| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
ci(desktop): publish macOS alphas sooner after a merge (#6950) Build the signed macOS alpha alongside the packaged smoke and other builds, and serialize only the upload to the rolling release. A build that finishes after a newer one is skipped instead of moving the feed back. Fetch only release tag names instead of every branch's history, and stop the first pnpm run from reinstalling every workspace package. Signed-off-by: Jalil <reachjalil@gmail.com> | 1 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
ci(macos): move macos-14 jobs to macos-26 (#6778) GitHub retires macOS 14 runner images on 2026-11-02 and cancels jobs during scheduled brownouts (actions/runner-images#13518). The alpha macOS arm64 build was cancelled by one. | 5 天前 | |
chore(celld): run the runner fleet's tooling on celld v0.6.3 (#6715) * chore(celld): run the runner fleet's tooling on celld v0.6.3 celld v0.6.3 refuses to acquire a cell whose ownership record (cells/<cell>/own.json) is missing while its LTX is still in the bucket, instead of starting it at epoch 1 with an empty database. It also distrusts the compromised eMudhra CA certificates and takes rustls 0.23.46. It supports a rolling upgrade from v0.6.2. The deploy workflow installs this version for `celld deploy` and the preflight node. The fleet nodes install celld from the Render service's build command, which is changed separately. OWNER-CELLS.md now recommends CELLD_TTL_MS=60000: on R2, most outages that fenced every node with 30000 lasted 20-50 s. It also recommends a CELLD_WATCH the start command empties (bucket durability only), a CELLD_LOCAL_CACHE_MAX_BYTES under the temporary disk's limit, and no lifecycle rule on celld's reserved prefixes. Signed-off-by: Jalil <reachjalil@gmail.com> * ci(celld): fail the daily backup when a cell's ownership record is lost celld v0.6.3 refuses a cell whose ownership record (fleet/cells/<cell>/own.json) is missing while its LTX is still in the bucket; older nodes start such a cell with an empty database. celld never deletes the record, so a missing one means something else did, and the first sign would otherwise be a person's conversation failing. The backup already lists the whole bucket to count objects. That listing is now kept, and a new step fails the run, naming the cells, when a cell has LTX but no own.json. The snapshot is written first. A failed listing now fails the backup instead of counting as empty. OWNER-CELLS.md gets the restore steps from celld's guarantees. Signed-off-by: Jalil <reachjalil@gmail.com> --------- Signed-off-by: Jalil <reachjalil@gmail.com> | 6 天前 | |
ci(workbot): start new Freestyle computers with the runner's guest (#6841) The desktop guest changes most days, but the runner deploy builds a Freestyle snapshot only when the desktop image changes. So a new computer usually starts with an older guest and installs the runner's on first open, which took one open from about 4.4 s to 11.1 s. Rebuilding the image for every guest would add four to six minutes to a two minute deploy, nearly all of it spent installing packages that have not changed. Instead, layer the guest onto the image's snapshot: boot it, install and start the guest as the runner does, and capture workbot-desktop-freestyle-<image>-<guest>. New computers start from that, report the runner's own version, and skip the install. The layer boots once before it is used, because every new computer would start from it, and it is deleted if the guest doesn't answer. Older layers get the same 14-day unused deletion window as older images. The image's snapshot stays as it is, so a sandbox gateway's template that names it is not affected. The new script is deliberately not one of the desktop image's inputs: it changes nothing an image installs, so it leaves existing computers current. They still install a new guest in place. Layering only saves time, so unlike an image build it never stops a deploy: if it fails, new computers start from the image's snapshot and install the guest as they do today. Signed-off-by: Jalil <reachjalil@gmail.com> | 2 天前 | |
Revert "refactor(engine): remove OpenCode v1 and run only OpenCode v2 (#6515)" (#6559) This reverts commit cdc21843845df598d76e7f104038aa9dbea9f6b5. | 8 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
feat(den-web): feature intros as default empty states (#6964) * feat(den-web): feature intros as default empty states Adds per-page feature intros (full screen, tab box, banner) with live sample-data examples, a ? help button and unseen tab dots, behind the featureIntros flag, plus per-member intro state (feature_intro_state, /v1/me/feature-intros). Merges SSO and SCIM into Settings > Auth & Security behind authSecuritySettings. DESIGN.md gains rules I1-I10. * docs: add missing pages for feature intro links Adds docs for OpenWork Models, gateway users and teams, the usage dashboard, connectors, per-person sign-in, plugins, agents/commands/hooks, GitHub Sources, prompts, Workbot, My bot, My Library, Automations, analytics, audit logs, API keys, billing, Tool Tester and the managed installer. Fixes members-and-rbac (custom roles exist) and points each intro's Read the docs link at its page. * fix(den-web): wrap Auth & Security routes in Suspense for prerender useSearchParams needs a Suspense boundary during next build; the new /dashboard/auth-security page and the redirecting /dashboard/sso and /dashboard/scim routes failed to prerender. * fix(den-web): align Auth & Security intro and docs with per-organization SSO Require SSO is now per organization and can live on the SSO tab (ssoSettingsOnSsoPage); the intro no longer says domain emails always go straight to SSO, and the docs describe where Require SSO, Restrict this domain and Ask for SSO again live. | 8 小时前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci(warden): make PR reviews advisory only (#6847) | 2 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
