fix(release): resync the electron lockfile and let a dispatch build from a repaired ref by diegosouzapw · Pull Request #11982 · cheaper-inference/OmniRoute

diegosouzapw · 2026-08-29T07:17:40Z

Achado (redisparo do Electron para v3.8.50, run 33238093090)

Leg Linux morreu em npm ci dentro de electron/:

Missing: electron-builder-squirrel-windows@26.15.3 from lock file (+ 12 transitivos: electron-winstaller, @electron/windows-sign, …)

A subárvore opcional do instalador Windows do electron-builder tinha sido perdida na última regeneração do lock — e nenhum CI rodou os legs do desktop desde então (v3.8.49 nunca rodou; v3.8.50 morreu na inicialização, #11973). A tag v3.8.50 carrega o lock quebrado.

O que muda

electron/package-lock.json: npm install --package-lock-only devolve as 13 entradas (271 → 284). Prova: npm ci --ignore-scripts numa cópia limpa: exit 0, 284 pacotes.
electron-release.yml: input build_ref (default = a tag da versão) para o dispatch buildar a partir de uma linha reparada quando a própria tag não builda. Push de tag não muda.

Validação

actionlint limpo; electron-release-desktop-channel-8949 4/4, electron-release-efficiency 3/3, electron-release-latest-yml.repro 2/2, check-workflows 32/32.

Depois do merge

gh workflow run electron-release.yml --ref main -f version=v3.8.50 -f build_ref=main -f publish_npm=false (com ELECTRON_SHARED_STANDALONE=disabled ligado por #11979) → os 4 legs anexam os assets à release existente.

…rom a repaired ref The v3.8.50 desktop re-dispatch (run 33238093090) lost its Linux leg at `npm ci` in electron/: "Missing: electron-builder-squirrel-windows@26.15.3 from lock file" plus its 12 transitive entries — the optional Windows-installer subtree of electron-builder had been dropped when the lock was last regenerated, and no CI ran the desktop legs between then and the tag (v3.8.49 never ran them; v3.8.50 died at startup, #11973). `npm install --package-lock-only` restores the 13 entries; a clean `npm ci --ignore-scripts` on the result adds 284 packages with no complaint. The tag itself carries the broken lock, and the workflow now checks out the tag on dispatch (#11973), so a dispatch input `build_ref` (default: the version tag) lets the operator name the repaired line — the v3.8.50 assets will be rebuilt from main, which is 3.8.50 plus its post-release fixes. Push-triggered runs are unaffected. actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro and check-workflows suites pass.

`generate_release_notes: true` on an existing release APPENDS GitHub's auto-generated "What's Changed" block to the curated body — the v3.8.50 re-dispatch (run 33238093090) added 1,416 chars to the 121 KB notes. Only the tag push should generate notes.

github-actions · 2026-08-29T08:07:21Z

CI Coverage Report

Coverage job: cancelled
PR test policy: success

Coverage artifact was not available for this run.

…SBOM on dispatch (twin of #11982 + #12020) (#12022) * fix(release): resync the electron lockfile, build a dispatch from a repaired ref, keep curated notes, attach the SBOM on dispatch (release/v3.8.51 twin of #11982 + #12020) Same four changes as #11982 and #12020 on main, applied to this branch's own copies: - electron/package-lock.json regenerated (271 -> 284 entries): the optional electron-builder-squirrel-windows subtree was missing and `npm ci` refused the lock (EUSAGE) on the Linux and macOS legs; a clean `npm ci --ignore-scripts` on the result exits 0. - electron-release.yml: `build_ref` dispatch input (default: the version tag) and `generate_release_notes` only on the tag push (a re-attach dispatch appended GitHub's auto notes to the curated body on v3.8.50). - npm-publish.yml: the SBOM attaches to the GitHub Release on workflow_dispatch publishes too, whenever a release for the tag exists. actionlint and prettier clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro, check-workflows and npm-publish-artifact-provenance suites pass. * fix(release): validate build_ref in the validate job before any checkout uses it CodeQL (actions/cache-poisoning/poisonable-step, high) on release/v3.8.51 — the default branch: a raw dispatch input checked out next to setup-node's npm cache is a cache-poisoning vector. The input now goes through the validate job's regex allowlist (main or release/vX.Y.Z, empty = the version tag) and every build job checks out needs.validate.outputs.build_ref, never the input itself. * fix(release): drop the build_ref input — a dispatch builds the ref it is dispatched on CodeQL (actions/cache-poisoning/poisonable-step) tracks the input through the validate job's output regardless of the regex allowlist: an input-controlled checkout next to setup-node's npm cache on the default branch is a cache-poisoning vector. The ref is not an input any more; the checkouts use github.ref, so `gh workflow run electron-release.yml --ref v3.8.50 -f version=v3.8.50` rebuilds the tag and `--ref main` builds the repaired line. The tag-push path is unchanged.

