From ca1dda7014681cd89f86216d886c5d1d31ccfba6 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:59:38 +0200 Subject: [PATCH 1/5] ci: path-scope Tauri Rust Gate, skip CEF harness on docs-only PRs, cache apt archives MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Today's recurring CI hangs traced to azure.archive.ubuntu.com apt .deb download throughput (~121 kB/s vs ~3.7 MB/s for the index fetch) โ€” real, external, not repo code. Three low-risk mitigations that reduce how often and how much we depend on that path: - New `changes` job in ci.yml diffs against the PR base SHA (fails open to tauri=true on any ambiguity) and gates `rust-tauri` so docs/frontend-only PRs skip its apt-get(libgtk/libwebkit) + cargo build entirely. `ci-success` now treats rust-tauri:skipped as a pass; only `changes` itself is a hard requirement, closing the fail-open detector's own failure mode. - cef-learning-harness.yml's PR trigger drops `docs/cef/**` โ€” a docs-only change can't regress the built host, so it no longer pays for the ~30min rebuild+launch-cycle proof. Code paths (apps/desktop-cef/**, scripts/cef/**) still trigger it regardless of accompanying doc changes. - actions/cache on /var/cache/apt/archives/*.deb for both apt-get install steps (Tauri Linux deps, CEF host + Wayland deps) so a cache hit skips the slow mirror download outright instead of just the index refresh. --- .github/workflows/cef-learning-harness.yml | 13 +++- .github/workflows/ci.yml | 85 ++++++++++++++++++---- 2 files changed, 82 insertions(+), 16 deletions(-) diff --git a/.github/workflows/cef-learning-harness.yml b/.github/workflows/cef-learning-harness.yml index 17294ac9b..08cc0dcef 100644 --- a/.github/workflows/cef-learning-harness.yml +++ b/.github/workflows/cef-learning-harness.yml @@ -24,6 +24,11 @@ # CEF-rendering regression introduced by an unrelated app-source PR is still # caught promptly (informationally, non-blocking), not silently missed until # someone next happens to touch a CEF-specific path. +# +# QNBS-v3: docs/cef/** deliberately excluded from the PR path list โ€” a docs-only +# change (e.g. updating the competency matrix) can't regress the built host, so it +# doesn't need a ~30min rebuild; code changes under apps/desktop-cef/** or +# scripts/cef/** still trigger this regardless of whether docs are also touched. # ============================================================ name: ๐Ÿงช CEF Learning Harness @@ -34,7 +39,6 @@ on: paths: - 'apps/desktop-cef/**' - 'scripts/cef/**' - - 'docs/cef/**' - '.github/workflows/cef-learning-harness.yml' push: branches: [main] @@ -86,6 +90,13 @@ jobs: with: toolchain: stable + - name: Cache apt packages (CEF host + Wayland build deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + # QNBS-v3: bump the -v suffix if either apt-get install package list in this job changes + key: apt-cef-harness-deps-v1 + - name: Install worldscript_host build dependencies run: | sudo apt-get update diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 79f504534..e6f0ece85 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -85,6 +85,43 @@ jobs: if: github.event_name == 'pull_request' uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 + # ---------------------------------------------------------- + # 0b. CHANGE DETECTION: path-scopes rust-tauri so a docs/frontend-only PR + # doesn't pay for a Rust toolchain + apt-get(libgtk/libwebkit) build it can't + # affect. Fails OPEN (tauri=true) on any ambiguity โ€” base SHA missing/unreachable + # โ€” so a detection error runs the real gate instead of silently skipping it. + # ---------------------------------------------------------- + changes: + name: ๐Ÿ“‚ Detect changed paths + runs-on: ubuntu-latest + timeout-minutes: 5 + outputs: + tauri: ${{ steps.filter.outputs.tauri }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Detect src-tauri changes + id: filter + run: | + if [ "${{ github.event_name }}" = "pull_request" ]; then + BASE="${{ github.event.pull_request.base.sha }}" + else + BASE="${{ github.event.before }}" + fi + if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "$BASE" 2>/dev/null; then + echo "::notice::No usable base SHA to diff against โ€” defaulting to tauri=true (fail open)" + echo "tauri=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + if git diff --name-only "$BASE" "${{ github.sha }}" | grep -qE '^(src-tauri/|\.github/workflows/ci\.yml$)'; then + echo "tauri=true" >> "$GITHUB_OUTPUT" + else + echo "tauri=false" >> "$GITHUB_OUTPUT" + fi + # ---------------------------------------------------------- # 1. QUALITY GATE: Lint + Typecheck + Tests (parallel matrix) # ---------------------------------------------------------- @@ -177,16 +214,15 @@ jobs: fail_ci_if_error: false # ---------------------------------------------------------- - # 2. BUILD: Production build + Pages artifact upload - # QNBS-v3: Stryker mutation removed from the PR/CI pipeline (2026-06-02) โ€” it added noise as a - # flaky, non-gating check. Mutation now runs ONLY via the manual `.github/workflows/ - # mutation.yml` (workflow_dispatch). To be re-integrated in a later iteration. + # 1b. RUST-TAURI: Tauri Rust Gate (fmt/check/clippy/test), path-scoped via `changes` # ---------------------------------------------------------- rust-tauri: name: ๐Ÿฆ€ Tauri Rust Gate runs-on: ubuntu-latest timeout-minutes: 20 - needs: [security] + needs: [security, changes] + # QNBS-v3: skips for PRs that don't touch src-tauri/** โ€” ci-success treats 'skipped' as pass for this job only + if: needs.changes.outputs.tauri == 'true' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: @@ -195,6 +231,12 @@ jobs: with: toolchain: stable components: rustfmt, clippy + - name: Cache apt packages (Tauri Linux build deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + # QNBS-v3: bump the -v suffix if the apt-get install package list below changes + key: apt-tauri-linux-deps-v1 - name: Install Linux Tauri build dependencies run: | sudo apt-get update @@ -212,6 +254,12 @@ jobs: working-directory: src-tauri run: cargo test --locked + # ---------------------------------------------------------- + # 2. BUILD: Production build + Pages artifact upload + # QNBS-v3: Stryker mutation removed from the PR/CI pipeline (2026-06-02) โ€” it added noise as a + # flaky, non-gating check. Mutation now runs ONLY via the manual `.github/workflows/ + # mutation.yml` (workflow_dispatch). To be re-integrated in a later iteration. + # ---------------------------------------------------------- build: name: ๐Ÿ—๏ธ Build runs-on: ubuntu-latest @@ -290,33 +338,40 @@ jobs: path: ./dist # ---------------------------------------------------------- - # 3. CI SUCCESS: single required-status aggregator (security + quality + build) + # 3. CI SUCCESS: single required-status aggregator (security + quality + changes + rust-tauri + build + e2e + vrt) # ---------------------------------------------------------- ci-success: name: โœ… CI Success runs-on: ubuntu-latest timeout-minutes: 5 - needs: [security, quality, rust-tauri, build, e2e, vrt] + needs: [security, quality, changes, rust-tauri, build, e2e, vrt] if: always() steps: + # QNBS-v3: rust-tauri may legitimately be 'skipped' (changes.outputs.tauri == 'false') โ€” that's a pass, not a failure - name: Verify all required jobs succeeded run: | - if [ "${{ needs.security.result }}" != "success" ] || \ - [ "${{ needs.quality.result }}" != "success" ] || \ - [ "${{ needs.rust-tauri.result }}" != "success" ] || \ - [ "${{ needs.build.result }}" != "success" ] || \ - [ "${{ needs.e2e.result }}" != "success" ] || \ - [ "${{ needs.vrt.result }}" != "success" ]; then + FAIL=0 + [ "${{ needs.security.result }}" = "success" ] || FAIL=1 + [ "${{ needs.quality.result }}" = "success" ] || FAIL=1 + [ "${{ needs.changes.result }}" = "success" ] || FAIL=1 + if [ "${{ needs.rust-tauri.result }}" != "success" ] && [ "${{ needs.rust-tauri.result }}" != "skipped" ]; then + FAIL=1 + fi + [ "${{ needs.build.result }}" = "success" ] || FAIL=1 + [ "${{ needs.e2e.result }}" = "success" ] || FAIL=1 + [ "${{ needs.vrt.result }}" = "success" ] || FAIL=1 + if [ "$FAIL" = "1" ]; then echo "One or more required jobs did not succeed:" echo " security: ${{ needs.security.result }}" echo " quality: ${{ needs.quality.result }}" - echo " rust-tauri: ${{ needs.rust-tauri.result }}" + echo " changes: ${{ needs.changes.result }}" + echo " rust-tauri: ${{ needs.rust-tauri.result }} (skipped = OK, src-tauri untouched)" echo " build: ${{ needs.build.result }}" echo " e2e: ${{ needs.e2e.result }}" echo " vrt: ${{ needs.vrt.result }}" exit 1 fi - echo "All required jobs succeeded." + echo "All required jobs succeeded (or were legitimately skipped)." # ---------------------------------------------------------- # 4. DEPLOY: GitHub Pages (only on main push) From be59c4c44c022aae3c8adf835f2fe9e1cbbdb6c9 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:03:04 +0200 Subject: [PATCH 2/5] ci: add Cargo caching and a fast lint/typecheck gate ahead of the CEF build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Neither src-tauri's cargo fmt/check/clippy/test nor the CEF harness's Corrosion-driven rust-core build had any Cargo caching โ€” every run re-fetched and rebuilt the full dependency tree from scratch. Adds Swatinem/rust-cache to both, keyed on Cargo.lock + rustc version so a toolchain bump or lockfile change invalidates cleanly. Also adds a `fast-gate` job (lint + typecheck) ahead of the CEF harness's `harness` job so a trivial code-style or type error fails in ~2-3min instead of only surfacing after the full ~30min SDK-fetch+CMake+Rust+Xvfb cycle. Duplicates a small slice of ci.yml's quality job (which still runs in parallel) โ€” a deliberate trade given how expensive the full CEF build is. --- .github/workflows/cef-learning-harness.yml | 35 ++++++++++++++++++++++ .github/workflows/ci.yml | 6 ++++ 2 files changed, 41 insertions(+) diff --git a/.github/workflows/cef-learning-harness.yml b/.github/workflows/cef-learning-harness.yml index 08cc0dcef..8b571d9d2 100644 --- a/.github/workflows/cef-learning-harness.yml +++ b/.github/workflows/cef-learning-harness.yml @@ -29,6 +29,15 @@ # change (e.g. updating the competency matrix) can't regress the built host, so it # doesn't need a ~30min rebuild; code changes under apps/desktop-cef/** or # scripts/cef/** still trigger this regardless of whether docs are also touched. +# The push-to-main trigger stays deliberately unscoped (no `paths:`) precisely so an +# unrelated app-source change that alters dist/'s real inputs is still caught after +# merge โ€” narrowing that trigger to apps/desktop-cef/** only would reintroduce the +# PR #388 gap this design already closed. +# +# QNBS-v3: `fast-gate` (lint+typecheck) runs before `harness` so a trivial code-style +# or type error fails in ~2-3min instead of after the full ~30min SDK+CMake+Rust+Xvfb +# cycle. `Swatinem/rust-cache` caches cargo's registry/git dirs for the rust-core +# crate Corrosion builds via CMake, cutting redundant crates.io re-fetches. # ============================================================ name: ๐Ÿงช CEF Learning Harness @@ -52,10 +61,29 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: + # QNBS-v3: fast, cheap checks (lint/typecheck) gate the ~30min CEF build so a trivial + # code-style or type error doesn't burn the full SDK-fetch+CMake+Rust+Xvfb cycle before + # surfacing. Duplicates a subset of ci.yml's quality job (which runs in parallel anyway) โ€” + # deliberate trade: a couple extra lint/typecheck minutes vs. up to 30 wasted on a fail-fast case. + fast-gate: + name: โšก Fast gate (lint + typecheck) + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + with: + persist-credentials: false + - uses: ./.github/actions/setup + - name: Lint (Biome) + run: pnpm run lint + - name: Typecheck (tsgo) + run: npx tsgo --project tsconfig.tsgo.json --noEmit --checkers 4 + harness: name: ๐Ÿงช CEF host build, dependency inventory, launch-cycle proof runs-on: ubuntu-latest timeout-minutes: 30 + needs: [fast-gate] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: @@ -90,6 +118,13 @@ jobs: with: toolchain: stable + # QNBS-v3: rust-core (apps/desktop-cef/rust-core) is built via CMake's corrosion_import_crate, + # invoking cargo under the hood โ€” this caches the global registry/git dirs cargo uses regardless + # of where Corrosion places its target/ output, so repeat runs skip re-fetching crates.io deps. + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: + workspaces: apps/desktop-cef/rust-core -> target + - name: Cache apt packages (CEF host + Wayland build deps) uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e6f0ece85..ac6db93ac 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -231,6 +231,12 @@ jobs: with: toolchain: stable components: rustfmt, clippy + # QNBS-v3: no cargo caching existed before