "sha256:db3906881f63e41b655e3b97d473603dc26326c2470d0b1b8083689e1bcbd1e8" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-linux-x64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935887" +checksum = "sha256:55b5ed0092bd11176c1669598e231ae52e7cedac59de6efd0d415730f37d0598" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-linux-x64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173360" provenance = "github-attestations" [tools.pnpm."platforms.linux-x64-musl"] -checksum = "sha256:f0a2db13d0a1b63c0053a5ddcfbf5c454b040e7ef54ca8771750e2cb55b86693" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-linux-x64-musl.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935901" +checksum = "sha256:d33802cc987dcfbe02a991473764ba25ad1b2344189e2097a2570baed66f008a" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-linux-x64-musl.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173349" provenance = "github-attestations" [tools.pnpm."platforms.linux-x64-musl-baseline"] -checksum = "sha256:f0a2db13d0a1b63c0053a5ddcfbf5c454b040e7ef54ca8771750e2cb55b86693" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-linux-x64-musl.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935901" +checksum = "sha256:d33802cc987dcfbe02a991473764ba25ad1b2344189e2097a2570baed66f008a" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-linux-x64-musl.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173349" provenance = "github-attestations" [tools.pnpm."platforms.macos-arm64"] -checksum = "sha256:8eeeae4cd714b2f1755750d303f5b1bcfe23d95ed7245536305d0c3877c5ce41" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-darwin-arm64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935883" +checksum = "sha256:6a41a2877773e97f19832067187cc6fc82e186d8a2cf91fec4b4c1a5fbd6ef27" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-darwin-arm64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173343" provenance = "github-attestations" [tools.pnpm."platforms.macos-x64"] -checksum = "sha256:8cbc5a840b4bcd8c0da878e6616a832d88e98a8acbedf1736310b395467f4a13" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-darwin-x64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935890" +checksum = "sha256:2d7b336884574aee8a765bee48591212e9caf4fcf985fb3279588c1fb73fb47f" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-darwin-x64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173347" provenance = "github-attestations" [tools.pnpm."platforms.macos-x64-baseline"] -checksum = "sha256:8cbc5a840b4bcd8c0da878e6616a832d88e98a8acbedf1736310b395467f4a13" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-darwin-x64.tar.gz" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935890" +checksum = "sha256:2d7b336884574aee8a765bee48591212e9caf4fcf985fb3279588c1fb73fb47f" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-darwin-x64.tar.gz" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173347" provenance = "github-attestations" [tools.pnpm."platforms.windows-x64"] -checksum = "sha256:823fc131326afeee292e113e2299ca9851c3ee5148a7de921c897f0170de6f05" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-win32-x64.zip" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935888" +checksum = "sha256:84cf69db1be19e95bb4e5bef329291a046f2821b390d87e00f5690809d8a2ed7" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-win32-x64.zip" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173351" provenance = "github-attestations" [tools.pnpm."platforms.windows-x64-baseline"] -checksum = "sha256:823fc131326afeee292e113e2299ca9851c3ee5148a7de921c897f0170de6f05" -url = "https://github.com/pnpm/pnpm/releases/download/v12.8.1/pnpm-win32-x64.zip" -url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/595935888" +checksum = "sha256:84cf69db1be19e95bb4e5bef329291a046f2821b390d87e00f5690809d8a2ed7" +url = "https://github.com/pnpm/pnpm/releases/download/v12.15.0/pnpm-win32-x64.zip" +url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/662173351" provenance = "github-attestations" [[tools.shellcheck]] diff --git a/mise.toml b/mise.toml index 2d2de7c3d1..5596a9bb89 100644 --- a/mise.toml +++ b/mise.toml @@ -1,4 +1,4 @@ -min_version = '2026.9.0' +min_version = '2026.10.17' [tools] go = "1.26.5" diff --git a/package.json b/package.json index 80d08e4740..ca8e4bafd7 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "devEngines": { "packageManager": { "name": "pnpm", - "version": "12.8.1", + "version": "12.15.0", "onFail": "warn" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1109b76646..d8673924f0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,153 +7,153 @@ importers: configDependencies: {} packageManagerDependencies: pnpm: - specifier: 12.8.1 - version: 12.8.1 + specifier: 12.15.0 + version: 12.15.0 packages: - '@pnpm/exe.android-arm64@12.8.1': - resolution: {integrity: sha512-siDxcidfz5eM6L2tJfik+i2bbUEw8UC7MZ3Yl2HYdRmqbdhHGAOQACtOOu6QVW4Jul4/w5wVKm+wM8ACtgh1Pg==} + '@pnpm/exe.android-arm64@12.15.0': + resolution: {integrity: sha512-eVCqmscY70LGvgRzu3mi8IBWBFGix+a6mNZoWmXxESsBdeiKEF9xQSuaeel10yn+zI7TXy2jlI63vFLzETk+aQ==} cpu: [arm64] os: [android] - '@pnpm/exe.android-x64@12.8.1': - resolution: {integrity: sha512-0F/uqPRc3aN4vLHsa0f+6fTtmsigFQ9/yxEU43fionF//pNHEd5e97b3w/nKIgqYMCUQCJphmBRMA9Q8/wlo9Q==} + '@pnpm/exe.android-x64@12.15.0': + resolution: {integrity: sha512-Gx/WbkFcdUFUg8g8AShezcS9EiQxfYvdAm2hfKLO8sfJmJvKOCt5fzlgHWDzmGhoclibgW+tUGZ/KF4F4wOTCA==} cpu: [x64] os: [android] - '@pnpm/exe.darwin-arm64@12.8.1': - resolution: {integrity: sha512-/rwavvMQJsl2RIxOHBnDF+4Gk+fhQFAY4M3PQZoKskJOEnaJcygG9p1xby6wcQcbS4d9dIubv09CQhufTgfmpw==} + '@pnpm/exe.darwin-arm64@12.15.0': + resolution: {integrity: sha512-N0ZykiDWCvqSBJvt71j7cSoBR993FqvYZFtmpCtqvW3pguiI+NAgraLPA5OTwu5mV+/d8hYpVcPktJA3xFDLtA==} cpu: [arm64] os: [darwin] - '@pnpm/exe.darwin-x64@12.8.1': - resolution: {integrity: sha512-htYt2gN7zqJKLhC99Ft6EUiO7myjZAZXfmGCTJUL1v+o7vE9hZdE1+fAkk4Oj1ZHNRti6b2woOxEkRkAusi8OQ==} + '@pnpm/exe.darwin-x64@12.15.0': + resolution: {integrity: sha512-7Ntr2HlBUxzwWOg7NwDxCbRW/3vXuqKO+hcXm+w3SBi9rrHY53li1wLqWVT7Gjxd+lVEHM1QJZo6WJEGFU8C6A==} cpu: [x64] os: [darwin] - '@pnpm/exe.freebsd-x64@12.8.1': - resolution: {integrity: sha512-PB5BULNgytxvExoOXUUeseS/DcpPENs+cg3iA6xHHeaLT4ctEGKSGXEbuj7USeqvo8JBpAx039hivnbzGqDwnA==} + '@pnpm/exe.freebsd-x64@12.15.0': + resolution: {integrity: sha512-btOiyL7fL7W4uQGH0aqFai2TNC3IoKcZ7gNHBVbEFZt2dWrnrD0SufL3iGs3fLlmb4OtuU35uf4Zpr9V9Jh9mA==} cpu: [x64] os: [freebsd] - '@pnpm/exe.linux-arm64-musl@12.8.1': - resolution: {integrity: sha512-kKeyC/ArjrgdciQRBrOL0j9HtOI4gDRgoyP+eJ1CQKyadpKlf/DhDDyspXe07R3B9KagTVLUF2nlt6Dr5quFIg==} + '@pnpm/exe.linux-arm64-musl@12.15.0': + resolution: {integrity: sha512-pNC38k+O+90FOjbPNSnw0E7apq1PKTmz3fFe1amn+lys/U5kL++uzir8bRiho8ONcyA3d9EU7wdqcY0DKkj+JA==} cpu: [arm64] os: [linux] libc: [musl] - '@pnpm/exe.linux-arm64@12.8.1': - resolution: {integrity: sha512-q4s9a9X2O3N9aeUFooW24orNrxvu20+jyVUFR5RanPCqOKKPBrgs2iywMkBBx1aXkkzdWT54/mfz8Be8sJlWEw==} + '@pnpm/exe.linux-arm64@12.15.0': + resolution: {integrity: sha512-qML/8aCXslh8td/w4U+HJNqUcZ2+m6EfTbWScIzZRmyPsRFN+xB4LP1U/hymxc1iSJiKtG56HJx2fvUErWFIGw==} cpu: [arm64] os: [linux] libc: [glibc] - '@pnpm/exe.linux-ppc64@12.8.1': - resolution: {integrity: sha512-F7XSjKJthwCh/L6abZiMpAfo2Cm61SZIT3e4dfgiIjESndlWaXCnfLKngSgZ/SEMsdmHT6dud3+kWIB3tw0/xQ==} + '@pnpm/exe.linux-ppc64@12.15.0': + resolution: {integrity: sha512-tjRDUUl7RCJ6T/6eoNPxOqkwU4Mzi5RtTXmSAxujyz37OTwwsMU7Ps087Zk4gHcUvRSeyF40ZFsew3vtE+nmUA==} cpu: [ppc64] os: [linux] libc: [glibc] - '@pnpm/exe.linux-riscv64@12.8.1': - resolution: {integrity: sha512-z1ecpIK/ZY08Unk69KWWE9867oaKUytGUjrHnBoGFAAhsK+q+0cfvBH+f5fWobJ7FX97leMlLO+gkJolddM45Q==} + '@pnpm/exe.linux-riscv64@12.15.0': + resolution: {integrity: sha512-bF1uBWEfbwaeryz6lIiaJ8AWD082otZfvzGX5l+6LZRpRwUEpJHUsJrORaYP5/cNMv5ZR2p6TvvcJcQzwtDzmw==} cpu: [riscv64] os: [linux] libc: [glibc] - '@pnpm/exe.linux-s390x@12.8.1': - resolution: {integrity: sha512-KU6tnrBfu4uKXTq6N5qJwSm8FSrs9Wc8b5AUEsHK9bRXwNdsZ1/lRxG1++X29SKRW9OSNuDSjxASv5mAvGo1gA==} + '@pnpm/exe.linux-s390x@12.15.0': + resolution: {integrity: sha512-zKMhIzsexYMToeLmqV5jPsvV/f9vwsJb2kUH2NFYzalbxImeBrlA4kL7GwF8gD4pagV6jYYcJb8RjbZIdjHptg==} cpu: [s390x] os: [linux] libc: [glibc] - '@pnpm/exe.linux-x64-musl@12.8.1': - resolution: {integrity: sha512-eUE8BWJkDr2tJb/yrk0yVnszlmNqFarVxUlqiZ9BAkct28Nq/5g2H0tvMDmPA7fAQW3STNj+omJPPRVT+4s5sQ==} + '@pnpm/exe.linux-x64-musl@12.15.0': + resolution: {integrity: sha512-A9J0Jg0Rdx+qQU4qXtwyST5tto9IOu1zi4fDk35nbc6DWahggbcKtFvZPKFwL2qgUXGXOX//hXv6z/sp6emO8A==} cpu: [x64] os: [linux] libc: [musl] - '@pnpm/exe.linux-x64@12.8.1': - resolution: {integrity: sha512-8bDZ0lZlCdi2rvnFul7EYgcC7zKeWSe76y8JV2oXobaS8p9i9d6PSf6LgLtTM0fI7R9Oh4eLCbveXyNDMmvZ+g==} + '@pnpm/exe.linux-x64@12.15.0': + resolution: {integrity: sha512-yc+QlZR+9+nr29J4fRzhMoapgxTBDndq/+peyoq1XUufnQFnfbXUMFudDIKzHi545linGqmOmXfn0NoufNgcOg==} cpu: [x64] os: [linux] libc: [glibc] - '@pnpm/exe.win32-arm64@12.8.1': - resolution: {integrity: sha512-MsT0dlrRxnCRCHCaosNbhWpEiAFnFuMEu3KuDJDU41BXgTwiINxU8goloUSUDejWZUqKaUqNC/qUTihl9nFtqg==} + '@pnpm/exe.win32-arm64@12.15.0': + resolution: {integrity: sha512-fPXZxuY1VclkOga9bc53qNCXcegfeoBR8+Ue+AospDwKzuGGSHll0oDxkLfkmpjyRqpe7bH5DyQPYp/xSMaIVA==} cpu: [arm64] os: [win32] - '@pnpm/exe.win32-x64@12.8.1': - resolution: {integrity: sha512-SWtPe0PsbTTk//gJND10tMdOfCYjrkq5+qV49hzVhY7xz2iJ339Rc+xwASlcvbwTfrvH39YNqpKYibD+CRGLwA==} + '@pnpm/exe.win32-x64@12.15.0': + resolution: {integrity: sha512-nrd+Tp1We1DGj4DGG5Bea9lZNh9y1PjlLBdEwdInS4D0h0UIDtM7JaGGGDJhNzIwcHASyihWI7HLV+dtG+fhYg==} cpu: [x64] os: [win32] - pnpm@12.8.1: - resolution: {integrity: sha512-9kupB1B/XOr+BsjTjmBS0BeURFgOwSed3Vv8EctIqoomRLZlmOB+dh2oSHKp/FfV+QK4f6SdAkGY1VhhKqu+RQ==} - engines: {node: '>=18.*'} + pnpm@12.15.0: + resolution: {integrity: sha512-s5UdbW/0qfE9x89WzSjSuOs328ycaOUuHhGRhz6p+CoBcoerULqtxczElPA2xnwOR+sTYIwvo29HcRth6hKOYQ==} + engines: {node: '>=18'} hasBin: true snapshots: - '@pnpm/exe.android-arm64@12.8.1': + '@pnpm/exe.android-arm64@12.15.0': optional: true - '@pnpm/exe.android-x64@12.8.1': + '@pnpm/exe.android-x64@12.15.0': optional: true - '@pnpm/exe.darwin-arm64@12.8.1': + '@pnpm/exe.darwin-arm64@12.15.0': optional: true - '@pnpm/exe.darwin-x64@12.8.1': + '@pnpm/exe.darwin-x64@12.15.0': optional: true - '@pnpm/exe.freebsd-x64@12.8.1': + '@pnpm/exe.freebsd-x64@12.15.0': optional: true - '@pnpm/exe.linux-arm64-musl@12.8.1': + '@pnpm/exe.linux-arm64-musl@12.15.0': optional: true - '@pnpm/exe.linux-arm64@12.8.1': + '@pnpm/exe.linux-arm64@12.15.0': optional: true - '@pnpm/exe.linux-ppc64@12.8.1': + '@pnpm/exe.linux-ppc64@12.15.0': optional: true - '@pnpm/exe.linux-riscv64@12.8.1': + '@pnpm/exe.linux-riscv64@12.15.0': optional: true - '@pnpm/exe.linux-s390x@12.8.1': + '@pnpm/exe.linux-s390x@12.15.0': optional: true - '@pnpm/exe.linux-x64-musl@12.8.1': + '@pnpm/exe.linux-x64-musl@12.15.0': optional: true - '@pnpm/exe.linux-x64@12.8.1': + '@pnpm/exe.linux-x64@12.15.0': optional: true - '@pnpm/exe.win32-arm64@12.8.1': + '@pnpm/exe.win32-arm64@12.15.0': optional: true - '@pnpm/exe.win32-x64@12.8.1': + '@pnpm/exe.win32-x64@12.15.0': optional: true - pnpm@12.8.1: + pnpm@12.15.0: optionalDependencies: - '@pnpm/exe.android-arm64': 12.8.1 - '@pnpm/exe.android-x64': 12.8.1 - '@pnpm/exe.darwin-arm64': 12.8.1 - '@pnpm/exe.darwin-x64': 12.8.1 - '@pnpm/exe.freebsd-x64': 12.8.1 - '@pnpm/exe.linux-arm64': 12.8.1 - '@pnpm/exe.linux-arm64-musl': 12.8.1 - '@pnpm/exe.linux-ppc64': 12.8.1 - '@pnpm/exe.linux-riscv64': 12.8.1 - '@pnpm/exe.linux-s390x': 12.8.1 - '@pnpm/exe.linux-x64': 12.8.1 - '@pnpm/exe.linux-x64-musl': 12.8.1 - '@pnpm/exe.win32-arm64': 12.8.1 - '@pnpm/exe.win32-x64': 12.8.1 + '@pnpm/exe.android-arm64': 12.15.0 + '@pnpm/exe.android-x64': 12.15.0 + '@pnpm/exe.darwin-arm64': 12.15.0 + '@pnpm/exe.darwin-x64': 12.15.0 + '@pnpm/exe.freebsd-x64': 12.15.0 + '@pnpm/exe.linux-arm64': 12.15.0 + '@pnpm/exe.linux-arm64-musl': 12.15.0 + '@pnpm/exe.linux-ppc64': 12.15.0 + '@pnpm/exe.linux-riscv64': 12.15.0 + '@pnpm/exe.linux-s390x': 12.15.0 + '@pnpm/exe.linux-x64': 12.15.0 + '@pnpm/exe.linux-x64-musl': 12.15.0 + '@pnpm/exe.win32-arm64': 12.15.0 + '@pnpm/exe.win32-x64': 12.15.0 --- lockfileVersion: '9.0' From e125d0f085df8f36a1db0a5afc263227fe55c934 Mon Sep 17 00:00:00 2001 From: kanad Date: Fri, 23 Oct 2026 14:40:30 +0000 Subject: [PATCH 2/2] chore(ci): bump jactionlint to 2.3.0 and address its new rules (#7287) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stacked on #7285. ## Bump - `jactionlint` moves from 1.8.2 to 2.3.0 (`"2"` in mise.toml, pinned in `mise.lock`). - The config's deprecated `require-commit-hash` key becomes `rules: unpinned-uses: error`, the vendored `.repos/**` submodules are excluded, and the `missing-timeout` and `concurrency-limits` policy rules are turned off. ## Fixes, one commit per rule - **excessive-permissions**: single-job workflows grant their write scopes on the job instead of the workflow. contribution-gate grants both jobs the scopes its script needs. release-smoke-test's caller job keeps the four scopes release-shared's job tree declares. - **github-app**: the three release-notes App tokens request only the permissions their jobs use, confirmed against GitHub's REST permission tables. - **superfluous-actions**: both `softprops/action-gh-release` steps become `gh release create`, skipping when the release already exists and verifying the tag the earlier step pushed. - **pipeline-without-pipefail**, **github-env**, **artipacked**, **unused-job-output**: small mechanical fixes. ## Accepted findings, one commit per rule Each carries an inline `# jactionlint ignore=` comment with a plain-English reason: `dangerous-triggers`, `adhoc-packages`, `unverified-download`, `cache-poisoning` (run-scoped key), `unpinned-images` (smoke-test container), `bot-conditions` (the author check is already present), and `issues: write` on reopen-stale-issue. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude --- .github/jactionlint.yaml | 10 ++- .github/scripts/ai-review/resolve.ts | 3 +- .github/workflows/ai-review.yml | 12 +++- .github/workflows/apply-release-notes.yml | 10 ++- .github/workflows/bot-pr-auto-merge.yml | 6 ++ .github/workflows/cli-go-ci.yml | 1 + .github/workflows/cli-go-mirror-image.yml | 9 +-- .github/workflows/cli-go-pg-prove.yml | 2 - .github/workflows/cli-go-publish-migra.yml | 2 - .github/workflows/cli-go-tag-pkg.yml | 5 +- .../workflows/close-stale-issues-and-prs.yml | 9 +-- .github/workflows/contribution-gate.yml | 20 ++++-- .github/workflows/dispatch-cli-e2e-ci.yml | 1 + .github/workflows/fill-sticky-disks.yml | 2 + .github/workflows/live-e2e-notify.yml | 2 + .github/workflows/propose-release-notes.yml | 3 + .github/workflows/release-config.yml | 29 ++++---- .github/workflows/release-shared.yml | 24 +++++-- .github/workflows/release-smoke-test.yml | 15 ++-- .github/workflows/reopen-stale-issue.yml | 5 ++ .github/workflows/setup-cli-smoke-test.yml | 3 + .github/workflows/sync-branches.yml | 13 +++- .github/workflows/sync-repair.yml | 9 ++- .github/workflows/verify-install-channels.yml | 3 + mise.lock | 70 +++++++++---------- mise.toml | 2 +- 26 files changed, 180 insertions(+), 90 deletions(-) diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml index 11d6ccd219..11746e71e1 100644 --- a/.github/jactionlint.yaml +++ b/.github/jactionlint.yaml @@ -1,4 +1,7 @@ -require-commit-hash: true # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest +rules: + missing-timeout: off + concurrency-limits: off + unpinned-uses: error # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest self-hosted-runner: labels: - arm-runner @@ -8,3 +11,8 @@ self-hosted-runner: - blacksmith-8vcpu-ubuntu-2404 - blacksmith-8vcpu-windows-2025 - blacksmith-32vcpu-ubuntu-2404 +paths: + # Other projects' repositories, pulled in as git submodules. CI never checks them out. + ".repos/**": + ignore: + - ".