QVAC-13562 feat: add @qvac/diagnostics package with BaseInference integration by olyasir · Pull Request #796 · tetherto/qvac

olyasir · 2026-03-10T13:37:58Z

Summary

New @qvac/diagnostics package (v0.1.0) with structured DiagnosticReport schema
Addon registration via contributor pattern (registerAddon/unregisterAddon)
Environment and hardware auto-detection via bare-os with Node.js fallback
Optional integration wired into BaseInference (load/destroy lifecycle)
CI/CD publishing workflow following qvac-lib-langdetect-text pattern

What changed

New package: packages/qvac-lib-diagnostics/

index.js: Singleton diagnostic system with JSDoc typedefs, runtime detection, report generation
APIs: registerAddon, unregisterAddon, registerExtension, collectEnvironment, collectHardware, generateReport, serializeReport, reset
13 unit tests (44 assertions) via brittle

Modified: packages/qvac-lib-infer-base/

Optional @qvac/diagnostics require with try/catch (no hard dependency)
Auto-register addon in load(), unregister in destroy()
getDiagnostics delegates to subclass _getDiagnosticsJSON() if implemented

New: .github/workflows/trigger-reusable-lib-qvac-lib-diagnostics.yml

CI/CD workflow for GPR dev builds and npm releases

Test plan

npx standard index.js — lint passes
npx tsc — generates valid index.d.ts
npm test — 13/13 tests pass, 44/44 assertions
Existing infer-base tests unaffected (92/92 pass)
Workflow validated via workflow_dispatch

Asana: https://app.asana.com/0/0/1213438112051005

…d CI - New @qvac/diagnostics package (v0.1.0) with DiagnosticReport schema, addon registration, environment/hardware collection, report generation - Wire BaseInference for optional diagnostics addon registration - Add CI/CD publishing workflow for diagnostics package - 13 unit tests, 44 assertions

github-actions · 2026-03-10T13:44:21Z

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (2/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*

olyasir · 2026-03-10T13:45:05Z

/review

olyasir · 2026-03-10T13:59:25Z

/review

olyasir · 2026-03-10T14:03:40Z

/review

…d CI (#796) - New @qvac/diagnostics package (v0.1.0) with DiagnosticReport schema, addon registration, environment/hardware collection, report generation - Wire BaseInference for optional diagnostics addon registration - Add CI/CD publishing workflow for diagnostics package - 13 unit tests, 44 assertions

…oning) Addresses CodeQL alert #796 (`actions/artifact-poisoning`) on PR #1946 flagged on the two `Download {Android,iOS} prebuilds (from artifacts)` steps in integration-mobile-test-tts-ggml.yml. The rule fires because the workflow has a `workflow_dispatch` entry point and downloads an artifact via `actions/download-artifact@v8` without an explicit `run-id`. Without that input, CodeQL has to assume the artifact could come from any prior run on the branch (including one uploaded by a fork PR's prebuild step) — which is the poisoning surface we are explicitly NOT exposing. Setting `run-id: ${{ github.run_id }}` (the action's existing default) plus `github-token: ${{ secrets.GITHUB_TOKEN }}` makes the trust boundary explicit at the call site so the analyzer can see the artifact is current-run only. No behavioural change: in `workflow_call` from on-pr-tts-ggml the parent workflow already produced the artifact in the same run, and `workflow_dispatch` falls into the `!inputs.package_spec` -> npm-pack branch since `package_spec` defaults to `@qvac/tts-ggml@latest` for that trigger. The four `actions/missing-workflow-permissions` findings on the benchmark stubs are addressed by the previous commit (ef8d4e2). Co-authored-by: Cursor <cursoragent@cursor.com>

* Add tts-ggml workflows * Add explicit file-level permissions to tts-ggml workflows Addresses GitHub Advanced Security findings on PR #1946 flagging the 4 benchmark stubs and the two integration workflows for the CodeQL actions/missing-workflow-permissions rule: every workflow file should declare a least-privilege `permissions:` block at the top so that any job added later inherits read-only by default instead of the implicit read/write GITHUB_TOKEN. - benchmark-{chatterbox,performance,rtf,supertonic}-tts-ggml.yml: add top-level `permissions: contents: read` plus a job-level mirror on the noop body (which only writes to stdout). - integration-test-tts-ggml.yml: add top-level `permissions: contents: read; packages: read` matching the existing job-level scope on `run-integration-tests`. - integration-mobile-test-tts-ggml.yml: add top-level `permissions: contents: read`; the existing `build-and-test` job continues to widen this to packages:read + pull-requests:write + id-token:write for the prebuild artifact pull and Device Farm hooks. The other six tts-ggml workflows (cpp-test-coverage, create-github-release, on-merge, on-pr, on-pr-close, prebuilds) already had top-level permissions declared and are untouched. Co-authored-by: Cursor <cursoragent@cursor.com> * Pin mobile prebuild downloads to current run-id (CodeQL artifact poisoning) Addresses CodeQL alert #796 (`actions/artifact-poisoning`) on PR #1946 flagged on the two `Download {Android,iOS} prebuilds (from artifacts)` steps in integration-mobile-test-tts-ggml.yml. The rule fires because the workflow has a `workflow_dispatch` entry point and downloads an artifact via `actions/download-artifact@v8` without an explicit `run-id`. Without that input, CodeQL has to assume the artifact could come from any prior run on the branch (including one uploaded by a fork PR's prebuild step) — which is the poisoning surface we are explicitly NOT exposing. Setting `run-id: ${{ github.run_id }}` (the action's existing default) plus `github-token: ${{ secrets.GITHUB_TOKEN }}` makes the trust boundary explicit at the call site so the analyzer can see the artifact is current-run only. No behavioural change: in `workflow_call` from on-pr-tts-ggml the parent workflow already produced the artifact in the same run, and `workflow_dispatch` falls into the `!inputs.package_spec` -> npm-pack branch since `package_spec` defaults to `@qvac/tts-ggml@latest` for that trigger. The four `actions/missing-workflow-permissions` findings on the benchmark stubs are addressed by the previous commit (ef8d4e2). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