…rom a repaired ref (cheaper-inference#11982) * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref The v3.8.50 desktop re-dispatch (run 33238093090) lost its Linux leg at `npm ci` in electron/: "Missing: electron-builder-squirrel-windows@26.15.3 from lock file" plus its 12 transitive entries — the optional Windows-installer subtree of electron-builder had been dropped when the lock was last regenerated, and no CI ran the desktop legs between then and the tag (v3.8.49 never ran them; v3.8.50 died at startup, cheaper-inference#11973). `npm install --package-lock-only` restores the 13 entries; a clean `npm ci --ignore-scripts` on the result adds 284 packages with no complaint. The tag itself carries the broken lock, and the workflow now checks out the tag on dispatch (cheaper-inference#11973), so a dispatch input `build_ref` (default: the version tag) lets the operator name the repaired line — the v3.8.50 assets will be rebuilt from main, which is 3.8.50 plus its post-release fixes. Push-triggered runs are unaffected. actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro and check-workflows suites pass. * fix(release): do not regenerate release notes on a re-attach dispatch `generate_release_notes: true` on an existing release APPENDS GitHub's auto-generated "What's Changed" block to the curated body — the v3.8.50 re-dispatch (run 33238093090) added 1,416 chars to the 121 KB notes. Only the tag push should generate notes. # Conflicts: # .github/workflows/electron-release.yml

…leware redirect (#13140) * fix(release): let the Electron workflow start again — grant actions:read to the npm leg (#11973) v3.8.50 shipped with zero desktop assets. The tag push did trigger electron-release.yml (run 33005490476) but GitHub refused the run at startup: Error calling workflow 'npm-publish.yml@5458026'. The nested job 'publish' is requesting 'actions: read', but is only allowed 'actions: none'. npm-publish.yml's `publish` job gained `actions: read` (it downloads the next-build artefact) and the caller job here never widened its grant — a reusable workflow may not request more than its caller allows, and the refusal is a startup failure of the WHOLE run, so the `release` job that attaches the installers, the source archives and the SBOM never ran either. Nothing about it is visible through the API (no jobs, no check-runs); only the run page shows the annotation. - publish-npm: `actions: read` added, with the rule written down (keep the block a superset of every job in npm-publish.yml). - workflow_dispatch: new boolean input `publish_npm` (default true) and the npm leg is gated on it, so re-attaching assets to a release whose package already shipped does not try to publish the same version twice. - web-build / build / release checkouts pin `ref: needs.validate.outputs.version`: a dispatch builds the tag it names, not the dispatching branch (a tag push resolves to the same commit, so nothing changes on the normal path). actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, build-next-isolated-windows-home-2402, electron-release-latest-yml.repro and check-workflows suites pass. Next step: dispatch on main with version=v3.8.50 and publish_npm=false to attach the missing assets. * fix(ci): stop a stalled Codecov upload from cancelling the Coverage job and the main run (main twin of #11972) (#11978) Same change as #11972 on release/v3.8.51: the Coverage job had timeout-minutes: 20, the c8 merge across 8 shards takes ~10 min and the informational Codecov upload hung for the rest of the budget on two consecutive main runs (33207760653, 33215115341), ending the job cancelled and turning the run's conclusion cancelled with every blocking job green. Codecov step: 5-minute ceiling + continue-on-error; job: 30 min. * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref (#11982) * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref The v3.8.50 desktop re-dispatch (run 33238093090) lost its Linux leg at `npm ci` in electron/: "Missing: electron-builder-squirrel-windows@26.15.3 from lock file" plus its 12 transitive entries — the optional Windows-installer subtree of electron-builder had been dropped when the lock was last regenerated, and no CI ran the desktop legs between then and the tag (v3.8.49 never ran them; v3.8.50 died at startup, #11973). `npm install --package-lock-only` restores the 13 entries; a clean `npm ci --ignore-scripts` on the result adds 284 packages with no complaint. The tag itself carries the broken lock, and the workflow now checks out the tag on dispatch (#11973), so a dispatch input `build_ref` (default: the version tag) lets the operator name the repaired line — the v3.8.50 assets will be rebuilt from main, which is 3.8.50 plus its post-release fixes. Push-triggered runs are unaffected. actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro and check-workflows suites pass. * fix(release): do not regenerate release notes on a re-attach dispatch `generate_release_notes: true` on an existing release APPENDS GitHub's auto-generated "What's Changed" block to the curated body — the v3.8.50 re-dispatch (run 33238093090) added 1,416 chars to the 121 KB notes. Only the tag push should generate notes. * fix(release): attach the SBOM to the GitHub Release on dispatch publishes too (#12020) The step was gated on github.event_name == 'release'. v3.8.50's package shipped through a workflow_dispatch (the staged publish, 11 attempts) and the step was skipped, so the GitHub Release carried no SBOM — it was attached by hand from the run's sbom-npm artifact (5.0 MB, 1,886 components). Now it attaches on release or workflow_dispatch whenever a release for the published tag exists, and says so when it does not (the workflow artifact remains the durable copy either way). actionlint and prettier clean; npm-publish-artifact-provenance and check-workflows-provenance-runner suites pass. * fix(release): drop the build_ref input — a dispatch builds the ref it is dispatched on (#12032) Twin of #12022 on main: CodeQL flagged the same input-controlled checkout + npm cache pattern (cache-poisoning/poisonable-step) on main since it's the default branch. Checkouts go back to github.ref; dispatch still works via --ref (documented in the workflow's own on: contract). Also fixes the packaged-app smoke: it now waits on /api/monitoring/health (which touches the DB) instead of /login (which doesn't), so the smoke can actually distinguish "native driver selected" from "database never opened." electron-smoke-script.test.ts 9/9 (2 new cases). * fix(ci): accept CVE-2025-68121 in the prebuilt tls-client .so, auto-close base-red issues, guard Scorecard on the default branch (main twin) (#12086) * fix(ci): accept CVE-2025-68121 in the prebuilt tls-client .so, auto-close base-red issues, guard Scorecard on the default branch - .trivyignore: CVE-2025-68121 (Go stdlib crypto/tls inside bogdanfinn/tls-client v1.15.1, built with go 1.24.1) with justification, expiry and tracker #12084. No upstream rebuild exists; the blocking Trivy gate now also names the ignore file explicitly. - nightly-release-green: close the "not green" issue when the validation passes again (the workflow only ever opened/commented it, so stale issues outlived the fix and stamped new PRs as base-red inherited). - scorecard: the action only accepts the DEFAULT branch (the active release branch, not main) - guard the job on it so pushes to main stop failing. Refs #12084 (cherry picked from commit 8adf34b) * fix(release): never let the tag-push Create Release append auto notes to the curated body Twin of the release/v3.8.51 commit (see #12085). Refs #12084 * fix(docker): bump Bun image to 1.4.0 with Turbopack and port the node image's build memory guards (#11719) Validated in an isolated worktree against main: typecheck:core clean, 15/15 focused tests pass (docker-build-memory-budget, bun-support, resolve-next-build-bundler-flag). Root cause confirmed against the current workflow config (docker-publish.yml triggers on push to both main and release/v*, so this genuinely needed to target main). One out-of-scope change dropped before merging: config/alibaba-free-tier-allowlist.json's validUntil bump (2026-08-27 -> 2027-12-31) was unrelated to the Docker/Bun fix — reverted to the current value, keeping only the Docker/Bun/memory-guard changes this PR is actually about. Thanks for the thorough root-cause writeup and the worker-pool math. * test(infra): retry recursive temp-dir removal on main (main twin of #11968) (#12246) * test(infra): retry recursive temp-dir removal on main (main twin of #11968) `main` has been red since b342c1a on the vitest and integration gates: ✖ tests/unit/autoCombo/provider-family-combos.test.ts > auto/<family> ✖ chat pipeline applies Codex OAuth fingerprint and priority tier inside combos Both call resetStorage() from beforeEach, which does an fs.rmSync(TEST_DATA_DIR, {recursive: true, force: true}) with no retry, and intermittently loses the race with a not-yet-released SQLite handle (ENOTEMPTY). release/v3.8.51 fixed this in #11968 with a mechanical codemod adding maxRetries/retryDelay to every recursive rm/rmSync/rmdirSync under tests/, but that PR landed only on the release branch. Because main only receives work at the release squash, it stayed broken for the whole cycle — and repo-wide gates then turn every open PR into main red on checks unrelated to their diff. This is the --base main twin: re-runs the same codemod that already shipped on the release branch (scripts/ad-hoc/codemod-rm-maxretries.mjs), so the two branches converge on identical test-teardown semantics. Test-only; no product logic is touched. The remaining three failures reported on #12133 (unit full suite exceeding its 4800s ceiling, package-artifact exceeding 1200s, and the boot-smoke that is skipped as a consequence) are runner-contention timeouts, not code defects — validate-release-green.mjs runs those heavy gates concurrently on one shared hosted runner. There is no fix to port for those. * chore(scripts): carry the rm-maxretries codemod onto main alongside its output The codemod that generated the previous commit lives in the repo on release/v3.8.51 (added by #11968) but was never on main. Bringing it over keeps the tool next to the change it produced, so the transformation stays reproducible and auditable from either branch. * fix(ci): port the release-green ESLint gate fix to main (base-red #12363) (#12618) Porta para `main` o fix do gate de ESLint que só havia entrado na branch de release — o padrão de PR-companheiro que `_shared/merge-gates.md` §8 prescreve. As 12 falhas de CI foram discriminadas como o **outro** base-red do main, não deste