*" diff --git a/.github/scripts/ai-review/resolve.ts b/.github/scripts/ai-review/resolve.ts index 0cfaafc071..74984e22ed 100644 --- a/.github/scripts/ai-review/resolve.ts +++ b/.github/scripts/ai-review/resolve.ts @@ -12,7 +12,7 @@ * * `resolveDecision` is the pure orchestration function (I/O injected) a test * can drive without the network; `main()` wires up the real GitHub I/O, - * writes `should_run`/`pr_number`/`head_ref`/`trigger` to `$GITHUB_OUTPUT`, + * writes `should_run`/`pr_number`/`head_sha`/`trigger` to `$GITHUB_OUTPUT`, * and surfaces the skip reason (if any) in `$GITHUB_STEP_SUMMARY`. * * Run in CI as: `bun .github/scripts/ai-review/resolve.ts`. @@ -374,7 +374,6 @@ function writeOutputs(result: ResolveResult, prNumber: number): void { const entries: Record = { should_run: String(result.shouldRun), pr_number: String(prNumber), - head_ref: `refs/pull/${prNumber}/head`, head_sha: result.headSha ?? "", trigger: result.trigger, }; diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index 582874175f..56bbfb6926 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -16,6 +16,10 @@ on: description: "PR number to review" required: true type: string + # A `/ai-review` comment on a pull request starts a review. The resolve job checks who + # commented, and the one job that can write to the pull request runs code from the default + # branch only, never from the pull request. + # jactionlint ignore=dangerous-triggers issue_comment: types: - created @@ -65,7 +69,6 @@ jobs: outputs: should_run: ${{ steps.resolve.outputs.should_run }} pr_number: ${{ steps.resolve.outputs.pr_number }} - head_ref: ${{ steps.resolve.outputs.head_ref }} # Every job reviews this commit, so a push during the run is never reported as reviewed. head_sha: ${{ steps.resolve.outputs.head_sha }} trigger: ${{ steps.resolve.outputs.trigger }} @@ -161,7 +164,10 @@ jobs: # behavior mid-rollout. Installed from the trusted checkout with npm config isolation so a # PR-supplied `.npmrc` in the untrusted `pr` checkout can never redirect this install to a # hostile registry. - # 2.1.280 is the first release that accepts claude-opus-5-5. + # 2.1.280 is the first release that accepts claude-opus-5-5. The CLI is installed on its + # own, not through the repository's lockfile, so nothing in the pull request's checkout + # can change what gets installed. + # jactionlint ignore=adhoc-packages - name: Install Claude Code CLI working-directory: trusted run: | @@ -544,7 +550,7 @@ jobs: steps: # Security-critical: this is the only job with write permission, so it must only ever # execute trusted base-branch code — never the PR head. Checking out `develop` explicitly - # (never `needs.resolve.outputs.head_ref`) keeps a malicious PR from smuggling a script + # (never the PR's own ref) keeps a malicious PR from smuggling a script # change into the one job that can write back to the PR. (For `pull_request` events GitHub # runs the workflow file from the PR's own ref; acceptable since the auto path only admits # same-repo PRs, whose authors hold write access anyway, and fork PRs run with a read-only diff --git a/.github/workflows/apply-release-notes.yml b/.github/workflows/apply-release-notes.yml index 753028e5cc..831ec66cf7 100644 --- a/.github/workflows/apply-release-notes.yml +++ b/.github/workflows/apply-release-notes.yml @@ -27,13 +27,14 @@ jobs: outputs: authorized: ${{ steps.check.outputs.authorized }} steps: - # App token needs org membership read, repo write to edit the release, and PR write to - # comment and close. + # The token reads the approver's team membership and comments on the pull request. - id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.GH_APP_CLIENT_ID }} private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + permission-members: read + permission-pull-requests: write - name: Authorize approver against supabase/cli team id: check @@ -66,11 +67,16 @@ jobs: contents: write pull-requests: write steps: + # The token edits the GitHub release, deletes the branch, and comments on and closes the + # pull request. The script below runs from the pull request's own checkout, so the token + # must not be able to change workflow files. - id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.GH_APP_CLIENT_ID }} private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write # Checkout the PR head so reviewer edits made before approval are captured; # apply-release-notes.ts reads from the working tree. diff --git a/.github/workflows/bot-pr-auto-merge.yml b/.github/workflows/bot-pr-auto-merge.yml index 6745993567..3d1006bfda 100644 --- a/.github/workflows/bot-pr-auto-merge.yml +++ b/.github/workflows/bot-pr-auto-merge.yml @@ -1,6 +1,9 @@ name: Bot PR auto-merge on: + # Only this event lets the job use the auto-approve environment's secret. The job never + # checks out or runs code from the pull request. + # jactionlint ignore=dangerous-triggers pull_request_target: types: [opened, reopened, synchronize, ready_for_review] branches: [develop] @@ -14,6 +17,9 @@ jobs: # Other apps (coding agents, CI vendors) also open PRs here and still need a maintainer. # Release-notes PRs are published by a maintainer approval and must never merge. Branch sync # PRs land by fast-forward on a maintainer approval, never by a squash. + # The first condition checks who opened the pull request. The second checks who caused this + # event, so a person pushing to a bot's pull request does not get it approved. + # jactionlint ignore=bot-conditions if: >- contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.pull_request.user.login) && contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.sender.login) && diff --git a/.github/workflows/cli-go-ci.yml b/.github/workflows/cli-go-ci.yml index 2ae77eac79..97ee9dc277 100644 --- a/.github/workflows/cli-go-ci.yml +++ b/.github/workflows/cli-go-ci.yml @@ -31,6 +31,7 @@ jobs: # Required by: internal/utils/credentials/keyring_test.go - uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0 - run: | + set -o pipefail pkgs=$(go list ./pkg/... | grep -Ev 'pkg/api' | paste -sd ',' -) go tool gotestsum -- -race -v -count=1 ./... \ -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out diff --git a/.github/workflows/cli-go-mirror-image.yml b/.github/workflows/cli-go-mirror-image.yml index 889ecaf9ae..284118c964 100644 --- a/.github/workflows/cli-go-mirror-image.yml +++ b/.github/workflows/cli-go-mirror-image.yml @@ -19,14 +19,15 @@ on: required: true type: string -permissions: - contents: read - packages: write - id-token: write +permissions: {} jobs: mirror: runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write steps: - id: strip env: diff --git a/.github/workflows/cli-go-pg-prove.yml b/.github/workflows/cli-go-pg-prove.yml index 6a4414ee3f..3c836bbdce 100644 --- a/.github/workflows/cli-go-pg-prove.yml +++ b/.github/workflows/cli-go-pg-prove.yml @@ -38,8 +38,6 @@ jobs: arch: arm64 runs-on: ${{ matrix.runner }} timeout-minutes: 180 - outputs: - image_digest: ${{ steps.build.outputs.digest }} steps: - run: docker context create builders - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 diff --git a/.github/workflows/cli-go-publish-migra.yml b/.github/workflows/cli-go-publish-migra.yml index c3b0a56333..7e37210911 100644 --- a/.github/workflows/cli-go-publish-migra.yml +++ b/.github/workflows/cli-go-publish-migra.yml @@ -38,8 +38,6 @@ jobs: arch: arm64 runs-on: ${{ matrix.runner }} timeout-minutes: 180 - outputs: - image_digest: ${{ steps.build.outputs.digest }} steps: - run: docker context create builders - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 diff --git a/.github/workflows/cli-go-tag-pkg.yml b/.github/workflows/cli-go-tag-pkg.yml index 9185ad5771..3563c4077b 100644 --- a/.github/workflows/cli-go-tag-pkg.yml +++ b/.github/workflows/cli-go-tag-pkg.yml @@ -8,13 +8,14 @@ on: required: true type: string -permissions: - contents: write +permissions: {} jobs: tag: name: Create pkg tag runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/close-stale-issues-and-prs.yml b/.github/workflows/close-stale-issues-and-prs.yml index e6ecb519a3..fb43466983 100644 --- a/.github/workflows/close-stale-issues-and-prs.yml +++ b/.github/workflows/close-stale-issues-and-prs.yml @@ -22,10 +22,7 @@ on: type: string default: "security,pinned,do-not-close,keep-open,do not merge" -permissions: - contents: read - issues: write - pull-requests: write +permissions: {} concurrency: group: close-stale-issues-and-prs @@ -35,6 +32,10 @@ jobs: close-stale: runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: read + issues: write + pull-requests: write steps: - name: Close stale issues and PRs uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 diff --git a/.github/workflows/contribution-gate.yml b/.github/workflows/contribution-gate.yml index af7cab6ac5..341bea8b29 100644 --- a/.github/workflows/contribution-gate.yml +++ b/.github/workflows/contribution-gate.yml @@ -1,6 +1,9 @@ name: Contribution Gate on: + # The gate has to comment on pull requests from forks, which only this event's token can do. + # It checks out the base branch, never the pull request. + # jactionlint ignore=dangerous-triggers pull_request_target: types: - opened @@ -16,10 +19,7 @@ on: type: boolean default: false -permissions: - pull-requests: write - issues: read - contents: read +permissions: {} concurrency: # Per-PR for pull_request_target; unique per run for manual sweeps (which @@ -31,6 +31,10 @@ jobs: gate-single: name: Contribution Gate runs-on: ubuntu-latest + permissions: + pull-requests: write + issues: read + contents: read # Exempt maintainers/collaborators and bots. External contributors are gated. if: > github.event_name == 'pull_request_target' && @@ -42,6 +46,8 @@ jobs: # Checks out the base repo (default for pull_request_target), so the gate # runs trusted code from the base branch, never the untrusted PR head. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: ".bun-version" @@ -58,11 +64,17 @@ jobs: gate-all: name: Contribution Gate (all open PRs) runs-on: ubuntu-latest + permissions: + pull-requests: write + issues: read + contents: read if: github.event_name == 'workflow_dispatch' steps: # Base-branch checkout only — the sweep makes API calls and never runs # any PR's code. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version-file: ".bun-version" diff --git a/.github/workflows/dispatch-cli-e2e-ci.yml b/.github/workflows/dispatch-cli-e2e-ci.yml index ed5aa0f22a..0fc4f0a9f9 100644 --- a/.github/workflows/dispatch-cli-e2e-ci.yml +++ b/.github/workflows/dispatch-cli-e2e-ci.yml @@ -37,6 +37,7 @@ jobs: CLI_SHA: ${{ github.event.pull_request.head.sha }} PR_NUMBER: ${{ github.event.pull_request.number }} run: | + set -o pipefail echo "Dispatching cli-e2e-ci live run for PR #${PR_NUMBER} @ ${CLI_SHA}" # Build the nested client_payload with jq — `gh api -f` sends a flat # body and would not nest `client_payload.