…d CI (#796) - New @qvac/diagnostics package (v0.1.0) with DiagnosticReport schema, addon registration, environment/hardware collection, report generation - Wire BaseInference for optional diagnostics addon registration - Add CI/CD publishing workflow for diagnostics package - 13 unit tests, 44 assertions

* Add tts-ggml workflows * Add explicit file-level permissions to tts-ggml workflows Addresses GitHub Advanced Security findings on PR #1946 flagging the 4 benchmark stubs and the two integration workflows for the CodeQL actions/missing-workflow-permissions rule: every workflow file should declare a least-privilege `permissions:` block at the top so that any job added later inherits read-only by default instead of the implicit read/write GITHUB_TOKEN. - benchmark-{chatterbox,performance,rtf,supertonic}-tts-ggml.yml: add top-level `permissions: contents: read` plus a job-level mirror on the noop body (which only writes to stdout). - integration-test-tts-ggml.yml: add top-level `permissions: contents: read; packages: read` matching the existing job-level scope on `run-integration-tests`. - integration-mobile-test-tts-ggml.yml: add top-level `permissions: contents: read`; the existing `build-and-test` job continues to widen this to packages:read + pull-requests:write + id-token:write for the prebuild artifact pull and Device Farm hooks. The other six tts-ggml workflows (cpp-test-coverage, create-github-release, on-merge, on-pr, on-pr-close, prebuilds) already had top-level permissions declared and are untouched. Co-authored-by: Cursor <cursoragent@cursor.com> * Pin mobile prebuild downloads to current run-id (CodeQL artifact poisoning) Addresses CodeQL alert #796 (`actions/artifact-poisoning`) on PR #1946 flagged on the two `Download {Android,iOS} prebuilds (from artifacts)` steps in integration-mobile-test-tts-ggml.yml. The rule fires because the workflow has a `workflow_dispatch` entry point and downloads an artifact via `actions/download-artifact@v8` without an explicit `run-id`. Without that input, CodeQL has to assume the artifact could come from any prior run on the branch (including one uploaded by a fork PR's prebuild step) — which is the poisoning surface we are explicitly NOT exposing. Setting `run-id: ${{ github.run_id }}` (the action's existing default) plus `github-token: ${{ secrets.GITHUB_TOKEN }}` makes the trust boundary explicit at the call site so the analyzer can see the artifact is current-run only. No behavioural change: in `workflow_call` from on-pr-tts-ggml the parent workflow already produced the artifact in the same run, and `workflow_dispatch` falls into the `!inputs.package_spec` -> npm-pack branch since `package_spec` defaults to `@qvac/tts-ggml@latest` for that trigger. The four `actions/missing-workflow-permissions` findings on the benchmark stubs are addressed by the previous commit (ef8d4e2). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

olyasir requested review from a team as code owners March 10, 2026 13:37

DmitryMalishev approved these changes Mar 10, 2026

View reviewed changes

mialso approved these changes Mar 10, 2026

View reviewed changes

Merge branch 'main' into feat/QVAC-13562-diagnostics-package

b2d693b

GustavoA1604 approved these changes Mar 10, 2026

View reviewed changes

olyasir merged commit 56cbfac into main Mar 10, 2026
8 checks passed

olyasir deleted the feat/QVAC-13562-diagnostics-package branch March 10, 2026 14:03

olyasir mentioned this pull request Mar 10, 2026

QVAC-13614 feat: integrate OCR addon with diagnostics contributor pattern #800

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

QVAC-13562 feat: add @qvac/diagnostics package with BaseInference integration#796

QVAC-13562 feat: add @qvac/diagnostics package with BaseInference integration#796
olyasir merged 2 commits into
mainfrom
feat/QVAC-13562-diagnostics-package

olyasir commented Mar 10, 2026

Uh oh!

github-actions Bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

olyasir commented Mar 10, 2026

Uh oh!

olyasir commented Mar 10, 2026

Uh oh!

olyasir commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

olyasir commented Mar 10, 2026

Summary

What changed

Test plan

Uh oh!

github-actions Bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tier-based Approval Status

Uh oh!

olyasir commented Mar 10, 2026

Uh oh!

olyasir commented Mar 10, 2026

Uh oh!

olyasir commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Mar 10, 2026 •

edited

Loading