Repository navigation
chore(release): prepare quality 1.4.0 - #56
Merged
Merged
Conversation
Refresh all documentation surfaces while preserving Quality's blue identity. Add responsive navigation, view transitions, keyboard and accessibility coverage, and shared guide navigation. Upgrade compatible dependencies, remove stale tooling exceptions and unused code, preserve operational Action errors, and harden the release workflow. Generate the 1.4.0 release metadata and document local validation and publication boundaries.
Remove duplicate chevrons and padding overrides so mobile guide controls retain the native Lumen spacing and disclosure indicator.
Center desktop navigation and group utilities on one opaque surface. Preserve Quality colors, mobile dialog behavior, and accessible controls.
Preserve existing permissions before writing atomic replacements. Respect umask for new files and normalize Git paths relative to the selected root. Add regression tests and resolve SVG spelling diagnostics.
Plan analyzer commands without executing them using --dry-run and --explain. Cover changed inputs, workspace scope, custom tasks and argument validation.
Verify explicitly enabled analyzers retain root commands without workspace markers.
Use Astro 4.1.0 and umbrella 4.2.0 from the published manifest. Validation: pnpm run validate.
Reuse Quality and Turbo selection while retaining full release gates. Add conservative fallbacks, regression tests, and isolated benchmarks.
Keep patched dependencies within existing consumer majors and rebuild the Action bundle. Document security overrides and the successful audit for the 1.4.0 candidate.
Generate release notes for the included CLI fixes and affected-validation pilot. Consume pending Changesets and align the private workspace Node minimum.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Preserve configuration compatibility with the maintained YAML parser on Rust 1.85. Deny Rust audit warnings without write credentials and refresh CodeQL on main. Use actual PR bases for affected validation into release branches.
Check the standalone cargo-audit version and wait for enlarged text before measuring page width. Record successful Action and site validation from ordinary PR #57.
Expose hosted browser layout diagnostics without relaxing the overflow assertion.
Wrap long heading words inside their container without reducing text size. Verify heading and page containment after applying text enlargement directly.
santi020k
added a commit
that referenced
this pull request
Oct 25, 2026
The first mobile-menu click on the deployed site was lost while Lumen’s dialog controller downloaded (reproduced in all five production retries after #56 merged). Native `command` / `commandfor` attributes now open and close the existing Lumen dialog immediately in supporting browsers. Lumen retains its existing fallback for browsers without native command support. The regression deliberately holds the controller request, exercises pointer and keyboard activation, close and Escape, then verifies the initialized Lumen fallback with native command attributes removed. Site version 0.3.1 and its changelog were generated through Changesets; CLI and Action remain at the unpublished 1.4.0. Validation: - New regression failed against the original implementation. - `pnpm validate` passed, including zero-warning quality checks, tests, builds, dependency audit, version consistency, and Action bundle verification. - `CI=true pnpm test:site`: 64 passed, 2 expected desktop skips for mobile-only contracts. - Fresh independent review of the complete diff: no actionable findings. Release completion: - The original Release run 40243267739 was cancelled before publication; no v1.4.0 tag or release was created. - Merge after CI and review, verify the normal site deployment, then dispatch Release from the new merged main revision. Do not rerun publication from the older #56 merge commit. - The upstream `http-cache-semantics` 4.3.0 OpenSSF warning remains documented in RELEASING.md without suppressions or lowered thresholds. No wider pilot rollout is included here. - No data or CLI migration. Before publication, fix any remaining candidate issue through this workflow. After publication, use a new patch version and never replace the version tag; site recovery uses a reviewed revert through the normal main deployment workflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare Quality 1.4.0 with CLI check previews, safer file handling, refreshed documentation, and an affected-validation pilot in this repository.
quality check --dry-run/--explain; preserve file permissions during atomic writes and scope changed-file discovery beneath a nested--root.serde_yaml/ unmaintainedunsafe-libyamlwith maintainedyaml_serde 0.10.7andlibyaml-rs.--deny warnings, read-only permissions, no advisory exceptions, and a fresh advisory database. This removes the old Action's Node 20 and Checks API reporting warnings. Check the standalone executable's version explicitly.Validation and review
pnpm validate: passed locally, including seven analyzers, package tests/builds, playground verification, all 32 repository script tests, release metadata, Action bundle reproducibility, and zero known npm vulnerabilities.--deny warnings: passed. The original lockfile fails the same command on RUSTSEC-2024-0449, confirming the warning is enforced.d5e6011a0ea5b4387d47c61a942862dfe42ec1bd: full validation and browser checks, Linux/macOS/Windows, CodeQL, Rust audit, Dependency Review, and PR title.mode: full, no skipped checks, and exit code zero: 52.28 s validation, with all 63 browser checks passing separately in 48.4 s. Rust Audit has no warning annotations. The only remaining warning is the upstream Scorecard signal below; GitHub runner migration/capacity notices are informational.Ordinary-PR pilot verification
PR #57 used ordinary PR events against the actual unmerged release base, without overriding change selection. It was closed without merging its harmless comments.
Both saved reports confirm affected mode and the expected workspace. Live npm audits, all 32 repository script checks, and Changeset checks against the actual PR base passed in both cases. Release validation remains full.
The benchmark and hosted evidence retain the controlled local measurements: warm deterministic validation improved by 79% for README edits, 61% for Action tests, 77% for site content, and 16% for Rust source. Hosted samples have different cache/runner conditions and exclude setup and queueing; they prove selection and retained coverage, not a controlled end-to-end speedup. The failed initial benchmark audit and intermediate hosted failures remain documented rather than counted as successful release gates.
Remaining upstream warning
Dependency Review still reports upstream
http-cache-semantics 4.3.0OpenSSF Scorecard 2.9, below the existing threshold of 3. It is the latest stable version, and current Astro still depends on it. Quality cannot fix the upstream repository's review, branch protection, security policy, fuzzing, and static-analysis controls. No exclusion, lower threshold, or advisory suppression was added. The vulnerability audit passes; this upstream maintenance signal remains visible and should be reassessed before wider rollout.Compatibility and recovery
Public 1.x CLI, configuration, reports, exit codes, and Action inputs remain compatible; Rust 1.85 remains supported. The private development workspace requires Node >=22.19.0 to match an existing dependency; contributors on 22.18 must update. The Action stays on Node 24. No persisted-data migration is needed.
To disable affected CI, set
QUALITY_CI_FULL=truein both validation jobs;pnpm validateandpnpm test:siteremain available. Publication must use the GitHub release workflow after merge. If a published release fails, prepare a patch through that workflow without moving published tags; recover the site through a reviewed follow-up deployment from main.This task does not merge the release, publish packages, deploy the site, or roll the pilot out to other repositories.