*` correctly. diff --git a/.github/workflows/fill-sticky-disks.yml b/.github/workflows/fill-sticky-disks.yml index 2440f388d1..0e9da129b8 100644 --- a/.github/workflows/fill-sticky-disks.yml +++ b/.github/workflows/fill-sticky-disks.yml @@ -72,6 +72,7 @@ jobs: - name: Pull stack package images run: | + set -o pipefail pnpm --silent --filter @supabase/stack prepare:test-artifacts --images | xargs --max-procs 4 --max-args 1 docker pull --quiet @@ -79,6 +80,7 @@ jobs: - name: Prune Docker before saving its image disk if: always() run: | + set -o pipefail docker ps --all --quiet | xargs --no-run-if-empty docker rm --force docker system prune --force docker volume prune --all --force diff --git a/.github/workflows/live-e2e-notify.yml b/.github/workflows/live-e2e-notify.yml index 66edf219b7..441f130f15 100644 --- a/.github/workflows/live-e2e-notify.yml +++ b/.github/workflows/live-e2e-notify.yml @@ -1,6 +1,8 @@ name: Live E2E Notifications on: + # The job only reads whether the run passed. It runs nothing the run produced. + # jactionlint ignore=dangerous-triggers workflow_run: workflows: [Live E2E, Release] types: [completed] diff --git a/.github/workflows/propose-release-notes.yml b/.github/workflows/propose-release-notes.yml index 04f9359071..3ba3ad70fc 100644 --- a/.github/workflows/propose-release-notes.yml +++ b/.github/workflows/propose-release-notes.yml @@ -61,6 +61,9 @@ jobs: with: client-id: ${{ vars.GH_APP_CLIENT_ID }} private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + permission-contents: write + permission-issues: read + permission-pull-requests: write - uses: useblacksmith/checkout@6fd481652155169ed4d2f25ebaf97464f685175f # v1 with: diff --git a/.github/workflows/release-config.yml b/.github/workflows/release-config.yml index 2b79a91614..87e6d5e57b 100644 --- a/.github/workflows/release-config.yml +++ b/.github/workflows/release-config.yml @@ -355,19 +355,24 @@ jobs: fi echo "dist-tag ${NPM_TAG} -> ${VERSION} confirmed." + # The CLI's install scripts and setup-cli resolve releases/latest/download/..., so a + # config release must never become the repo's "latest" release. Re-runs skip this step + # when the release already exists. - name: Create GitHub Release - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 - with: - token: ${{ github.token }} - tag_name: config-v${{ needs.plan.outputs.version }} - name: "@supabase/config v${{ needs.plan.outputs.version }}" - body_path: ${{ runner.temp }}/config-release/config-release-notes.md - draft: false - prerelease: false - # The CLI's install scripts and setup-cli resolve - # releases/latest/download/..., so a config release must never - # become the repo's "latest" release. - make_latest: "false" + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + tag="config-v${VERSION}" + if gh release view "${tag}" >/dev/null 2>&1; then + echo "Release ${tag} already exists; skipping." + else + gh release create "${tag}" \ + --verify-tag \ + --title "@supabase/config v${VERSION}" \ + --notes-file "${RUNNER_TEMP}/config-release/config-release-notes.md" \ + --latest=false + fi # Pages Slack the moment a real run arms the config-release approval gate. Runs in parallel # with the publish job's `waiting` state (needs only `plan`), so the ping and the pending diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml index 1f0e0a13c9..119ee14e84 100644 --- a/.github/workflows/release-shared.yml +++ b/.github/workflows/release-shared.yml @@ -307,6 +307,8 @@ jobs: with: dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }} + # The cache key includes this run's id, so only this run's build job can have written it. + # jactionlint ignore=cache-poisoning - name: Restore build artifacts cache uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: @@ -377,13 +379,23 @@ jobs: done # Created empty; the next step uploads the assets so each one can be retried on its own. + # Re-runs skip this step when the release already exists. - name: Create draft GitHub Release - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 - with: - tag_name: v${{ inputs.version }} - name: v${{ inputs.version }} - draft: true - prerelease: ${{ inputs.prerelease }} + env: + GH_TOKEN: ${{ github.token }} + PRERELEASE: ${{ inputs.prerelease }} + run: | + set -euo pipefail + tag="v${VERSION}" + if gh release view "${tag}" >/dev/null 2>&1; then + echo "Release ${tag} already exists; skipping." + else + args=(--draft --verify-tag --title "${tag}") + if [[ "$PRERELEASE" == true ]]; then + args+=(--prerelease) + fi + gh release create "${tag}" "${args[@]}" + fi # One asset at a time with per-asset retries; see apps/cli/scripts/upload-release-assets.ts. - name: Upload release assets diff --git a/.github/workflows/release-smoke-test.yml b/.github/workflows/release-smoke-test.yml index 27ca8a2ebc..0aa4ff6b17 100644 --- a/.github/workflows/release-smoke-test.yml +++ b/.github/workflows/release-smoke-test.yml @@ -26,17 +26,18 @@ concurrency: group: release-smoke-test-${{ github.event.pull_request.number || github.run_id }} cancel-in-progress: true -permissions: - # release-shared.yml declares