From 4f0d6fd79fa6e4ea1d421061c3f47a36cd45b5f1 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 15:20:38 +0100 Subject: [PATCH 1/5] chore: remove changesets leftovers Remove the changesets versioning workflow (changesets/action without a publish input, which only added a Release check to every commit on main), the generated .changeset/README.md and the root CHANGELOG.md stub. changeset publish stays the publish command. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .changeset/README.md | 8 ------- .github/workflows/version.yml | 45 ----------------------------------- CHANGELOG.md | 3 --- 3 files changed, 56 deletions(-) delete mode 100644 .changeset/README.md delete mode 100644 .github/workflows/version.yml delete mode 100644 CHANGELOG.md diff --git a/.changeset/README.md b/.changeset/README.md deleted file mode 100644 index e5b6d8d6..00000000 --- a/.changeset/README.md +++ /dev/null @@ -1,8 +0,0 @@ -# Changesets - -Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works -with multi-package repos, or single-package repos to help you version and publish your code. You can -find the full documentation for it [in our repository](https://github.com/changesets/changesets) - -We have a quick list of common questions to get you started engaging with this project in -[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md) diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml deleted file mode 100644 index e003108a..00000000 --- a/.github/workflows/version.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Versioning packages - -on: - push: - branches: - - main - -concurrency: ${{ github.workflow }}-${{ github.ref }} - -jobs: - release: - name: Release - runs-on: ubuntu-latest - steps: - - name: Checkout Repo - uses: actions/checkout@v3 - - - name: Setup Node.js 20.x - uses: actions/setup-node@v3 - with: - node-version: 20.x - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} - - - name: Install Dependencies - run: npm i - - - name: Unset Git Hooks - run: git config --unset core.hooksPath - - - name: Create Release Pull Request - uses: changesets/action@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index 5c79a3c3..00000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,3 +0,0 @@ -# Changelog - -All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines. From aab203e57f3b2bd262ea8dc1d650a7db0dbc7ea8 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 15:34:07 +0100 Subject: [PATCH 2/5] fix: add a .dockerignore for the docs image The builder stage of the docs image copies the whole build context. Send only what the build needs (allow list: workspaces, build scripts, root manifests), so that local .env* files and other local files never reach the image, and drop dependencies and build output within. Closes #463 Co-Authored-By: Claude Opus 5.5 --- .dockerignore | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 00000000..17e2b9a9 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,23 @@ +# Only send what the docs image build needs to the build context (allow +# list): the workspaces, the build scripts and the root manifests read by +# `turbo prune`. Everything else, such as `.env*` files with secrets, never +# reaches the image +* +!apps/ +!packages/ +!scripts/ +!package.json +!package-lock.json +!turbo.json + +# Exclude local files within the included paths: environment files (except +# examples), dependencies and build output (rebuilt in the image) +**/.env* +!**/.env.example +**/node_modules +**/.next +**/.turbo +**/.vercel +**/coverage +**/dist +**/out From cfeb90e369e3683ca86012a1cd05f888737039ba Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 15:35:11 +0100 Subject: [PATCH 3/5] ci: pin actions and fix caches Pin every action to a full commit SHA on its current major version (checkout v7, setup-node v7, cache v6, semantic PR title v6, ssh-agent v0.10, push action v1.3.0 instead of master), with Dependabot keeping the pins up to date. Replace the node_modules caches, whose key hashed a file that doesn't exist and which used ::set-output, by the npm cache of setup-node in CI; releases use no dependency cache. Drop the force-with-lease input of the push action, which doesn't exist (the input is force_with_lease) and so never had an effect. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 11 +++++++ .github/workflows/pr_evaluation.yml | 42 ++++++-------------------- .github/workflows/publish.yml | 47 +++++++++++++---------------- 3 files changed, 41 insertions(+), 59 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..7ffb1898 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + # Actions in the workflows are pinned to commit SHAs; this keeps the pins + # (and their version comments) up to date, in one grouped pull request + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + groups: + github-actions: + patterns: ["*"] diff --git a/.github/workflows/pr_evaluation.yml b/.github/workflows/pr_evaluation.yml index de5cef4c..2121f48c 100644 --- a/.github/workflows/pr_evaluation.yml +++ b/.github/workflows/pr_evaluation.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event.action != 'edited' || github.event.changes.title != null }} steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -46,7 +46,7 @@ jobs: runs-on: ubuntu-latest needs: semantic_pr steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: List files with merge conflict markers run: git --no-pager grep "<<<<<<<" ":(exclude).github/" || true - name: Fail or succeed job if any files with merge conflict markers have been checked in @@ -61,27 +61,15 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - name: Use Node.js 20.x - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} + cache: npm - name: Install dependencies run: npm install @@ -99,31 +87,19 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node-version }} - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} + cache: npm - name: Cache Playwright id: playwright-cache - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cache/ms-playwright diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d311d89f..53116636 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -13,27 +13,17 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - name: Use Node.js 20.x - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - - - name: Get node version - id: node - run: | - echo "::set-output name=version::$(node -v)" - - - name: Get node_modules cache - uses: actions/cache@v4 - id: node_modules - with: - path: | - **/node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package.lock') }}-${{ steps.node.outputs.version }} + # No dependency cache in releases (cache poisoning); `package.json` + # sets `packageManager`, which would turn on npm caching by default + package-manager-cache: false - name: Install dependencies run: npm install @@ -47,12 +37,12 @@ jobs: # steps: # - name: Check out code - # uses: actions/checkout@v3 + # uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # with: # fetch-depth: 2 # - name: Use Node.js 20.x - # uses: actions/setup-node@v3 + # uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 # with: # node-version: 20.x @@ -62,7 +52,7 @@ jobs: # echo "::set-output name=version::$(node -v)" # - name: Get node_modules cache - # uses: actions/cache@v4 + # uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # id: node_modules # with: # path: | @@ -89,7 +79,7 @@ jobs: needs: - linters steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set env run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV - name: Remove 'v' from RELEASE_VERSION @@ -99,12 +89,12 @@ jobs: echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV shell: bash - name: Install SSH Client - uses: webfactory/ssh-agent@v0.7.0 + uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.DEPLOY_KEY }} - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main @@ -114,9 +104,12 @@ jobs: git config --global user.email "github-actions[bot]@users.noreply.github.com" - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x + # No dependency cache in releases (cache poisoning); `package.json` + # sets `packageManager`, which would turn on npm caching by default + package-manager-cache: false - name: Install dependencies run: npm ci @@ -183,9 +176,8 @@ jobs: git commit -m "bump: v$RELEASE_VERSION" - name: Push changes - uses: ad-m/github-push-action@master + uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0 with: - force-with-lease: true ssh: true branch: main @@ -195,7 +187,7 @@ jobs: needs: bump-monorepo steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main @@ -210,9 +202,12 @@ jobs: shell: bash - name: Setup Node.js 20.x - uses: actions/setup-node@v3 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x + # No dependency cache in releases (cache poisoning); `package.json` + # sets `packageManager`, which would turn on npm caching by default + package-manager-cache: false - name: Login to npm run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc From 51263de249a3a671ee4d5ebda774779f1ee32ae5 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 16:15:46 +0100 Subject: [PATCH 4/5] ci: prefix Dependabot titles, tidy comments Give Dependabot pull requests a ci: prefix, so that their titles pass the PR title check. Keep the commented-out release tests job as it was and state the release cache comment once. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 3 +++ .github/workflows/publish.yml | 12 +++++------- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7ffb1898..44066b76 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,9 @@ updates: # (and their version comments) up to date, in one grouped pull request - package-ecosystem: github-actions directory: / + # Pull request titles must be Conventional Commits (PR title check) + commit-message: + prefix: ci schedule: interval: monthly groups: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 53116636..b695d5b6 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -37,12 +37,12 @@ jobs: # steps: # - name: Check out code - # uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # uses: actions/checkout@v3 # with: # fetch-depth: 2 # - name: Use Node.js 20.x - # uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + # uses: actions/setup-node@v3 # with: # node-version: 20.x @@ -52,7 +52,7 @@ jobs: # echo "::set-output name=version::$(node -v)" # - name: Get node_modules cache - # uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + # uses: actions/cache@v4 # id: node_modules # with: # path: | @@ -107,8 +107,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - # No dependency cache in releases (cache poisoning); `package.json` - # sets `packageManager`, which would turn on npm caching by default + # No dependency cache in releases, see above package-manager-cache: false - name: Install dependencies @@ -205,8 +204,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x - # No dependency cache in releases (cache poisoning); `package.json` - # sets `packageManager`, which would turn on npm caching by default + # No dependency cache in releases, see above package-manager-cache: false - name: Login to npm From 78891fef9618ee99dc49bfe75bc8d232464a5875 Mon Sep 17 00:00:00 2001 From: Alex Kanitz Date: Mon, 26 Oct 2026 16:56:02 +0100 Subject: [PATCH 5/5] ci: run tests on Ubuntu 24.04 ubuntu-latest now is Ubuntu 26.04, on which Playwright 1.56 can't install its browsers, so every test job fails (unrelated to the other changes). Pin the test job to ubuntu-24.04 until Playwright is upgraded. Refs #465 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr_evaluation.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr_evaluation.yml b/.github/workflows/pr_evaluation.yml index 2121f48c..ac026971 100644 --- a/.github/workflows/pr_evaluation.yml +++ b/.github/workflows/pr_evaluation.yml @@ -79,7 +79,9 @@ jobs: tests: name: Test checks - runs-on: ubuntu-latest + # Playwright 1.56 can't install its browsers on Ubuntu 26.04, which + # `ubuntu-latest` now is; move on when Playwright is upgraded + runs-on: ubuntu-24.04 needs: semantic_pr strategy: matrix: