chore: sync changes

[sitole]

Automated sync. Do not edit this branch.

GitOrigin-RevId: 08b169a46c1e0563b6d1613c285e247ee0e110dc

[cursor]

PR Summary

Low Risk
Small CI and helper-script changes with no auth or production runtime impact; migration script behavior differs only when git tree and filesystem disagree.

Overview
CI can start the orchestrator from an alternate Makefile directory via a new orchestrator-make-path input on the start-services action (default unchanged). get-latest-migration.sh resolves the repo root from the script location and picks the latest migration from packages/db/migrations on disk instead of from git HEAD. packages/local-dev/.gitignore ignores a built local-dev binary.

^{Reviewed by Cursor Bugbot for commit 6d0f71a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[claude]

LGTM — small, mechanical CI/tooling changes with no production code impact.

What was reviewed: the new optional orchestrator-make-path composite-action input (defaults to the existing path, wired through correctly to start-service.sh); the get-latest-migration.sh change from git-based to filesystem-based migration lookup (verified packages/db/migrations/ exists relative to the script via dirname "$0"/.., and confirmed all 4 call sites invoke it with a path such that $0 resolves correctly); and the added .gitignore entry for the local-dev binary.

Extended reasoning...

Overview

This PR touches three files: a GitHub composite action (.github/actions/start-services/action.yml), a .gitignore entry in packages/local-dev, and a shell script (scripts/get-latest-migration.sh) used to compute the expected DB migration timestamp for Docker builds and Makefiles.

Security risks

None. These are CI/build tooling changes only — no production code paths (API, orchestrator, envd, auth) are touched. The script change removes a git dependency in favor of listing a local directory, which is strictly less surprising and does not introduce any injection or path-traversal risk (the directory is a fixed relative path).

Level of scrutiny

Low. This is exactly the kind of small, mechanical CI/build-tooling change that doesn't need deep review: an optional composite-action input with a safe default that preserves existing behavior, a gitignore addition, and a script rewritten to avoid a git dependency so it also works in contexts without full git history (e.g. Docker build contexts). I traced the input through to its consumer (start-service.sh) and verified all call sites of get-latest-migration.sh invoke it in a way that makes dirname "$0" resolve to the repo root correctly.

Other factors

No prior reviews or outstanding comments on this PR. The bug-hunting system found no issues, and my own read of the diff didn't surface anything beyond what's already covered above.