Bump pnpm/action-setup from 4 to 6 - #7
Open
dependabot[bot] wants to merge 22 commits into
Open
Conversation
…tion detection The CLI was uploading .turbo cache blobs and other gitignored files because it fell back to the api-gateway subdirectory's .gitignore instead of the monorepo root's, ballooning the upload to ~1800 files and causing repeated "Upload aborted" failures. An explicit .vercelignore fixes that regardless of which .gitignore the CLI would otherwise pick. Separately, the Fastify framework preset's zero-config detection was treating src/app.ts (a factory function, not a default-exported server) as a second function entry point and routing traffic to it instead of the project's own api/index.ts handler, crashing every request. Disabling framework detection fixes routing, at the cost of needing an explicit (empty) output directory since there's no static frontend here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BTcRHQmup7ykxjRG7CBNW1
…dged detail The previous version buried "what this does" under paragraph-long sentences stacking every caveat inline. Replaced with a short problem/solution intro, a plain how-it-works list, a component table, and badges/links (live demo, CI status, tech stack) — the honesty about what's real vs. not-yet-live stays, just as a scannable status table instead of prose. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BTcRHQmup7ykxjRG7CBNW1
Loads DATABASE_URL from the gitignored .env.prod-workers.local (chmod 600, never committed) then execs the existing prod-workers supervisor. Invoked as `bash <path>` rather than directly, so it doesn't need the executable bit. The launchd registration itself is not done yet -- it needs Full Disk Access granted to /bin/bash first, since ~/Desktop is TCC-protected and launchd-spawned processes don't inherit Terminal's grant. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BTcRHQmup7ykxjRG7CBNW1
…ized functions Runtime-config validation (Postgres URL, RPC URL/network resolution, merchant capability parsing, bounded-int parsing, ConfigurationError base) was byte-identical across api-gateway, orchestrator-worker, payment-worker, and x402-demo-target; moved into packages/goat-network-config as shared helpers. protected-delivery-fetch-client.ts was ~90% identical between orchestrator-worker and x402-demo-target; moved into packages/protected-delivery-runner as a parameterized factory. Split apps/api-gateway/src/app.ts's ~400-line createApp() into per-route-group registration functions, and apps/orchestrator-worker/src/pipeline.ts's ~324-line runOrchestratorPipeline() into phase-level helpers (risk analysis, procurement, execution, evidence, attestation) -- behavior unchanged, verified against the existing test suites (including the 22 checkpoint/resume pipeline tests) after each step. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
- Add description/license to all 19 workspace package.json files; remove x402-payments' unused run-domain and zod dependencies. - Fix docs/architecture.md drift: it described a Redis/BullMQ queue and separate Execution/Procurement/Sentinel/Signer worker containers that were never built -- job queuing is Postgres-backed leased jobs, and those phases all run inside orchestrator-worker/payment-worker. - Add direct unit tests for the new goat-network-config helpers (previously only covered indirectly via each app's runtime-config.test.ts) and for web-dashboard's pure formatting/validation helpers, which had zero test files before this. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
No ESLint/Prettier existed anywhere in this 18-package TypeScript monorepo, and every package's "format:check" script was actually just a duplicate of "format:check" -> "typecheck" (tsc --noEmit does not check formatting). Removed those 18 fake scripts and the now-unused turbo.json task for them. Added @biomejs/biome with a root biome.json (single quotes/semicolons/2-space indent to match existing style; noLiteralKeys and noNonNullAssertion turned off since they conflict with this repo's noPropertyAccessFromIndexSignature tsconfig setting and an established, deliberate `!`-after-guard pattern; noDescendingSpecificity/noImportantStyles off for the hand-tuned CSS cascade in styles.css). New root scripts: lint, lint:fix, and a real format:check. Wired both into a new CI job and into `pnpm verify`. Applied Biome's formatter across the repo and fixed everything it flagged: - 3 genuine noImplicitAnyLet gaps (x402-demo-target's receipt/native-payment verifier `let` locals had no type until first assignment). - 3 unsafe optional-chaining sites in tests where an absent array element would have thrown a confusing TypeError instead of a clear assertion failure; replaced with an explicit guard. - A handful of real accessibility issues (a <div> needing role="region" or a <section> instead, an array-index React key swapped for the already- available requestHash, a couple of justified biome-ignore exceptions for patterns that are correct here but look wrong in isolation, e.g. a non-form <div> reimplementing Enter-to-submit because it's nested inside the outer <form> and nested <form> tags are invalid HTML). - A stale, inert `eslint-disable-next-line` comment (ESLint was never actually installed) on two intentionally-narrow useEffect dependency arrays, replaced with an enforced biome-ignore plus the reasoning. - 4 env vars read in scripts but not declared to Turborepo's cache key (added to turbo.json's globalPassThroughEnv). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
None of /v1/quotes, /v1/auth/session, /v1/services/onboard, /v1/runs, or /v1/runs/:runId/payment-challenge had any request-rate protection despite the latter two triggering real external cost (OpenAPI fetches, GOAT Flow order creation). Added @fastify/rate-limit: a generous global default (300/min/IP) plus tighter per-route ceilings on those five routes. Route declarations had to move inside app.after(...): @fastify/rate-limit wires its per-route config.rateLimit override via an onRoute hook, and a route declared synchronously right after the unawaited `app.register(rateLimit, ...)` call (as apps/api-gateway's other plugin, cors, has always done) gets no rate limiting at all, since that hook hasn't attached yet -- confirmed with an isolated repro before touching the real route table. The plugin's errorResponseBuilder return value is thrown and routed through this app's own generic setErrorHandler rather than sent directly, so it needed an explicit statusCode: 429 to avoid being miscategorized as a 500, plus a small addition to that handler to preserve the RATE_LIMITED code instead of collapsing it into the generic BAD_REQUEST used for other 4xx errors. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
The layering documented in docs/architecture.md (packages/* never depending on apps/*, apps/web-dashboard only reaching the backend through public-api-client) was true only by discipline -- nothing would catch a future violation except someone noticing on review. Added a .dependency-cruiser.cjs with four rules (no-circular, packages-do-not-depend- on-apps, web-dashboard-is-frontend-only, demo-target-is-not-a-backend- dependency), a `depcruise` script, and a CI step after `pnpm build` (the ruleset resolves @shipyard402/* imports through each package's built dist/, same as Node does at runtime, so it needs the workspace already built). Verified the rules actually fire, not just pass vacuously: temporarily added a real cross-boundary dependency (persistence-postgres from web-dashboard) and confirmed dependency-cruiser flagged it, before reverting. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
apps/web-dashboard had zero tests that actually rendered a React component -- the earlier pass in this session only covered pure formatting/validation helpers. The two components that actually move money (release-run-form.tsx, wallet-pay-panel.tsx) had no behavioral coverage at all. Added @testing-library/react + jsdom + user-event as devDependencies, scoped to just these two new test files via a per-file `@vitest-environment jsdom` comment so the existing node-environment pure-function tests (which rely on `window` being undefined by default) are unaffected. Coverage added: - WalletPayPanel: no-wallet-detected fallback copy, connect-wallet flow, connected-elsewhere skips straight to Pay, a successful payment shows the tx-hash link, and a wallet rejection (EIP-1193 code 4001) surfaces the friendly message instead of a raw error. - ReleaseRunForm: submission is blocked until a wallet is connected, a connect + quote-request round trip renders the returned quote, and an API failure surfaces its message instead of being swallowed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
Cheap polish from the repo-quality pass: pin the Node major version editors and nvm/fnm pick up automatically (matches engines >=24.0.0 and CI's NODE_VERSION), add a baseline .editorconfig (2-space default, 4-space for Solidity to match forge fmt, trailing-whitespace trimming left off for Markdown's trailing-double-space line breaks), and add a one-line note to docs/adr/README.md explaining why ADR numbers 0004/0005/0007/0008/0010/0011/ 0013 don't exist (retired during drafting, not a missing-files bug). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
…nents Only the payment UI (wallet-pay-panel, release-run-form) had render-level coverage. Added the same for the remaining components that render real data and call the API, as opposed to the static marketing/landing sections: - service-onboarding.tsx: collapsed-by-default toggle, required-field validation blocking submission, a successful registration reporting back to the parent, and the API-error path. - run-history.tsx: loading state, the deliberate "render nothing" behavior on both an empty page and a load failure, row rendering with status labels, and paginated "Load more". - run-detail.tsx: loading state, rendering RunProgressPanels once the run resolves, the plain-error vs AUTH_-prefixed-error branches (the latter shows a reconnect prompt instead of a generic error card), and the reconnect flow itself. - run-progress-panels.tsx: the payment panel across its three real states (awaiting challenge / challenge issued / confirmed with tx link), the AI risk plan and evidence panels once populated (including a FAIL result), the terminal verdict banner, and that a pending panel's toggle stays non-interactive while a ready one expands. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
The session's earlier test-coverage work has no protection against silent erosion -- nothing stops a future change from quietly deleting a test or an assertion. Added @vitest/coverage-v8 (pinned to match the repo's vitest 3.2.7, not the v4 the bare install resolves to) and a vitest.config.ts scoping coverage to src/lib, src/hooks, and src/components -- excluding the app-router pages (thin Next.js routing wrappers, better exercised by the browser than a unit test) and the presentational-only marketing/landing components that were never in scope for this work. Thresholds (65% statements/lines, 80% branches, 50% functions) are set a comfortable margin below what that scope actually measures at right now (72.47/85.8/57.31/72.47) -- a floor, not an aspirational target. Verified the gate is real by temporarily setting an impossible threshold and confirming `pnpm test:coverage` actually fails, then reverting. Wired into `pnpm verify` and a new CI step (apps/web-dashboard only, right after the existing `pnpm test`). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
pipeline.ts had grown to 735 lines carrying all five pipeline phases (risk
analysis, procurement, execution, evidence, attestation) plus their shared
types, error classes, and the scenario registry -- a lot of blast radius in
one file. This is an internal-only reorganization: the same process, same
deployment, same runtime behavior, just moved into apps/orchestrator-worker/
src/pipeline/{types,errors,scenarios,risk-analysis-phase,procurement-phase,
execution-phase,evidence-phase,attestation-phase}.ts.