diff. Todas descendem de um único ponto: `Package Artifact` falha e os 9 shards de E2E mais os 2 Electron Package Smoke consomem esse artefato. A própria issue #12363 lista os dois separadamente: - `❌ ESLint: could not parse eslint json` — que é justamente o que este PR conserta; - `❌ Package artifact (npm pack policy): gate exceeded its 1200s ceiling` — a raiz da cascata. O PR toca apenas `scripts/quality/validate-release-green.mjs` e seu teste, então não tem caminho para afetar o build do pacote. Teste portado primeiro e falhando no script atual do main (TDD). * fix(authz): preserve zed-hosted native-app callback through root middleware redirect The root middleware intercepts `pathname === "/"` and redirects to `/dashboard` using `new URL(basePath+"/dashboard", url)`, which drops the query string entirely. Zed's native-app sign-in always redirects the browser to the loopback root — `http://127.0.0.1:<port>/?user_id=...&access_token=...` — ignoring any path. When the dashboard's own loopback port is reused as `native_app_port` (see `src/lib/oauth/providers/zed-hosted.ts`'s `resolveDashboardLoopbackPort`), that redirect lands on `/` of the running OmniRoute instance. The root page (`src/app/page.tsx`) was already written to forward `user_id`+`access_token` to `/callback`, but this middleware runs first and silently discards the payload — making page.tsx's forward dead code and breaking the entire zed-hosted sign-in flow. Fix: detect `user_id` + `access_token` in `searchParams` and, when present, redirect to `/callback${search}` (preserving the query string) instead of `/dashboard`. Regular root visits (no native callback params) continue to redirect to `/dashboard` unchanged. This approach mirrors what `src/app/page.tsx` already does and is provider-agnostic: any future provider whose native loopback callback lands on `/` with `user_id`+`access_token` params benefits automatically. * test(authz): cover zed-hosted native-app callback root redirect (#13140) Adds automated coverage for the new pathname === "/" branch: with user_id+access_token both present the redirect now forwards to /callback preserving the query string; with only one of the two present, behavior is unchanged (redirect to /dashboard). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Rouzbeh† <78313022+rqzbeh@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…SBOM on dispatch (twin of cheaper-inference#11982 + cheaper-inference#12020) (cheaper-inference#12022) * fix(release): resync the electron lockfile, build a dispatch from a repaired ref, keep curated notes, attach the SBOM on dispatch (release/v3.8.51 twin of cheaper-inference#11982 + cheaper-inference#12020) Same four changes as cheaper-inference#11982 and cheaper-inference#12020 on main, applied to this branch's own copies: - electron/package-lock.json regenerated (271 -> 284 entries): the optional electron-builder-squirrel-windows subtree was missing and `npm ci` refused the lock (EUSAGE) on the Linux and macOS legs; a clean `npm ci --ignore-scripts` on the result exits 0. - electron-release.yml: `build_ref` dispatch input (default: the version tag) and `generate_release_notes` only on the tag push (a re-attach dispatch appended GitHub's auto notes to the curated body on v3.8.50). - npm-publish.yml: the SBOM attaches to the GitHub Release on workflow_dispatch publishes too, whenever a release for the tag exists. actionlint and prettier clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro, check-workflows and npm-publish-artifact-provenance suites pass. * fix(release): validate build_ref in the validate job before any checkout uses it CodeQL (actions/cache-poisoning/poisonable-step, high) on release/v3.8.51 — the default branch: a raw dispatch input checked out next to setup-node's npm cache is a cache-poisoning vector. The input now goes through the validate job's regex allowlist (main or release/vX.Y.Z, empty = the version tag) and every build job checks out needs.validate.outputs.build_ref, never the input itself. * fix(release): drop the build_ref input — a dispatch builds the ref it is dispatched on CodeQL (actions/cache-poisoning/poisonable-step) tracks the input through the validate job's output regardless of the regex allowlist: an input-controlled checkout next to setup-node's npm cache on the default branch is a cache-poisoning vector. The ref is not an input any more; the checkouts use github.ref, so `gh workflow run electron-release.yml --ref v3.8.50 -f version=v3.8.50` rebuilds the tag and `--ref main` builds the repaired line. The tag-push path is unchanged.

