Repository navigation
fix: refresh dependencies and pause automatic publication - #39
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This was referenced Oct 2, 2026
Closed
ts-76
changed the title
This was referenced Oct 2, 2026
ts-76
marked this pull request as ready for review
October 3, 2026 09:31
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Release creation has verification-race and partial-success recovery issues, while the publish CLI audit remains blocked.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Refreshes dependencies and migrates publishing from semantic-release to an audited Release Please workflow.
Changes:
- Updates application/UI dependencies and lockfiles.
- Adds Release Please configuration, validation, and release documentation.
- Introduces pinned npm publishing, audits, and offline package checks.
| File | Description |
|---|---|
.github/publish-cli/package-lock.json |
Locks the publishing CLI tree. |
.github/publish-cli/package.json |
Pins npm 11.20.0. |
.github/workflows/ci.yml |
Adds UI checks and package validation. |
.github/workflows/release.yml |
Implements staged release and publication jobs. |
.github/workflows/security.yml |
Expands dependency auditing. |
.release-please-manifest.json |
Seeds version 1.3.0. |
biome.json |
Updates the Biome schema and preset. |
bun.lock |
Locks refreshed root dependencies. |
docs/releasing.md |
Documents the release process and blocker. |
package-lock.json |
Locks npm dependency updates. |
package.json |
Updates dependencies and release scripts. |
release-please-config.json |
Configures Release Please. |
release.config.mjs |
Removes semantic-release configuration. |
scripts/publish-dry-run.mjs |
Validates package contents offline. |
scripts/release-control.mjs |
Controls Release Please operations. |
test/command-boundaries.test.ts |
Isolates home-path behavior. |
test/helpers.ts |
Canonicalizes temporary paths. |
test/release-process.test.ts |
Tests release version updates. |
ui/bun.lock |
Locks refreshed UI dependencies. |
ui/package.json |
Updates UI tooling and typechecking. |
Files not reviewed (1)
- .github/publish-cli/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
ts-76
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the application/UI dependencies and replace the main-push semantic-release pipeline with verified Release Please proposals. Automatic GitHub tags/releases and npm publication are intentionally disabled: current npm publisher bundles include an unpatched dependency. Main pushes now verify the project and maintain a release PR without publishing anything.
release.ymlto verification and release-PR creation. Release-PR creation depends on full verification. Retain the workflow filename and existing GITHUB_TOKEN permissions; remove the OIDC/publish jobs and all tag/release creation code. Explicitly reject the formerreleasecommand even inside main Actions.bun pm pack --ignore-scriptsand checks against the real tarball: package name/version, both CLI aliases, CLI/UI assets and LICENSE. No publish command or lifecycle script runs. A future audited publisher requires a separate reviewed implementation; this PR cannot enable publication through ordinary main/release-PR merges.Validation at 572d4c2
Node 24.19.0 / Bun 1.3.13: frozen root/UI installs, lint, root/UI TypeScript, 35 tests in 5 files, full CLI/UI build, source/built CLI help and real tarball checks pass. New regressions exercise tag-command refusal and the verified, publication-free workflow configuration.
Root Bun audit, UI Bun audit and root npm audit: 0 vulnerabilities. The deleted publisher previously audited at 24 (23 high, 1 moderate); testing official npm 11.21.0 produces the same findings, including http-cache-semantics with no patched release. It remains removed while publication is disabled, rather than being ignored in Security.
A local integration with the final #44–#47 feature stack passes 103 CLI/API/release tests + 29 UI tests, lint, root/UI types, svelte-check (0 errors/warnings), CLI/UI build, real tarball checks and all three audits (0 findings). It is not pushed or merged to main. Previous browser checks on those feature PRs remain documented; no new browser run is claimed for this workflow-only correction.
Draft is removed. Existing Copilot threads are resolved; the affected tag-creation paths are now removed. Fresh Copilot review was unavailable because the requesting account exhausted its quota. All final-head required checks pass; one approving review remains required by main protection. No protection bypass, main merge, actual tag/release/npm publication, auth/token creation, new permission or global Devbox/chezmoi change occurred.