Repository navigation
chore(deps-dev): bump @types/node from 26.6.1 to 26.6.2 - #107
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
|
PR author is in the excluded authors list. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
unbraind
added a commit
that referenced
this pull request
Sep 22, 2026
… lint and duplication gates (#108) * Certify pm CLI 2026.9.21 and adopt the canonical pm-ops merge-driver, lint and duplication gates Fleet wave of 2026-09-22 (epic pm-cli-website-5s6z). This PR moves pm-ts-starter onto the canonical pm-ops exports and certifies the new pm CLI: - Pins: @unbrained/pm-cli 2026.9.17 -> 2026.9.21, pm-ops 2026.9.13 -> 2026.9.18 and pm-changelog 2026.9.16 -> 2026.9.18 (exact, in package.json and package-lock.json). Absorbs Dependabot PR #107 by bumping the lockfile's @types/node to 26.6.1 within the unchanged ^26.2.0 range. - Merge driver: scripts/prepare-merge-driver.ts is now the thin launcher over the canonical pm-ops/merge-driver export (146-line vendored implementation removed); CI runs ./node_modules/.bin/pm merge install before ./node_modules/.bin/pm health --strict-exit --require-merge-drivers. Measured: npm ci registers all five merge drivers, node scripts/prepare-merge-driver.ts exits 0, health exits 0. - Lint + duplication gates: new thin launchers scripts/lint.ts and scripts/duplication-gate.ts over pm-ops/eslint and pm-ops/duplication, wired into release:check (right after typecheck) and CI, with a duplicationGate block of threshold 0 / minTokens 50. Measured before: 1 lint error (duplicate import in test/smoke.test.ts) and 3.09% duplicated lines / 23 jscpd clone pairs. Measured after: npm run lint 0 findings (exit 0) and npm run duplication 0.00% / 0 clone pairs (exit 0). Every finding was fixed in code through shared helpers and table-shaped refactors (setUpPmWorkspace, withFakePmOnPath, runSetupWizard, assertAllHooksQuiet, runPassThroughPreflightOverride, createGateFixture/assertGateFails/runGateWithRunner); no eslint-disable, no ignore lists, no threshold changes, and every assertion is kept. - Tests: the vendored merge-driver implementation tests are deleted in favour of a launcher test (pm-ops covers the canonical installer); 193 -> 178 tests, all passing, coverage stays at 100/100/100 lines/branches/functions (exit 0). - Docs: README names the launcher in the multi-agent merge safety section; CHANGELOG regenerated with changelog:full. npm run release:check exits 0. pm items: pm-ts-starter-jwgz (Task, closed+released), pm-ts-starter-s2kh (Issue, closed+released - its lint and duplication halves are delivered here). * Fix the release workflow's late-publish reporting and bun-dependent Release creation Hub item pm-cli-website-3y5d, tracked here as pm-ts-starter-beto (created, closed and released in this PR). The hub's anchored patcher edited this repo's own .github/workflows/release.yml in place (matched: 1, refused: 0; never a copied file): - Publish reconcile window widens from 5 x 30 s to 20 x 30 s (10 minutes) using `npm view --prefer-online`, so a stale cache can neither fake nor hide visibility, and the never-visible failure message now states exactly what is known instead of the false "failed after 3 attempts". The unattested-occupant refusal is preserved byte-for-byte. - "Create GitHub release" no longer depends on the bun mirror: it runs whenever the publish (new step id `publish`) and the tag push succeeded, and a new gate step "Fail the job on bun verification failure" fails the job visibly after the 10-minute bun window instead of silently skipping the Release. - New "Backfill missing GitHub releases" step creates missing Releases for attested tags with tag-scoped pm-changelog notes, best-effort, so old tag-without-Release gaps close themselves. Proofs: grep -c "reconcile_attempts=20" = 1, grep -c "seq 1 20" = 1, grep -c "Backfill missing GitHub releases" = 1, and the workflow names only unbraind/pm-ts-starter. Stub harness against this repo's patched file: PASS=5 FAIL=0 (the unpatched file fails 4/5). actionlint clean. npm test 178/178, changelog regenerated with changelog:full, release:check exits 0. * Run the CI type check once, before the lint and duplication gates The certify commit inserted a Type check step ahead of the new Lint and Duplication gate steps but left the original Type check below them, so every Node 22 and Node 26 job ran the full tsc --noEmit pass twice. Keep the single step in front of the gates it guards. Found by Greptile review on this PR. * Re-check bun after the final pause and backfill only real release tags Two review findings on the release-window fix, both confirmed with the stub harness that executes the changed run blocks: - Bun verification (Greptile P1, CodeRabbit minor): the widened loop slept 30 s after its 20th failed attempt and then gave up without reading again, so a version that became installable during that last pause still failed the job. It is now 21 attempts with pauses only between them (20 x 30 s, the same 10-minute window), and the error names the real attempt count. New scenario s6 (bun resolves at the 10-minute mark) fails on the old loop and passes on this one. - Backfill tag selection (CodeRabbit major): the glob admitted v2026.09.18foo, whose day part breaks the 10# arithmetic and, under set -e, the step, and v2026.09.20-rc.1, an unintended prerelease backfill. Tags are now filtered with an anchored ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(-[0-9]+)?