From 2559d91308ecb39b1da184582a9d2b24747e78a7 Mon Sep 17 00:00:00 2001 From: Petr Plenkov Date: Tue, 11 Aug 2026 03:16:43 +0200 Subject: [PATCH 01/11] chore: trigger PR #18 head update From d936df3b6280d6ca883c64830e30189290191a03 Mon Sep 17 00:00:00 2001 From: Petr Plenkov Date: Tue, 11 Aug 2026 03:16:43 +0200 Subject: [PATCH 02/11] chore: trigger PR #18 head update From c61acaa4c7ca54ade05f044ec828bb9dc63a1560 Mon Sep 17 00:00:00 2001 From: Petr Plenkov Date: Mon, 10 Aug 2026 20:57:15 +0200 Subject: [PATCH 03/11] feat(nx-cloud): setup nx cloud workspace This commit sets up Nx Cloud for your Nx workspace, enabling distributed caching and the Nx Cloud GitHub integration for fast CI and improved developer experience. You can access your Nx Cloud workspace by going to https://cloud.nx.app/orgs/6a7a1e77cff5d2abcf16725d/workspaces/6a7a1f08cff5d2abcf167263 > [!TIP] > Run `npx nx generate ci-workflow` if you don't have a CI script configured yet. **Note:** This commit attempts to maintain formatting of the nx.json file, however you may need to correct formatting by running an nx format command and committing the changes. --- nx.json | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/nx.json b/nx.json index 3c307dce8..fd4d77e4e 100644 --- a/nx.json +++ b/nx.json @@ -1,7 +1,10 @@ { "$schema": "./node_modules/nx/schemas/nx-schema.json", "namedInputs": { - "default": ["{projectRoot}/**/*", "sharedGlobals"], + "default": [ + "{projectRoot}/**/*", + "sharedGlobals" + ], "production": [ "default", "!{projectRoot}/**/__tests__/**/*", @@ -11,23 +14,40 @@ }, "targetDefaults": { "build": { - "dependsOn": ["^build"], - "inputs": ["production", "^production"], + "dependsOn": [ + "^build" + ], + "inputs": [ + "production", + "^production" + ], "cache": true }, "test": { - "inputs": ["default", "^production"], + "inputs": [ + "default", + "^production" + ], "cache": true }, "lint": { - "inputs": ["default", "{workspaceRoot}/.eslintrc.json"], + "inputs": [ + "default", + "{workspaceRoot}/.eslintrc.json" + ], "cache": true }, "typecheck": { - "dependsOn": ["^build"], - "inputs": ["default", "^production"], + "dependsOn": [ + "^build" + ], + "inputs": [ + "default", + "^production" + ], "cache": true } }, - "nxCloudAccessToken": "" -} + "nxCloudAccessToken": "", + "nxCloudId": "6a7a1f08cff5d2abcf167263" +} \ No newline at end of file From 4779ff50a40e0d1792916472c69d0261d8c692fa Mon Sep 17 00:00:00 2001 From: "nx-cloud[bot]" <71083854+nx-cloud[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 18:57:19 +0000 Subject: [PATCH 04/11] chore: add CI workflow with Nx Cloud self-healing CI --- .github/workflows/ci.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 000000000..0661e5c88 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,30 @@ +name: CI + +on: + push: + branches: + - main + pull_request: + +permissions: + actions: read + contents: read + +jobs: + main: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + filter: tree:0 + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v1 + with: + bun-version: latest + - run: bun install --frozen-lockfile + - uses: nrwl/nx-set-shas@v4 + + - run: bunx nx affected -t lint test build + - run: bunx nx fix-ci + if: always() \ No newline at end of file From 8b87c26d7b2ba5dfd9ca55a834ea714c0950f1ab Mon Sep 17 00:00:00 2001 From: Petr Plenkov Date: Mon, 10 Aug 2026 21:04:30 +0200 Subject: [PATCH 05/11] fix(ci): contents: write for nx fix-ci auto-apply MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit nx fix-ci needs write access to push automated fixes back to the repository. Changed contents: read → contents: write per Codacy review. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0661e5c88..cd5a71198 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,7 +8,7 @@ on: permissions: actions: read - contents: read + contents: write jobs: main: From fbea33c1b5e1a9df206dfc45ab15200c5ef53548 Mon Sep 17 00:00:00 2001 From: Petr Plenkov Date: Mon, 10 Aug 2026 21:41:23 +0200 Subject: [PATCH 06/11] fix(ci): pin all third-party actions to commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codacy and SonarCloud both flagged unpinned actions as security risk. Pinned: - actions/checkout@v4 → 11d5960a326750d5838078e36cf38b85af677262 - oven-sh/setup-bun@v1 → f4d14e03ff726c06358e5557344e1da148b56cf7 - nrwl/nx-set-shas@v4 → 3e9ad7370203c1e93d109be57f3b72eb0eb511b1 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cd5a71198..a47271039 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,16 +14,16 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: filter: tree:0 fetch-depth: 0 - - uses: oven-sh/setup-bun@v1 + - uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # v1 with: bun-version: latest - run: bun install --frozen-lockfile - - uses: nrwl/nx-set-shas@v4 + - uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4 - run: bunx nx affected -t lint test build - run: bunx nx fix-ci From 1fdcaaffea71e4515dfe3e52fe79e2fda3d51f57 Mon Sep 17 00:00:00 2001 From: Petr Plenkov Date: Mon, 10 Aug 2026 21:44:46 +0200 Subject: [PATCH 07/11] fix(ci): resolve SonarCloud findings + add dependabot - Add --ignore-scripts to bun install (S6505) - Pin nx to 21.0.0 in bunx calls (S8543) - Add dependabot.yml for github-actions + npm weekly updates Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/dependabot.yml | 21 +++++++++++++++++++++ .github/workflows/ci.yml | 6 +++--- 2 files changed, 24 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..e5d191b9a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,21 @@ +version: 2 +updates: + # GitHub Actions — track action version updates in workflows + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "github-actions" + + # npm — track package updates in package.json + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "npm" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a47271039..0b7c68153 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,9 +22,9 @@ jobs: - uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # v1 with: bun-version: latest - - run: bun install --frozen-lockfile + - run: bun install --frozen-lockfile --ignore-scripts - uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4 - - run: bunx nx affected -t lint test build - - run: bunx nx fix-ci + - run: bunx nx@21.0.0 affected -t lint test build + - run: bunx nx@21.0.0 fix-ci if: always() \ No newline at end of file From f1792969576584b615a3691fcedd3a58e79d6af6 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 15:36:13 +0000 Subject: [PATCH 08/11] ci: run build before lint/test so dependents use fresh dist Co-Authored-By: Petr Plenkov --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0b7c68153..0f9e8c8e3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,6 +25,6 @@ jobs: - run: bun install --frozen-lockfile --ignore-scripts - uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4 - - run: bunx nx@21.0.0 affected -t lint test build + - run: bunx nx@21.0.0 affected -t build lint test - run: bunx nx@21.0.0 fix-ci if: always() \ No newline at end of file From 3e712ef25a7b4d6b769d6e919c904f24c7b8b019 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 15:43:32 +0000 Subject: [PATCH 09/11] ci: split build and lint/test steps so dist is fresh before tests Co-Authored-By: Petr Plenkov --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0f9e8c8e3..94baa3aab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,6 +25,7 @@ jobs: - run: bun install --frozen-lockfile --ignore-scripts - uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4 - - run: bunx nx@21.0.0 affected -t build lint test + - run: bunx nx@21.0.0 affected -t build + - run: bunx nx@21.0.0 affected -t lint test - run: bunx nx@21.0.0 fix-ci if: always() \ No newline at end of file From 3c11fbcb5c9f58d7750b298babe572f6af96638a Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 15:54:32 +0000 Subject: [PATCH 10/11] ci: declare build outputs and make tests depend on builds Co-Authored-By: Petr Plenkov --- nx.json | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/nx.json b/nx.json index fd4d77e4e..1aca0a9fe 100644 --- a/nx.json +++ b/nx.json @@ -21,9 +21,16 @@ "production", "^production" ], + "outputs": [ + "{projectRoot}/dist" + ], "cache": true }, "test": { + "dependsOn": [ + "build", + "^build" + ], "inputs": [ "default", "^production" From 6dfa7ac68fec8392db6c5d8a7b45377d09471117 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 16:20:57 +0000 Subject: [PATCH 11/11] ci: retrigger SonarCloud analysis Co-Authored-By: Petr Plenkov