…leware redirect (cheaper-inference#13140) * fix(release): let the Electron workflow start again — grant actions:read to the npm leg (cheaper-inference#11973) v3.8.50 shipped with zero desktop assets. The tag push did trigger electron-release.yml (run 33005490476) but GitHub refused the run at startup: Error calling workflow 'npm-publish.yml@2b80128'. The nested job 'publish' is requesting 'actions: read', but is only allowed 'actions: none'. npm-publish.yml's `publish` job gained `actions: read` (it downloads the next-build artefact) and the caller job here never widened its grant — a reusable workflow may not request more than its caller allows, and the refusal is a startup failure of the WHOLE run, so the `release` job that attaches the installers, the source archives and the SBOM never ran either. Nothing about it is visible through the API (no jobs, no check-runs); only the run page shows the annotation. - publish-npm: `actions: read` added, with the rule written down (keep the block a superset of every job in npm-publish.yml). - workflow_dispatch: new boolean input `publish_npm` (default true) and the npm leg is gated on it, so re-attaching assets to a release whose package already shipped does not try to publish the same version twice. - web-build / build / release checkouts pin `ref: needs.validate.outputs.version`: a dispatch builds the tag it names, not the dispatching branch (a tag push resolves to the same commit, so nothing changes on the normal path). actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, build-next-isolated-windows-home-2402, electron-release-latest-yml.repro and check-workflows suites pass. Next step: dispatch on main with version=v3.8.50 and publish_npm=false to attach the missing assets. * fix(ci): stop a stalled Codecov upload from cancelling the Coverage job and the main run (main twin of cheaper-inference#11972) (cheaper-inference#11978) Same change as cheaper-inference#11972 on release/v3.8.51: the Coverage job had timeout-minutes: 20, the c8 merge across 8 shards takes ~10 min and the informational Codecov upload hung for the rest of the budget on two consecutive main runs (33207760653, 33215115341), ending the job cancelled and turning the run's conclusion cancelled with every blocking job green. Codecov step: 5-minute ceiling + continue-on-error; job: 30 min. * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref (cheaper-inference#11982) * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref The v3.8.50 desktop re-dispatch (run 33238093090) lost its Linux leg at `npm ci` in electron/: "Missing: electron-builder-squirrel-windows@26.15.3 from lock file" plus its 12 transitive entries — the optional Windows-installer subtree of electron-builder had been dropped when the lock was last regenerated, and no CI ran the desktop legs between then and the tag (v3.8.49 never ran them; v3.8.50 died at startup, cheaper-inference#11973). `npm install --package-lock-only` restores the 13 entries; a clean `npm ci --ignore-scripts` on the result adds 284 packages with no complaint. The tag itself carries the broken lock, and the workflow now checks out the tag on dispatch (cheaper-inference#11973), so a dispatch input `build_ref` (default: the version tag) lets the operator name the repaired line — the v3.8.50 assets will be rebuilt from main, which is 3.8.50 plus its post-release fixes. Push-triggered runs are unaffected. actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro and check-workflows suites pass. * fix(release): do not regenerate release notes on a re-attach dispatch `generate_release_notes: true` on an existing release APPENDS GitHub's auto-generated "What's Changed" block to the curated body — the v3.8.50 re-dispatch (run 33238093090) added 1,416 chars to the 121 KB notes. Only the tag push should generate notes. * fix(release): attach the SBOM to the GitHub Release on dispatch publishes too (cheaper-inference#12020) The step was gated on github.event_name == 'release'. v3.8.50's package shipped through a workflow_dispatch (the staged publish, 11 attempts) and the step was skipped, so the GitHub Release carried no SBOM — it was attached by hand from the run's sbom-npm artifact (5.0 MB, 1,886 components). Now it attaches on release or workflow_dispatch whenever a release for the published tag exists, and says so when it does not (the workflow artifact remains the durable copy either way). actionlint and prettier clean; npm-publish-artifact-provenance and check-workflows-provenance-runner suites pass. * fix(release): drop the build_ref input — a dispatch builds the ref it is dispatched on (cheaper-inference#12032) Twin of cheaper-inference#12022 on main: CodeQL flagged the same input-controlled checkout + npm cache pattern (cache-poisoning/poisonable-step) on main since it's the default branch. Checkouts go back to github.ref; dispatch still works via --ref (documented in the workflow's own on: contract). Also fixes the packaged-app smoke: it now waits on /api/monitoring/health (which touches the DB) instead of /login (which doesn't), so the smoke can actually distinguish "native driver selected" from "database never opened." electron-smoke-script.test.ts 9/9 (2 new cases). * fix(ci): accept CVE-2025-68121 in the prebuilt tls-client .so, auto-close base-red issues, guard Scorecard on the default branch (main twin) (cheaper-inference#12086) * fix(ci): accept CVE-2025-68121 in the prebuilt tls-client .so, auto-close base-red issues, guard Scorecard on the default branch - .trivyignore: CVE-2025-68121 (Go stdlib crypto/tls inside bogdanfinn/tls-client v1.15.1, built with go 1.24.1) with justification, expiry and tracker cheaper-inference#12084. No upstream rebuild exists; the blocking Trivy gate now also names the ignore file explicitly. - nightly-release-green: close the "not green" issue when the validation passes again (the workflow only ever opened/commented it, so stale issues outlived the fix and stamped new PRs as base-red inherited). - scorecard: the action