privileged publish jobs. They are gated by - # dry_run here, but GitHub validates nested-workflow permissions at startup. - actions: read - contents: write - id-token: write - pull-requests: write +permissions: {} jobs: smoke: name: Run release smoke tests + # release-shared.yml declares privileged publish jobs. They are gated by + # dry_run here, but GitHub validates nested-workflow permissions at startup. + permissions: + actions: read + contents: write + id-token: write + pull-requests: write # Fork heads are skipped: the shared workflow declares write permissions a # fork pull request token cannot hold, and hotfixes come from this repository. if: | diff --git a/.github/workflows/reopen-stale-issue.yml b/.github/workflows/reopen-stale-issue.yml index dd7572b617..1235ddbefe 100644 --- a/.github/workflows/reopen-stale-issue.yml +++ b/.github/workflows/reopen-stale-issue.yml @@ -1,12 +1,17 @@ name: Reopen stale issue on: + # Anyone who can comment must be able to use /reopen. The script only reads the comment + # text and never runs it. + # jactionlint ignore=dangerous-triggers issue_comment: types: - created permissions: contents: read + # The script reopens the issue, removes a label, and comments. Each needs issues: write. + # jactionlint ignore=excessive-permissions issues: write concurrency: diff --git a/.github/workflows/setup-cli-smoke-test.yml b/.github/workflows/setup-cli-smoke-test.yml index dc9aeb1ba9..1bcc37242b 100644 --- a/.github/workflows/setup-cli-smoke-test.yml +++ b/.github/workflows/setup-cli-smoke-test.yml @@ -84,6 +84,9 @@ jobs: # `node:20-alpine` ships a musl-linked Node, required for JavaScript-based actions to launch # here — the runner's mounted glibc Node won't execute inside an Alpine container. container: + # The image is pinned by tag, not by digest. It only hosts the installer smoke test, and + # nothing would update a digest here automatically. + # jactionlint ignore=unpinned-images image: node:20-alpine env: VERSION: ${{ inputs.version }} diff --git a/.github/workflows/sync-branches.yml b/.github/workflows/sync-branches.yml index 5eefcfbae3..5ab7797833 100644 --- a/.github/workflows/sync-branches.yml +++ b/.github/workflows/sync-branches.yml @@ -1,6 +1,9 @@ name: Sync branches on: + # Starts when the Release workflow finishes. Every script runs from the default-branch + # checkout, never from the merged tree. + # jactionlint ignore=dangerous-triggers workflow_run: workflows: - Release @@ -120,7 +123,8 @@ jobs: persist-credentials: false - name: Load Claude model - run: echo "CLAUDE_MODEL=$(jq -r .claude.opus trusted/.github/ai-models.json)" >> "$GITHUB_ENV" + id: model + run: echo "model=$(jq -r .claude.opus trusted/.github/ai-models.json)" >> "$GITHUB_OUTPUT" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -134,6 +138,7 @@ jobs: bun-version-file: trusted/.bun-version # Same pinned release and isolated npm config as the AI review workflow. + # jactionlint ignore=adhoc-packages - name: Install Claude Code CLI run: | npm install -g \ @@ -146,6 +151,7 @@ jobs: working-directory: trusted env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + CLAUDE_MODEL: ${{ steps.model.outputs.model }} WORK_DIR: ${{ github.workspace }}/work run: | git -C "$WORK_DIR" config user.name "github-actions[bot]" @@ -246,7 +252,8 @@ jobs: persist-credentials: false - name: Load Claude model - run: echo "CLAUDE_MODEL=$(jq -r .claude.opus trusted/.github/ai-models.json)" >> "$GITHUB_ENV" + id: model + run: echo "model=$(jq -r .claude.opus trusted/.github/ai-models.json)" >> "$GITHUB_OUTPUT" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -260,6 +267,7 @@ jobs: bun-version-file: trusted/.bun-version # Same pinned release and isolated npm config as the AI review workflow. + # jactionlint ignore=adhoc-packages - name: Install Claude Code CLI run: | npm install -g \ @@ -276,6 +284,7 @@ jobs: working-directory: trusted env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + CLAUDE_MODEL: ${{ steps.model.outputs.model }} WORK_DIR: ${{ github.workspace }}/work run: | git -C "$WORK_DIR" fetch --no-tags "$OUTPUT_DIR/sync.bundle" HEAD diff --git a/.github/workflows/sync-repair.yml b/.github/workflows/sync-repair.yml index a9002a4085..dea2a6ec30 100644 --- a/.github/workflows/sync-repair.yml +++ b/.github/workflows/sync-repair.yml @@ -3,6 +3,9 @@ name: Sync repair # Once CI and the AI review finish on a Claude-resolved sync/develop-into-next pull request, lets Claude fix what # the merge broke and answer the review. See apps/cli/docs/release-process.md#claude-resolved-develop-into-next. on: + # Starts when the sync branch's checks finish. Every script runs from the default-branch + # checkout, never from the sync branch. + # jactionlint ignore=dangerous-triggers workflow_run: workflows: - CI @@ -55,7 +58,8 @@ jobs: persist-credentials: false - name: Load Claude model - run: echo "CLAUDE_MODEL=$(jq -r .claude.opus trusted/.github/ai-models.json)" >> "$GITHUB_ENV" + id: model + run: echo "model=$(jq -r .claude.opus trusted/.github/ai-models.json)" >> "$GITHUB_OUTPUT" - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: @@ -77,6 +81,7 @@ jobs: persist-credentials: false # Same pinned release and isolated npm config as the AI review workflow. + # jactionlint ignore=adhoc-packages - name: Install Claude Code CLI if: steps.collect.outputs.action == 'repair' run: | @@ -91,6 +96,7 @@ jobs: working-directory: trusted env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + CLAUDE_MODEL: ${{ steps.model.outputs.model }} WORK_DIR: ${{ github.workspace }}/work HEAD_SHA: ${{ steps.collect.outputs.head }} run: | @@ -119,6 +125,7 @@ jobs: HEAD_SHA: ${{ steps.collect.outputs.head }} CHANGED: ${{ steps.repair.outputs.changed }} run: | + set -o pipefail if [ "$(gh pr view "$PR" --repo "$GITHUB_REPOSITORY" --json headRefOid -q .headRefOid)" != "$HEAD_SHA" ]; then echo "::notice::The sync branch moved since the checks settled; skipping." exit 0 diff --git a/.github/workflows/verify-install-channels.yml b/.github/workflows/verify-install-channels.yml index 26bfa0d90b..66402ba70e 100644 --- a/.github/workflows/verify-install-channels.yml +++ b/.github/workflows/verify-install-channels.yml @@ -222,6 +222,9 @@ jobs: env: VERSION: ${{ inputs.version }} steps: + # This job exists to run the published install script. That script checks the tarball it + # downloads against the release's checksums.txt before using it. + # jactionlint ignore=unverified-download - name: Install via the published install script shell: bash run: | diff --git a/mise.lock b/mise.lock index 83da59b571..4b64eed8ee 100644 --- a/mise.lock +++ b/mise.lock @@ -172,74 +172,74 @@ url_api = "https://api.github.com/repos/golangci/golangci-lint/releases/assets/4 provenance = "github-attestations" [[tools.jactionlint]] -version = "1.8.2" +version = "2.3.0" backend = "github:jdx/jactionlint" -specifiers = ["1"] +specifiers = ["2"] [tools.jactionlint."platforms.linux-arm64"] -checksum = "sha256:7d618749dbddd762a14bd491ea97bc4f6599626f830a11edc6c6522ead8bcd05" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338576" +checksum = "sha256:deea7744e5769e1e5cc8c9898a838f80a941ec68476d9f2814a61474d5652dac" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210370" provenance = "github-attestations" [tools.jactionlint."platforms.linux-arm64-musl"] -checksum = "sha256:7d618749dbddd762a14bd491ea97bc4f6599626f830a11edc6c6522ead8bcd05" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338576" +checksum = "sha256:deea7744e5769e1e5cc8c9898a838f80a941ec68476d9f2814a61474d5652dac" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210370" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:907e6f6a59e181879f7e6936e19ee2eca1cbc51de134fb85460cfa8d65a71f28" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210498" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-baseline"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:907e6f6a59e181879f7e6936e19ee2eca1cbc51de134fb85460cfa8d65a71f28" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210498" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:907e6f6a59e181879f7e6936e19ee2eca1cbc51de134fb85460cfa8d65a71f28" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210498" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl-baseline"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:907e6f6a59e181879f7e6936e19ee2eca1cbc51de134fb85460cfa8d65a71f28" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210498" provenance = "github-attestations" [tools.jactionlint."platforms.macos-arm64"] -checksum = "sha256:de9eb05af3cde409dc0b37fe2fd6a21b875a575374e7b26c02d45a7086645c28" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338605" +checksum = "sha256:f96afa36578b21290203ae8df4fa7ac3bf5aba08ed288df28cb0530af7ca6e55" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210452" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64"] -checksum = "sha256:42790b2565759b7f4a81696fb9034b2060f97f551d2ced54cf722c9de9abe6b2" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338604" +checksum = "sha256:a61006b669ec0ab1266c73e3561eecf839537eb6e8b3b6be766a55ba17fcbe42" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210428" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64-baseline"] -checksum = "sha256:42790b2565759b7f4a81696fb9034b2060f97f551d2ced54cf722c9de9abe6b2" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338604" +checksum = "sha256:a61006b669ec0ab1266c73e3561eecf839537eb6e8b3b6be766a55ba17fcbe42" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210428" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64"] -checksum = "sha256:fd7be539cd3276d5178f85ef140c1bb52395b1ec1f59b1585050e1be3b0b194b" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338616" +checksum = "sha256:9864d1045bd37fddb2df33bf4d6b45de205c0ce133c52a225928b7ede7d7f3eb" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210534" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64-baseline"] -checksum = "sha256:fd7be539cd3276d5178f85ef140c1bb52395b1ec1f59b1585050e1be3b0b194b" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338616" +checksum = "sha256:9864d1045bd37fddb2df33bf4d6b45de205c0ce133c52a225928b7ede7d7f3eb" +url = "https://github.com/jdx/jactionlint/releases/download/v2.3.0/jactionlint_2.3.0_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/662210534" provenance = "github-attestations" [[tools.node]] diff --git a/mise.toml b/mise.toml index 5596a9bb89..a197d4db4c 100644 --- a/mise.toml +++ b/mise.toml @@ -3,7 +3,7 @@ min_version = '2026.10.17' [tools] go = "1.26.5" golangci-lint = "2.12.2" -jactionlint = "1" +jactionlint = "2" shellcheck = "0.11.0" [settings]