| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(diag): persistent memory trajectory + query-leak CI soak for #581 #581 (query-path memory growth) does not reproduce in our soak: a 10-min, 200-file query-only run shows RSS flat-to-shrinking and committed plateauing (mimalloc already purges on free, purge_delay=0). Rather than ship speculative mitigations for a leak we cannot measure, this adds the observability to find it where it actually occurs, plus a continuous guard. - diag: the diagnostics writer now appends a PERSISTENT NDJSON memory trajectory (one sample / 5s: rss, committed, peak fields, page_faults, fd, queries), kept on exit (rotates to a .1 generation past 8 MB) so users can send the time series post-mortem. The previous latest-snapshot file was overwritten every 5s and deleted on stop. - ci: the soak now also runs a read-only query-leak leg (CBM_SOAK_MODE query-leak, no reindex/mutate) on every platform including Windows, so a regression that introduces a query-path leak is caught. soak-test.sh RESULTS_DIR is now env-overridable so both legs keep separate artifacts. - docs: README Troubleshooting and Diagnostics section + a bug-report field explain the no-telemetry stance and how to capture and share the trajectory. Build clean; unit suite 5714/0; trajectory verified to persist post-exit. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 2 个月前 | |
Merge branch 'main' into fix/smoke-tool-inventory | 3 天前 | |
docs: make maintainer policy project-oriented Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 2 个月前 | |
Pin Actions to SHA + enforce via security audit + Dependabot - All GitHub Actions pinned to immutable commit SHAs (prevents tag-poisoning attacks like tj-actions/changed-files incident) - Security audit (Layer 1) now blocks unpinned Actions in CI - Dependabot configured to auto-propose SHA updates weekly - Pre-commit hooks tracked in scripts/hooks/ for contributors - Time-bomb detection + MCP file read audit added to Layer 1 | 6 个月前 | |
fix(ci): issue labeler no-oped on every issue — (?i) is invalid in JS RegExp github/issue-labeler compiles patterns with JavaScript RegExp, which rejects PCRE-only inline (?i) groups with SyntaxError: Invalid group, so the workflow failed before evaluating any rule and no issue ever got an area label (#764). Replace the third-party action with first-party actions/github-script: the same config rules are compiled with the i flag applied centrally (case-insensitivity preserved), labels stay additive-only via addLabels, and a pattern that fails to compile now fails the run loudly instead of silently no-oping. Strip (?i) from all 7 config patterns and document the line format the workflow parses. Verified locally: all 7 rules compile and match expected labels across sample issue texts; the old pattern reproduces the SyntaxError. Closes #764 Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 2 个月前 | |
ci: add issue-triage bots (stale, label-actions, area-labeler) Three native GitHub Actions to automate the mechanical parts of issue triage: - stale.yml: actions/stale scoped to the awaiting-reporter label — warns at 21 days idle, closes at 35, auto-resets when the reporter replies. Never touches PRs or unlabeled issues. - label-actions.yml + .github/label-actions.yml: posts a templated comment when duplicate or awaiting-reporter is applied (duplicates are linked, not auto-closed). - issue-labeler.yml + .github/issue-labeler.yml: adds area labels (windows, stability/performance, parsing/quality, editor/integration, ux/behavior, cypher, language-request) from title/body keywords. Additive only; base bug/enhancement labels still come from the forms. All third-party actions pinned to full commit SHAs with least-privilege per-job permissions (issues: write only where required). Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 3 个月前 | |
docs(ci): tell contributors the release freeze is over, not that it is ongoing The acknowledgement text described a state of the world that ended when 0.9.1-rc.1 published: it told every new contributor we were still finishing release-critical work and that "review resumes once the release path is clear". Posting that now would be false on the day it starts running. This is the obligation the PR description already set for itself -- the review-status section is a public promise and has to be edited when the situation it describes changes. Doing that before the workflow ever posts, rather than after someone reads a stale freeze notice, is the point. The queue is still real, so the section stays rather than being removed: the freeze is over, a large backlog is not, and PRs are being read oldest-first. Saying that is more useful to someone opening a PR today than either the old text or silence, because it explains why a recent PR sits behind older ones. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 1 个月前 | |
Adopt the Developer Certificate of Origin for all commits Every commit must now carry a Signed-off-by trailer matching its author, certifying the right to submit the change under the project's MIT license (DCO 1.1, the Linux kernel mechanism). Enforcement is strict at three layers: a commit-msg hook rejects unsigned commits locally (scripts/install-git-hooks.sh), and the new DCO workflow rejects every push and pull request containing one. Merge commits and bot authors are exempt, matching standard DCO checks. Signed-off-by: Martin Vogel <martin.vogel@datadice.io> | 3 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 2 个月前 | ||
| 3 天前 | ||
| 2 个月前 | ||
| 6 个月前 | ||
| 2 个月前 | ||
| 3 个月前 | ||
| 1 个月前 | ||
| 3 个月前 |