only accepts the DEFAULT branch (the active release branch, not main) - guard the job on it so pushes to main stop failing. Refs cheaper-inference#12084 (cherry picked from commit d7097b02eeb3ec413a54c4e43a6538bf7ae40090) * fix(release): never let the tag-push Create Release append auto notes to the curated body Twin of the release/v3.8.51 commit (see cheaper-inference#12085). Refs cheaper-inference#12084 * fix(docker): bump Bun image to 1.4.0 with Turbopack and port the node image's build memory guards (cheaper-inference#11719) Validated in an isolated worktree against main: typecheck:core clean, 15/15 focused tests pass (docker-build-memory-budget, bun-support, resolve-next-build-bundler-flag). Root cause confirmed against the current workflow config (docker-publish.yml triggers on push to both main and release/v*, so this genuinely needed to target main). One out-of-scope change dropped before merging: config/alibaba-free-tier-allowlist.json's validUntil bump (2026-08-27 -> 2027-12-31) was unrelated to the Docker/Bun fix — reverted to the current value, keeping only the Docker/Bun/memory-guard changes this PR is actually about. Thanks for the thorough root-cause writeup and the worker-pool math. * test(infra): retry recursive temp-dir removal on main (main twin of cheaper-inference#11968) (cheaper-inference#12246) * test(infra): retry recursive temp-dir removal on main (main twin of cheaper-inference#11968) `main` has been red since 530d9be779 on the vitest and integration gates: ✖ tests/unit/autoCombo/provider-family-combos.test.ts > auto/<family> ✖ chat pipeline applies Codex OAuth fingerprint and priority tier inside combos Both call resetStorage() from beforeEach, which does an fs.rmSync(TEST_DATA_DIR, {recursive: true, force: true}) with no retry, and intermittently loses the race with a not-yet-released SQLite handle (ENOTEMPTY). release/v3.8.51 fixed this in cheaper-inference#11968 with a mechanical codemod adding maxRetries/retryDelay to every recursive rm/rmSync/rmdirSync under tests/, but that PR landed only on the release branch. Because main only receives work at the release squash, it stayed broken for the whole cycle — and repo-wide gates then turn every open PR into main red on checks unrelated to their diff. This is the --base main twin: re-runs the same codemod that already shipped on the release branch (scripts/ad-hoc/codemod-rm-maxretries.mjs), so the two branches converge on identical test-teardown semantics. Test-only; no product logic is touched. The remaining three failures reported on cheaper-inference#12133 (unit full suite exceeding its 4800s ceiling, package-artifact exceeding 1200s, and the boot-smoke that is skipped as a consequence) are runner-contention timeouts, not code defects — validate-release-green.mjs runs those heavy gates concurrently on one shared hosted runner. There is no fix to port for those. * chore(scripts): carry the rm-maxretries codemod onto main alongside its output The codemod that generated the previous commit lives in the repo on release/v3.8.51 (added by cheaper-inference#11968) but was never on main. Bringing it over keeps the tool next to the change it produced, so the transformation stays reproducible and auditable from either branch. * fix(ci): port the release-green ESLint gate fix to main (base-red cheaper-inference#12363) (cheaper-inference#12618) Porta para `main` o fix do gate de ESLint que só havia entrado na branch de release — o padrão de PR-companheiro que `_shared/merge-gates.md` §8 prescreve. As 12 falhas de CI foram discriminadas como o **outro** base-red do main, não deste diff. Todas descendem de um único ponto: `Package Artifact` falha e os 9 shards de E2E mais os 2 Electron Package Smoke consomem esse artefato. A própria issue cheaper-inference#12363 lista os dois separadamente: - `❌ ESLint: could not parse eslint json` — que é justamente o que este PR conserta; - `❌ Package artifact (npm pack policy): gate exceeded its 1200s ceiling` — a raiz da cascata. O PR toca apenas `scripts/quality/validate-release-green.mjs` e seu teste, então não tem caminho para afetar o build do pacote. Teste portado primeiro e falhando no script atual do main (TDD). * fix(authz): preserve zed-hosted native-app callback through root middleware redirect The root middleware intercepts `pathname === "/"` and redirects to `/dashboard` using `new URL(basePath+"/dashboard", url)`, which drops the query string entirely. Zed's native-app sign-in always redirects the browser to the loopback root — `http://127.0.0.1:<port>/?user_id=...&access_token=...` — ignoring any path. When the dashboard's own loopback port is reused as `native_app_port` (see `src/lib/oauth/providers/zed-hosted.ts`'s `resolveDashboardLoopbackPort`), that redirect lands on `/` of the running OmniRoute instance. The root page (`src/app/page.tsx`) was already written to forward `user_id`+`access_token` to `/callback`, but this middleware runs first and silently discards the payload — making page.tsx's forward dead code and breaking the entire zed-hosted sign-in flow. Fix: detect `user_id` + `access_token` in `searchParams` and, when present, redirect to `/callback${search}` (preserving the query string) instead of `/dashboard`. Regular root visits (no native callback params) continue to redirect to `/dashboard` unchanged. This approach mirrors what `src/app/page.tsx` already does and is provider-agnostic: any future provider whose native loopback callback lands on `/` with `user_id`+`access_token` params benefits automatically. * test(authz): cover zed-hosted native-app callback root redirect (cheaper-inference#13140) Adds automated coverage for the new pathname === "/" branch: with user_id+access_token both present the redirect now forwards to /callback preserving the query string; with only one of the two present, behavior is unchanged (redirect to /dashboard). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Rouzbeh† <78313022+rqzbeh@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