$ that keeps the same-day -N suffix, and the step is continue-on-error so an outage there can never cancel today's release. New scenario s7 fails on the glob and passes on the filter. The harness now passes 7/7 on three consecutive runs. It also runs every block with the scenario directory as HOME and aborts unless npm, npx, gh, git and bun resolve to stubs, so a PATH surprise can never reach a real registry (verified adversarially: 9 aborts, no block executed). * State the real install contract of the canonical merge-driver launcher The prepare launcher statically imports pm-ops, a devDependency, so the README's promise that production / --omit=dev installs cannot break was only true for registry installs (npm never runs prepare for a registry tarball). A production install of a clone omits pm-ops as well and must pass --ignore-scripts, which is what this fleet's own Dockerfiles do. Raised by Greptile and Sourcery on pm-starter#113. The canonical guarded launcher is tracked as companion item pm-cli-website-xy19. * Let CI prove that npm ci's prepare hook installs the merge drivers CI ran an explicit pm merge install right before pm health --require-merge-drivers, so the gate only verified the step before it and would have passed with a broken prepare hook. Without that step, the health gate asserts what a fresh clone actually relies on: npm ci runs the prepare launcher, which installs the drivers through pm-ops/merge-driver. Verified on a fresh git clone: no merge.pm* keys before npm ci, all of them after, and pm health --strict-exit --require-merge-drivers exits 1 once they are removed. Raised by Greptile on pm-github#93. * Drop the release backfill step until it can verify provenance ancestry The backfill created a GitHub Release for any fleet-shaped tag whose npm version carried some attestation, without proving the tag's commit produced that artifact, so a stale, moved or hand-made tag could get a misleading Release. Comparing the attested commit with the tag commit is not the fix either: this fleet's provenance names the workflow trigger commit, measured as the tag's direct parent on three real releases. The correct check (same repository and workflow, attested commit an ancestor of the tag) belongs in the canonical pm-ops release verifier. The 10-minute npm visibility window and the Release decoupled from bun mirror lag remain; they fix the root causes. Raised by Greptile on pm-brief#124 and pm-linear#121. * Declare max_attempts before use and correct the wave's pm records - release.yml: max_attempts is declared before refuse_unattested_or_fail, which expands it, so its visibility no longer depends on call-time reasoning (the fleet's bindings-before-use rule; Greptile on pm-todos#99). Behaviour is unchanged. - pm records: the release Issue no longer claims the backfill that review removed, and the certify Task describes CI as it now is (health gate right after npm ci, no separate install step). The final release.yml is byte-identical to a fresh run of the anchored applier on origin/main (identical). * Make every closure field of the release Issue match the final scope The resolution, expected result and close reason still described the backfill step that review removed, and the close reason cited the earlier 7-scenario harness run. All three now state the two changes that ship, the 5 applicable harness scenarios, and that the backfill moved to companion item pm-cli-website-mxrp. Raised by Greptile on pm-slack#115. --------- Co-authored-by: SteveBot <1153461+unbraind@users.noreply.github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.6.1 to 26.6.2. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/types/node-26.6.1
branch
from
September 22, 2026 06:35
01ebf51 to
7152341
Compare
Owner
|
Verified by hand (bot-authored PRs get no AI review here): only package manifests change, the lockfile resolves @types/node@26.6.2 exactly as the title states, the branch is level with main (which now carries the 2026.9.21 certification and the canonical pm-ops merge driver), and both required test jobs are green on this head. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @types/node from 26.6.1 to 26.6.2.
Commits