FIX 1 — security scanner install (gitleaks/osv/actionlint/zizmor):
the step ran under bash -e and aborted before the $GITHUB_PATH export when
'go install ...gitleaks/v8@latest' failed/produced a non-working binary, so no
scanner landed on PATH and every check self-skipped. Rewritten to set +e,
install from official release downloads, ALWAYS export $HOME/.local/bin, and
print diagnostics. Validated only on the next CI run (binaries install in CI).
FIX 2 — size-limit bundleSize: add @size-limit/file devDependency (the correct
preset for the plain FILE-size .size-limit.json) + allowlist entry. check:bundle-size
now measures the 4 bin entries via the preset (bundleSize=5601) instead of erroring
on the missing preset / falling back to fs.statSync.
FIX 3 — codeqlAlerts promoted to BLOCKING: check-codeql-ratchet.mjs now reads
metrics.codeqlAlerts.value, exits 1 ONLY on a real regression (measured > baseline),
and exits 0 (graceful skip) on any measurement failure (gh absent / no auth /
no repo / API error) so missing infra never blocks. Baseline seeded codeqlAlerts=0
(repo has 0 open alerts). Blocking step wired in the quality-gate job with
security-events:read; the duplicate advisory step removed from quality-extended.
New TDD: evaluateCodeqlRatchet (5 cases).
Move the committed quality-gate state files out of the repo root into
config/quality/ and the v3.8.24 documentation audit into docs/ops/, then
re-point every gate script, test and .gitignore entry at the new paths.
Refresh docs/architecture/REPOSITORY_MAP.md (stale since v3.8.2) to match
the current layout.
Moved -> config/quality/:
quality-baseline.json, complexity-baseline.json, duplication-baseline.json,
file-size-baseline.json, test-discovery-baseline.json,
dependency-allowlist.json, .license-allowlist.json
(generated quality-metrics.json now written here too; still gitignored)
Moved -> docs/ops/:
DOCUMENTATION_AUDIT_REPORT.md (+ meta.json entry + fabricated-docs skip)
Path updates: check-{complexity,duplication,file-size,test-discovery,deps,
licenses,dead-code,cognitive-complexity,type-coverage}.mjs, check-quality-
ratchet.mjs, collect-metrics.mjs, check-tracked-artifacts.mjs (+ its test and
check-deps test). Also gitignore /logs/ (was untracked-not-ignored).
Tracked root files: 56 -> 48. Tool configs left in root on purpose: most are
auto-discovered there, and the tsconfig variants have location-relative
files:[] arrays that would need 46 path rewrites for a 2-file gain.
Release v3.8.24 — see CHANGELOG.md [3.8.24] for the full notes and the PR description for the contributors hall. Integration of release/v3.8.24 into main.
CRITICAL white-screen bug from the build-output-isolation refactor: the standalone
server.js bakes distDir ("./.build/next") into its config and serves /_next/static
from <root>/.build/next/static — but assembleStandalone hard-coded the destination
to <outDir>/.next/static (+ sanitised/patched <outDir>/.next/{required-server-files,
server}). Result: the server's static dir was EMPTY → every JS/CSS chunk 404'd →
blank login page (health stayed 200, so it slipped past the health-only dry-run).
Mirror the distDir path (relative to projectRoot) for static, required-server-files
sanitization (was a silent no-op → 0 paths sanitised, now 11), and the Turbopack
chunk patch. Verified: booting the assembled bundle serves the webpack chunk 200.
Affects every consumer (npm/Docker/Electron/VPS).
Extract the shared copy/sync/sanitize logic (native assets, extra modules,
static/public, optional path-sanitize + turbopack-chunk-patch) from the three
divergent assembly scripts into one module. Wire build-next-isolated.mjs to call
it (in-place .next/standalone). Output is byte-identical to before — pure refactor.
Golden test + existing build-next-isolated tests (7/7) green; standalone retains
all natives + sidecars.