pipeline.ts itself shrinks to 205 lines: runOrchestratorPipeline (the
resumable state-machine driver) plus re-exports of everything worker.ts,
main.ts, and the test suites already imported from './pipeline.js', so
nothing outside this file needed to change.
Deliberately did NOT split this into separate deployable services/processes
-- that would be real infrastructure work (new job leasing between phases,
new deploy targets) carrying real risk to the production workers this repo
runs today, which is out of proportion for a code-organization concern.
Verified byte-identical behavior: typecheck clean, build clean, and all 39
tests pass unchanged, including the 22 checkpoint/resume pipeline tests that
exercise this exact resumable-state-machine logic. Stopped the live
production workers (which run via `tsx watch` and reload on file save)
before making this change and restarted them only after full verification,
so no live process ran partially-edited code.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
The launchd-managed prod workers (see scripts/run-prod-workers-launchd.sh) were running via `pnpm dev` (tsx watch), inherited from when this was a manual, actively-iterated-on session process. That's wrong for something meant to stay stable and unattended: a file-watcher has no business running against production, and it meant an unrelated edit anywhere else in the repo could silently restart a live worker mid-run. Switched both workers to `pnpm start` (node dist/main.js), with the supervisor script rebuilding via `turbo run build --filter=...` (not a plain pnpm filter) right before starting them, so a change to a shared packages/* dependency gets picked up too, not just the two apps themselves. A real code change now reaches the running workers only when the supervisor script restarts (`launchctl kickstart -k ...`), not on every save -- a deliberate tradeoff for stability during demo/judging. Also restores the repo-root .env load that `tsx watch --env-file-if-exists` used to provide for free (GOATX402_* creds, signer paths, OPENAI_API_KEY, IPFS_API_URL, etc.) -- plain `node` doesn't read .env files on its own. DATABASE_URL is explicitly saved and restored around that load so .env's local-Postgres value can't clobber the real prod Neon URL. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
launchd gives the process a minimal PATH (/usr/bin:/bin:/usr/sbin:/sbin), unlike an interactive shell that sources ~/.zshrc -- without this the supervisor script (and everything it execs) failed immediately with "pnpm: command not found" every time the LaunchAgent tried to start. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018N9SNh4DphGMH9TbQHdvBJ
The API gateway's CORS allowlist only accepted whichever loopback spelling WEB_ORIGIN used, so opening the dashboard via the other alias got rejected. Mirror loopback HTTP origins on the same port in development only; production's allowlist stays exact. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZf6VTzEduBpbtcXsF4QoU
Introduce AnimatedContent, DecryptedText, GlassSurface, LightRays, and SpotlightCard (from React Bits) plus a VerifiedText helper, and wire them into the landing page, app shell, workflow animation, problem/solution section, release-run form, replay-defense demo, run detail view, site header, specular button, and threat-coverage section. Bundles the accompanying stylesheet rework and the new gsap/three dependencies these components need. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZf6VTzEduBpbtcXsF4QoU
Apply the new VerifiedText component to the run verdict label and the mono hash/tx values in the panels, and drop the redundant [01]-style index prefix from panel labels now that the stepper above already numbers each stage. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZf6VTzEduBpbtcXsF4QoU
The Payment/Evidence/Attestation panel summary (e.g. "INVOICED", "PASS") sat in a flex item with flex-basis: 0, so once a sibling panel expanded and squeezed the others, it had almost no width left to grow into. Combined with overflow-wrap: anywhere, that made the status word wrap one letter per line instead of staying readable. Wrap the summary text in its own span and force it to stay on one line, truncating with an ellipsis instead of breaking mid-word. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XZf6VTzEduBpbtcXsF4QoU
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 6. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@v4...v6) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps pnpm/action-setup from 4 to 6.
Release notes
Sourced from pnpm/action-setup's releases.
Commits
0977fd9docs: Update README to include devEngines.packageManager (#273)48261acfix: update pnpm to v11.19.0 (#283)75677f7ci: use pnpm 11 forpr-check(#284)769ae71refactor: introduce restore keys for cache (#280)6fed91fdocs(README): point users to the successor pnpm/setup action (#282)0ebf471fix: update pnpm to v11.7.0 (#267)0e279bbfix: update pnpm to 11.1.1 (#248)3e83581fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)551b42edocs(README): fixcache_dependency_pathtype (#257)739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)