feat(release): commit-free tag-driven releases — pure GHA + GitHub Releases (#3818) * fix(desktop): normalize asar entry separators so Windows afterPack verification matches * feat(release): commit-free tag-driven releases — versions live in tags, CI stamps the workspace * fix(release): skip workspace stamping when recovering pre-redesign tags * feat(release): assert packaged artifacts carry the tag version before upload * fix(desktop): satisfy @electron/asar listPackage signature in afterPack typecheck | 2 个月前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
feat(managed): adopt the shared GCP module with a guarded database upgrade (#6192) * feat(managed): adopt the shared Google Cloud module with a guarded migration handover Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): accept shared GCP bundles and wait for rollout completion Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * docs(managed): distinguish GCP operator and service-account IAM prerequisites Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): canonicalize Docker Hub digest references before mirroring Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): enable Cloud Resource Manager before GCP planning Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * docs(managed): require Google issuance in inherited CAA policies Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): verify maintained revisions through scoped Cloud Run API Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): accept omitted zero traffic percentages in GCP health Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): preserve the legacy Cloud SQL user host during adoption Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * docs(managed): explain Cloud Run revision tag removal on updates Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): recover fresh health reports and track the exact health execution Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> * fix(managed): bound GCP maintenance commands and document update downtime Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> --------- Signed-off-by: Guillaume Loret <guillaume@openworklabs.com> | 2 天前 | |
Revert "refactor(engine): remove OpenCode v1 and run only OpenCode v2 (#6515)" (#6559) This reverts commit cdc21843845df598d76e7f104038aa9dbea9f6b5. | 8 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
fix(dry-run): enforce read-only copies and protected-source cleanup (#6536) | 9 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard. | 13 天前 | |
ci(desktop): publish macOS alphas sooner after a merge (#6950) Build the signed macOS alpha alongside the packaged smoke and other builds, and serialize only the upload to the rolling release. A build that finishes after a newer one is skipped instead of moving the feed back. Fetch only release tag names instead of every branch's history, and stop the first pnpm run from reinstalling every workspace package. Signed-off-by: Jalil <reachjalil@gmail.com> | 1 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
ci: run release and production jobs in protected environments (#6415) Jobs that sign desktop builds, publish packages, migrate the production database or deploy Den now name a GitHub environment, so their credentials can live as environment secrets instead of repository secrets: - macos-signing: alpha and release macOS builds, notarization smoke - den-production: Render deploys and Daytona snapshot promotion - den-database: production migrations - review-app: review app deploy and evidence publishing - aur: AUR validation and publishing - npm-publish: openwork-ui-mcp publishing Each uses deployment: false, so no deployment records are created. Until secrets move, jobs keep reading the repository secrets. Also correct the freestyle-cleanup comment: its provider keys are repository secrets, not environment secrets. Signed-off-by: Jalil <reachjalil@gmail.com> | 12 天前 | |
Revert "refactor(engine): remove OpenCode v1 and run only OpenCode v2 (#6515)" (#6559) This reverts commit cdc21843845df598d76e7f104038aa9dbea9f6b5. | 8 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
ci: post the contributor gate as diff-warden, approve and open PRs as an App (#5783) * ci: post the contributor gate as diff-warden, approve and open PRs as an App Any workflow on a branch can ask for statuses or pull-requests write, so with "Allow GitHub Actions to create and approve pull requests" on, someone with write access could fake contributor-pr-required or approve their own PR as github-actions[bot]. - contributor-pr-required is now posted with a diff-warden App token (statuses only), minted in the warden-clearance environment, which only dev and v* tags can use. The four jobs that post it no longer give the workflow token statuses write, and the AI screen no longer touches it. With the dev ruleset requiring that App as the source, no branch workflow can post it. - revert-fastlane approves, and changelog and update-models open their PRs, with an optional automation App (AUTOMATION_APP_ID and AUTOMATION_PRIVATE_KEY in warden-clearance), falling back to the workflow token until it exists. Not diff-warden: Warden clearance withdraws diff-warden approvals, and an App can't approve its own PR. Once the App exists, the repository can turn off "Allow GitHub Actions to create and approve pull requests". Signed-off-by: OmarMcAdam <gh@mcadam.io> * ci: keep maintainer handles out of the gate status Warden's confidentiality review flagged a line this PR changes; the only person-related text in it was the GitHub handle of the maintainer who ran /test, in a public commit status. The status now says "a maintainer"; the bot's PR comment still records who ran /test. Signed-off-by: OmarMcAdam <gh@mcadam.io> * ci: let /test read commit statuses authorize and finalize read the screen, AI screen and Warden statuses with the workflow token. The previous commit removed statuses: write from those jobs without granting statuses: read, which would have made those reads fail with 403. Found by the Vercel review bot. Signed-off-by: OmarMcAdam <gh@mcadam.io> --------- Signed-off-by: OmarMcAdam <gh@mcadam.io> | 28 天前 | |
ci: build and deploy only affected products (#6694) Resolve per-product inputs from workspace dependencies and explicit build-time source reads instead of treating every dev merge as a full product change. Keep unknown comparisons conservative and preserve the required checks and daily/manual backstops. Use successfully published image fingerprints and target-level locks so skipped or failed work is not mistaken for a successful baseline. Preserve release builds and exercise changed image recipes on infrastructure PRs. Version native Render filters behind an explicit preview/apply operator workflow; this commit does not edit live services. Keep real dev CodeQL scans until their complete-baseline accounting can be changed separately. | 7 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
feat(gateway): add openrouter-eu provider to the models catalog (#6579) * feat(gateway): add openrouter-eu provider to the models catalog Move the Update Models workflow's inline download/validation into ee/apps/gateway/scripts/update-models.mjs and derive an openrouter-eu provider from OpenRouter's EU model list, cloning matching models from openrouter and dropping slugs it does not have. * fix(ci): run the models generator from the workflow's own commit Check out update-models.mjs from github.workflow_sha without credentials instead of running it from the dispatcher-chosen base branch, which has the persisted write token. | 8 天前 | |
ci(warden): make PR reviews advisory only (#6847) | 2 天前 | |
ci(warden): make PR reviews advisory only (#6847) | 2 天前 | |
ci: gate PRs on one quick check, run the rest after merge (#6804) * ci(warden): design Warden as a fixer and add an off-by-default prototype Warden's findings report now carries each finding's confidence and suggested fix. The manual, variable-gated fixer turns high-confidence, small fixes to files a same-repository PR already changes into one fix PR against that PR's branch. It never pushes to the PR, approves or merges. Release note: none * ci: gate PRs on one quick check; run everything else after merge PRs run only the Quick check (openwork-tests-required): static CI guards, the feature registry and Helm chart, a typecheck of shipped code for every changed package and its dependents (tests left out), and the Den API auth and permission tests plus audit route coverage when Den API inputs change. Moved off PRs, with the same assertions: - Build and core checks (unit tests, full Den API suite, desktop build, docs and models validation) runs on dev pushes and nightly. - PR change proof runs by hand; core journeys and changed proofs run on the dev push that merges them. - The packaged desktop smoke runs before every alpha release. - CodeQL analyzes dev pushes and weekly; PRs upload empty results for the code_scanning rule. - EE images verify nightly; plugin, Terraform, installer, feature registry and evidence tooling checks run on the dev pushes that change them. Release note: none | 4 天前 | |
ci(warden): make PR reviews advisory only (#6847) | 2 天前 | |
ci(warden): short Slack digest and readable fix PRs (#6889) | 2 天前 | |
ci(warden): make PR reviews advisory only (#6847) | 2 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 天前 | ||
| 7 天前 | ||
| 12 天前 | ||
| 5 天前 | ||
| 6 天前 | ||
| 2 天前 | ||
| 8 天前 | ||
| 13 天前 | ||
| 7 天前 | ||
| 4 天前 | ||
| 12 天前 | ||
| 7 天前 | ||
| 8 小时前 | ||
| 13 天前 | ||
| 4 天前 | ||
| 2 天前 | ||
| 13 天前 | ||
| 13 天前 | ||
| 4 天前 | ||
| 13 天前 | ||
| 12 天前 | ||
| 12 天前 | ||
| 13 天前 | ||
| 12 天前 | ||
| 7 天前 | ||
| 13 天前 | ||
| 13 天前 | ||
| 4 天前 | ||
| 12 天前 | ||
| 2 个月前 | ||
| 4 天前 | ||
| 12 天前 | ||
| 13 天前 | ||
| 13 天前 | ||
| 2 天前 | ||
| 8 天前 | ||
| 4 天前 | ||
| 4 天前 | ||
| 9 天前 | ||
| 4 天前 | ||
| 4 天前 | ||
| 13 天前 | ||
| 1 天前 | ||
| 7 天前 | ||
| 12 天前 | ||
| 8 天前 | ||
| 7 天前 | ||
| 28 天前 | ||
| 7 天前 | ||
| 4 天前 | ||
| 8 天前 | ||
| 2 天前 | ||
| 2 天前 | ||
| 4 天前 | ||
| 2 天前 | ||
| 2 天前 | ||
| 2 天前 |