โ€” fmt/check/clippy/test each rebuilt the full + # dependency tree from scratch every run. Keyed on Cargo.lock + rustc version, so a toolchain + # bump or lockfile change invalidates cleanly rather than reusing stale artifacts. + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + with: + workspaces: src-tauri -> target - name: Cache apt packages (Tauri Linux build deps) uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: From 36a1a1ed4a8f94f061c9955fc6da76db7054dd5e Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:07:35 +0200 Subject: [PATCH 3/5] fix(security): allowlist apt-cache-key false positives in gitleaks scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gitleaks' generic-api-key heuristic flagged the two new actions/cache `key:` values added in this PR (apt-cef-harness-deps-v1, apt-tauri-linux-deps-v1) โ€” a YAML `key:` field next to a hyphenated alphanumeric string matches its pattern even though these are static, non-secret cache-namespace literals, not credentials. Extends the existing narrow-regex allowlist convention (exact-match, not path-based) rather than weakening the rule. --- .gitleaks.toml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index a6b378370..5a1e37566 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -20,6 +20,16 @@ useDefault = true # broadening the exemption to "anything in that file" rather than narrowing it. The exact leaked # value alone is already a highly-specific, non-generic string that cannot coincidentally match a # real secret elsewhere, so it's the narrowest correct scope available in this schema. +# +# apt-cef-harness-deps-v1 / apt-tauri-linux-deps-v1 +# (.github/workflows/cef-learning-harness.yml, ci.yml) are actions/cache `key:` values for apt +# archive caching โ€” static, non-secret cache-namespace strings. Flagged by the same generic-api-key +# heuristic: YAML `key:` field name next to a hyphenated alphanumeric string. Reviewed 2026-08-19: +# both are cache keys with a fixed literal suffix (`-v1`), not credentials. [allowlist] -description = "PASSPHRASE_SENTINEL_RECORD_KEY test mock โ€” static IDB record-key identifier, not a credential" -regexes = ['''^idb_passphrase_sentinel_v1$'''] +description = "Cache-key / record-key literals flagged by generic-api-key's key-adjacent-string heuristic โ€” not credentials" +regexes = [ + '''^idb_passphrase_sentinel_v1$''', + '''^apt-cef-harness-deps-v1$''', + '''^apt-tauri-linux-deps-v1$''', +] From 58c8123127521170c71fcdc021f7219003bcd4b6 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:12:15 +0200 Subject: [PATCH 4/5] ci: cache apt archives for every Playwright --with-deps install site MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Live evidence while this PR was in flight: PR #397's Storybook job hit its 25min timeout stuck on the exact same azure.archive.ubuntu.com font package downloads diagnosed earlier today โ€” this time in a different job (Storybook's own `playwright install --with-deps chromium`), confirming the same throughput problem hits every one of ci.yml's 5 `--with-deps` call sites (build, e2e, e2e-deep, storybook, vrt), not just the two jobs already covered (rust-tauri, CEF harness). All 5 now cache /var/cache/apt/archives/*.deb under one shared key โ€” they install the same system packages on the same runner image, so a cache write from any one job warms it for the rest. --- .github/workflows/ci.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac6db93ac..91328999e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -287,6 +287,16 @@ jobs: env: NODE_ENV: production + # QNBS-v3: caches the apt .deb archives `--with-deps` fetches (fonts, libx11, etc.) โ€” shared + # key across every `playwright install --with-deps` call site in this workflow, since they all + # install the same system packages on the same runner image. actions/cache/save on a fresh + # write here also warms the cache for e2e/e2e-deep/storybook/vrt below. + - name: Cache apt packages (Playwright system deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + key: apt-playwright-chromium-deps-v1 + # QNBS-v3: The E2E suite runs `vite dev`, so prod-only rolldown bundling crashes (e.g. the # zod DCE "init_locales is not defined" blank screen) never surface there. This guard loads # the real production