ci: CI gates, typecheck scaffold, dependabot (audit bucket 2 — M2, M3) - #2
Merged
Merged
Conversation
Audit bucket 2 — findings M2, M3 (report @ 23c7d12). M2 — CI + supply-chain scaffolding: - .github/workflows/ci.yml on PR + push to main: blocking 'build' gate (green in CI per existing tagged releases) plus non-blocking 'typecheck' and 'npm audit' jobs, labeled informational until the typing/dep buckets land. - .github/dependabot.yml: weekly npm + github-actions update PRs. - publish.yml installs with 'npm ci' (was 'npm install') for reproducible builds. M3 — type-check scaffold: - tsconfig.json (strict target) + 'npm run typecheck' (tsc --noEmit). Not yet strict-clean (index.ts uses node-ical's union type without narrowing, ~65 errors) so the CI step is non-blocking; promote to a required check once the typing bucket (H2) lands. Ratchet note recorded in tsconfig.json. Docs: README badge row (CI/release/license) + Last updated stamp; CHANGELOG. Verification on this arm64 host is type/lint only — Parcel's lmdb native module has no arm64/node-22 prebuilt binary, so 'npm run build' can't run locally (pre-existing). typecheck runs (65 errors, expected); deps installed via --ignore-scripts; workflow YAML + tsconfig validated as parseable. CI build gate relies on the same ubuntu-x64/node-20 path that cuts releases today. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cVCdCtNzUJmy1yen3JyBk
The bucket-1 removal of committed node_modules exposed that re2@1.17.7 has no Node-20 prebuilt binary — it only ever 'built' because a compiled re2.node was committed. A clean 'npm ci' now has to fetch/build re2, and 1.17.7 fails to compile on Node 20 (old nan vs modern V8: AccessorSignature removed). re2@1.26.0 ships a prebuilt but requires Node >=22, so bump both workflows to Node 22.x. This is a build-toolchain change only; the plugin is Parcel-bundled for the browser/Electron runtime and does not embed the native re2 binary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019cVCdCtNzUJmy1yen3JyBk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Audit report bucket 2 (report @
23c7d129) — CI and supply-chain scaffolding.M2 — CI + supply chain
.github/workflows/ci.ymlon every PR and push tomain:npm ci+npm run build); green in CI per existing tagged releases.continue-on-error), surfaces thetscerror count.npm audit --audit-level=high..github/dependabot.yml— weekly npm + github-actions update PRs.publish.ymlnow usesnpm ci(wasnpm install) for reproducible builds.M3 — typecheck scaffold
tsconfig.json(strict target) +npm run typecheck. The code isn't strict-clean yet (index.tsaccesses node-ical's union event type without narrowing — ~65 errors), so typecheck runs non-blocking; it flips to a required check once the typing bucket (H2/bucket 4) lands. Ratchet note is in the tsconfig.Docs: README badge row (CI/release/license) +
Last updatedstamp; CHANGELOG.Why
No gates existed — vulnerable deps rot silently, regressions merge freely, builds aren't reproducible. This adds the scaffolding and makes blocking only what's green today (build), with a documented promotion path for the rest.
Non-blocking-by-design (promotion triggers)
index.tsgreen.Testing / verification
dependabot.yml, andtsconfig.jsonall validated as parseable.npm run typecheckruns and reports 65 errors (expected; non-blocking).typescriptdevDep only (+16 lines);npm ci-consistent.lmdbnative module has no arm64/node-22 prebuilt binary on this host (pre-existing). The CI build gate uses the same ubuntu-x64/node-20 path that cuts releases today.Follow-up (needs repo settings — not in this PR)
After this merges and CI runs once (registering the
buildcheck), add a ruleset onmainrequiring PRs + thebuildstatus check. That's a repo-settings change; I'll hand you the exact steps.Reviewer note
No automated PR reviewer configured; self-reviewed (correctness, no runtime behavior change, no secrets, least-privilege
permissions: contents: readon the workflow).🤖 Generated with Claude Code
https://claude.ai/code/session_019cVCdCtNzUJmy1yen3JyBk