…lockstep comments The five changelog.d fragments for cheaper-inference#11719/cheaper-inference#11973/cheaper-inference#11978/cheaper-inference#11982/cheaper-inference#12020 were already folded into CHANGELOG.md and deleted on the release branch; re-adding them would duplicate those entries. Compacting the buildUrlForBody doc comments brings open-sse/executors/base.ts's ceiling down from 1772 to 1760.

@adivekar-utexas

… the rewritten body model (#12826) Validated on the 2026-09-28 release-drain board. Maintainer rework on top of your commits: merged the current release/v3.8.51 tip, resolving the openai-to-gemini.ts conflict so the tip's output-cap-aware default budget and your explicit-thinkingLevel rule combine (an explicit level still omits the numeric budget); dropped five changelog.d fragments the branch had re-added for already-released PRs (#11719/#11973/#11978/#11982/#12020, which would have duplicated CHANGELOG entries); compacted the buildUrlForBody comments so the base.ts ceiling drops from 1772 to 1760. The 3 new test files fail on the old code -> 12/12 with the fix, plus the tip's gemini thinking-budget suites and the executor-* sample green; typecheck:core, check:open-sse-typecheck, eslint and changelog-integrity clean. Thank you @adivekar-utexas!

…rom a repaired ref (cheaper-inference#11982) * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref The v3.8.50 desktop re-dispatch (run 33238093090) lost its Linux leg at `npm ci` in electron/: "Missing: electron-builder-squirrel-windows@26.15.3 from lock file" plus its 12 transitive entries — the optional Windows-installer subtree of electron-builder had been dropped when the lock was last regenerated, and no CI ran the desktop legs between then and the tag (v3.8.49 never ran them; v3.8.50 died at startup, cheaper-inference#11973). `npm install --package-lock-only` restores the 13 entries; a clean `npm ci --ignore-scripts` on the result adds 284 packages with no complaint. The tag itself carries the broken lock, and the workflow now checks out the tag on dispatch (cheaper-inference#11973), so a dispatch input `build_ref` (default: the version tag) lets the operator name the repaired line — the v3.8.50 assets will be rebuilt from main, which is 3.8.50 plus its post-release fixes. Push-triggered runs are unaffected. actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro and check-workflows suites pass. * fix(release): do not regenerate release notes on a re-attach dispatch `generate_release_notes: true` on an existing release APPENDS GitHub's auto-generated "What's Changed" block to the curated body — the v3.8.50 re-dispatch (run 33238093090) added 1,416 chars to the 121 KB notes. Only the tag push should generate notes. # Conflicts: # .github/workflows/electron-release.yml

…rom a repaired ref (cheaper-inference#11982) * fix(release): resync the electron lockfile and let a dispatch build from a repaired ref The v3.8.50 desktop re-dispatch (run 33238093090) lost its Linux leg at `npm ci` in electron/: "Missing: electron-builder-squirrel-windows@26.15.3 from lock file" plus its 12 transitive entries — the optional Windows-installer subtree of electron-builder had been dropped when the lock was last regenerated, and no CI ran the desktop legs between then and the tag (v3.8.49 never ran them; v3.8.50 died at startup, cheaper-inference#11973). `npm install --package-lock-only` restores the 13 entries; a clean `npm ci --ignore-scripts` on the result adds 284 packages with no complaint. The tag itself carries the broken lock, and the workflow now checks out the tag on dispatch (cheaper-inference#11973), so a dispatch input `build_ref` (default: the version tag) lets the operator name the repaired line — the v3.8.50 assets will be rebuilt from main, which is 3.8.50 plus its post-release fixes. Push-triggered runs are unaffected. actionlint clean; electron-release-desktop-channel-8949, electron-release-efficiency, electron-release-latest-yml.repro and check-workflows suites pass. * fix(release): do not regenerate release notes on a re-attach dispatch `generate_release_notes: true` on an existing release APPENDS GitHub's auto-generated "What's Changed" block to the curated body — the v3.8.50 re-dispatch (run 33238093090) added 1,416 chars to the 121 KB notes. Only the tag push should generate notes. (cherry picked from commit 2af28c4)

diegosouzapw added 2 commits August 29, 2026 04:17

diegosouzapw merged commit 2af28c4 into main Aug 29, 2026
87 of 92 checks passed

diegosouzapw deleted the fix/release-v3.8.50-electron-lockfile-build-ref branch August 29, 2026 12:05

diegosouzapw mentioned this pull request Sep 30, 2026

fix(electron): resync electron/package-lock.json with its package.json #15157

Merged

Navigation Menu

Repository navigation

fix(release): resync the electron lockfile and let a dispatch build from a repaired ref - #11982

fix(release): resync the electron lockfile and let a dispatch build from a repaired ref#11982
diegosouzapw merged 2 commits into
mainfrom
fix/release-v3.8.50-electron-lockfile-build-ref

diegosouzapw commented Aug 29, 2026

Uh oh!

github-actions Bot commented Aug 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

diegosouzapw commented Aug 29, 2026

Achado (redisparo do Electron para v3.8.50, run 33238093090)

O que muda

Validação

Depois do merge

Uh oh!

github-actions Bot commented Aug 29, 2026

CI Coverage Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant