mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-21 06:12:17 +03:00
Compare commits
5 Commits
fix/sec-im
...
fix/releas
| Author | SHA1 | Date | |
|---|---|---|---|
|
831bb0f28f | ||
|
|
f47f5ad32d | ||
|
|
9656084454 | ||
|
|
e58014a41a | ||
|
|
41d379d880 |
@@ -0,0 +1 @@
|
||||
- **test(models):** Pin `CATALOG_BUILD_TIMEOUT_MS` in the #12058 canonical-catalog regression so a cold catalog build racing the 8s default bound no longer flakes the suite with a 500 ([#12732](https://github.com/diegosouzapw/OmniRoute/issues/12732))
|
||||
1
changelog.d/maintenance/0000-pack-policy-opencode-v2.md
Normal file
1
changelog.d/maintenance/0000-pack-policy-opencode-v2.md
Normal file
@@ -0,0 +1 @@
|
||||
- **fix(ci):** Allow `@omniroute/opencode-plugin-v2/` in the npm pack policy — [#12870](https://github.com/diegosouzapw/OmniRoute/pull/12870) shipped the v2 plugin beside its v1 sibling without widening the allowlist, so every packed file under it read as an unexpected artifact and failed `check:pack-policy` ([#12732](https://github.com/diegosouzapw/OmniRoute/issues/12732))
|
||||
@@ -0,0 +1 @@
|
||||
- **fix(ci):** Point the release-green validator's pack gate at the tree it is validating — the build-provenance guard defaulted to `origin/main`, which a release branch tip can never be an ancestor of mid-cycle, so `Package artifact` reported a false red on every run and the tarball boot-smoke cascaded off it ([#12732](https://github.com/diegosouzapw/OmniRoute/issues/12732))
|
||||
@@ -169,6 +169,9 @@ export const PACK_ARTIFACT_ROOT_ALLOWED_EXACT_PATHS: string[] = [
|
||||
|
||||
export const PACK_ARTIFACT_ROOT_ALLOWED_PATH_PREFIXES: string[] = [
|
||||
"@omniroute/opencode-plugin/",
|
||||
// #12870 shipped the v2 plugin beside its v1 sibling but never widened this
|
||||
// allowlist, so every packed file under it read as an unexpected artifact.
|
||||
"@omniroute/opencode-plugin-v2/",
|
||||
"@omniroute/opencode-provider/",
|
||||
"bin/cli/",
|
||||
// Broad open-sse + src source dirs added to package.json "files" in v3.8.21
|
||||
|
||||
@@ -399,6 +399,22 @@ export function classifyRunError(err, timeoutMs) {
|
||||
// every one a false-positive red against the release branch).
|
||||
const HERMETIC_SCRUB = ["OMNIROUTE_API_KEY", "OMNIROUTE_URL"];
|
||||
let hermetic = false;
|
||||
/**
|
||||
* Env for the pack gate's provenance guard (#10427).
|
||||
*
|
||||
* `validate-pack-artifact.ts` checks `dist/BUILD_SHA` for ancestry against
|
||||
* `OMNIROUTE_RELEASE_REF`, defaulting to `origin/main`. That default is right at
|
||||
* PUBLICATION (npm-publish.yml runs on main) but structurally impossible here: this
|
||||
* validator runs ON a release branch, whose tip is by definition NOT an ancestor of
|
||||
* main mid-cycle, so the gate reported `off-release-line` on every single run and the
|
||||
* tarball boot-smoke cascaded off it. `ci.yml` already resolves the same problem for
|
||||
* `pull_request` by pointing the ref at the head under test; the checkable invariant
|
||||
* here is identical — "the stamp matches the tree we just validated" — so point it at
|
||||
* HEAD. This does not relax the guard: a dist/ built from some other commit still
|
||||
* fails, and a missing BUILD_SHA still fails.
|
||||
*/
|
||||
const PACK_GATE_ENV = { OMNIROUTE_RELEASE_REF: "HEAD" };
|
||||
|
||||
function buildGateEnv(extra) {
|
||||
const env = { ...process.env, FORCE_COLOR: "0", ...(extra || {}) };
|
||||
if (hermetic) for (const k of HERMETIC_SCRUB) delete env[k];
|
||||
@@ -698,12 +714,13 @@ async function main() {
|
||||
id: "pack-artifact",
|
||||
label: "Package artifact (npm pack policy)",
|
||||
args: ["run", "check:pack-artifact"],
|
||||
env: PACK_GATE_ENV,
|
||||
timeout: 20 * 60 * 1000,
|
||||
});
|
||||
}
|
||||
slow.forEach((g) => announce(`${g.label} [parallel]`));
|
||||
const slowResults = await Promise.all(
|
||||
slow.map((g) => runAsync(npmCmd, g.args, { timeout: g.timeout }))
|
||||
slow.map((g) => runAsync(npmCmd, g.args, { timeout: g.timeout, env: g.env }))
|
||||
);
|
||||
slow.forEach((g, i) => {
|
||||
const { code, out } = slowResults[i];
|
||||
@@ -754,6 +771,7 @@ async function main() {
|
||||
} else if (WITH_BUILD) {
|
||||
// --with-build without the suites (--quick): still verify the package artifact.
|
||||
const { code, out } = await runAsync(npmCmd, ["run", "check:pack-artifact"], {
|
||||
env: PACK_GATE_ENV,
|
||||
timeout: 20 * 60 * 1000,
|
||||
});
|
||||
saveGateLog("pack-artifact", out);
|
||||
|
||||
@@ -24,6 +24,15 @@ import path from "node:path";
|
||||
|
||||
const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-12058-"));
|
||||
process.env.DATA_DIR = TEST_DATA_DIR;
|
||||
// Every `getRows()` call resets the builder, so each one is a *cold* catalog
|
||||
// build. That path is bounded by `CATALOG_BUILD_TIMEOUT_MS` (8s by default),
|
||||
// and a cold build of the full catalog already costs ~7s on an idle box before
|
||||
// the fire-and-forget upstream usage refreshes land — so on a loaded CI runner
|
||||
// the bound trips and `getRows()` sees a 500 instead of the rows under test.
|
||||
// That budget is not what this regression covers (row shaping in canonical
|
||||
// mode is), so pin it out of the way exactly like #12627 does. Every
|
||||
// assertion below is unchanged.
|
||||
process.env.CATALOG_BUILD_TIMEOUT_MS = "120000";
|
||||
|
||||
const core = await import("../../src/lib/db/core.ts");
|
||||
const providersDb = await import("../../src/lib/db/providers.ts");
|
||||
|
||||
Reference in New Issue
Block a user