bundle in headless Chromium and fails if React does not mount. @@ -422,6 +432,12 @@ jobs: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }} + - name: Cache apt packages (Playwright system deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + key: apt-playwright-chromium-deps-v1 + - name: Install Playwright browsers run: pnpm exec playwright install --with-deps chromium @@ -476,6 +492,12 @@ jobs: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }} + - name: Cache apt packages (Playwright system deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + key: apt-playwright-chromium-deps-v1 + - name: Install Playwright browsers run: pnpm exec playwright install --with-deps chromium @@ -567,6 +589,12 @@ jobs: - name: Build Storybook run: pnpm exec storybook build --output-dir storybook-static + - name: Cache apt packages (Playwright system deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + key: apt-playwright-chromium-deps-v1 + # QNBS-v3: Chromium-only; test-runner v0.24+ is async-compatible with Storybook v10. - name: Install Playwright browsers (test-runner) run: pnpm exec playwright install --with-deps chromium @@ -630,6 +658,12 @@ jobs: name: dist path: dist/ + - name: Cache apt packages (Playwright system deps) + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /var/cache/apt/archives/*.deb + key: apt-playwright-chromium-deps-v1 + - name: Install Playwright browsers run: pnpm exec playwright install --with-deps chromium From 8d404198ccc09e811c53185f7b52819bd1bbf939 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:31:13 +0200 Subject: [PATCH 5/5] docs(ci): fix stale actions/checkout version annotation (v6 -> v7.0.1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit finding on PR #398, independently re-verified: dereferencing both tags shows v6 -> d23441a4..., v7.0.1 -> 3d3c42e5... โ€” the SHA pinned throughout this repo's workflows is actually v7.0.1, not v6. Pre-existing across all workflow files (this pin was copied verbatim as this repo's established convention, not introduced by this PR); fixed here only in the two files this PR already touches to stay in scope. --- .github/workflows/cef-learning-harness.yml | 4 ++-- .github/workflows/ci.yml | 20 ++++++++++---------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/cef-learning-harness.yml b/.github/workflows/cef-learning-harness.yml index 8b571d9d2..42f3e32e0 100644 --- a/.github/workflows/cef-learning-harness.yml +++ b/.github/workflows/cef-learning-harness.yml @@ -70,7 +70,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -85,7 +85,7 @@ jobs: timeout-minutes: 30 needs: [fast-gate] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 91328999e..c4b25da7c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: pull-requests: read steps: # QNBS-v3: fetch-depth:0 gives gitleaks access to parent commits (sha^) needed for PR diff scans; shallow clone causes "ambiguous argument" errors. - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -98,7 +98,7 @@ jobs: outputs: tauri: ${{ steps.filter.outputs.tauri }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -138,7 +138,7 @@ jobs: steps: # QNBS-v3: fetch-tags โ€” check-doc-metrics.mjs's stale-PLANNED-status check reads `git tag` # and silently no-ops without one; a default shallow checkout has no tags at all. - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-tags: true @@ -224,7 +224,7 @@ jobs: # QNBS-v3: skips for PRs that don't touch src-tauri/** โ€” ci-success treats 'skipped' as pass for this job only if: needs.changes.outputs.tauri == 'true' steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @@ -277,7 +277,7 @@ jobs: attestations: write id-token: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -420,7 +420,7 @@ jobs: timeout-minutes: 50 needs: [quality] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -481,7 +481,7 @@ jobs: needs: [quality] continue-on-error: true steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -526,7 +526,7 @@ jobs: needs: [build] continue-on-error: false steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -573,7 +573,7 @@ jobs: timeout-minutes: 25 needs: [quality] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -646,7 +646,7 @@ jobs: timeout-minutes: 15 needs: [build] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup