csh/playbook
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

📦 deps(thirdparty): update snapshots

Browse Source
This commit is contained in:
ci[bot]
2026-07-29 07:59:17 +00:00
parent 60364c6660
commit 0c634043e3
427 changed files with 26138 additions and 2336 deletions
Download Patch File Download Diff File Expand all files Collapse all files
antigravity-awesome-skills/.github/workflows/aas-agent-first-preview.yml
Vendored
+4
View File
@@ -18,6 +18,10 @@ on:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
candidate:
name: preview candidate
antigravity-awesome-skills/.github/workflows/actionlint.yml
Vendored
+4
View File
@@ -14,6 +14,10 @@ on:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
actionlint:
runs-on: ubuntu-latest
antigravity-awesome-skills/.github/workflows/ci.yml
Vendored
+113 -27
View File
@@ -19,6 +19,10 @@ permissions:
env:
IS_TRUSTED_CANONICAL_SYNC_PR: ${{ inputs.canonical_sync_pr == true || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'automation/canonical-repo-state' && github.event.pull_request.user.login == 'github-actions[bot]') }}
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
pr-policy:
if: github.event_name == 'pull_request' || inputs.canonical_sync_pr == true
@@ -30,6 +34,9 @@ jobs:
direct_derived_changes_count: ${{ steps.intake.outputs.direct_derived_changes_count }}
has_quality_checklist: ${{ steps.intake.outputs.has_quality_checklist }}
has_issue_link: ${{ steps.intake.outputs.has_issue_link }}
fork_approval_safe: ${{ steps.intake.outputs.fork_approval_safe }}
impact_profile: ${{ steps.intake.outputs.impact_profile }}
impact_reasons: ${{ steps.intake.outputs.impact_reasons }}
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
@@ -52,10 +59,14 @@ jobs:
id: intake
if: github.event_name == 'pull_request' && env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: |
node tools/scripts/pr_preflight.cjs \
--base "origin/${{ github.base_ref }}" \
--head "HEAD" \
trusted_root="$RUNNER_TEMP/pr-policy-main"
git worktree add --detach "$trusted_root" "${{ github.event.pull_request.base.sha }}"
NODE_PATH="$GITHUB_WORKSPACE/node_modules" node "$trusted_root/tools/scripts/pr_preflight.cjs" \
--repo "$GITHUB_WORKSPACE" \
--base "${{ github.event.pull_request.base.sha }}" \
--head "${{ github.event.pull_request.head.sha }}" \
--event-path "$GITHUB_EVENT_PATH" \
--check-fork-safety \
--no-run \
--write-github-output \
--write-step-summary
@@ -107,10 +118,6 @@ jobs:
actual_tree=$(git -C "$GITHUB_WORKSPACE" rev-parse 'HEAD^{tree}')
test "$expected_tree" = "$actual_tree"
- name: Install npm dependencies
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
run: npm ci --ignore-scripts
- name: Enforce PR source-only contract
if: github.event_name == 'pull_request' && env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
env:
@@ -137,32 +144,43 @@ jobs:
source-validation:
if: github.event_name == 'pull_request' || inputs.canonical_sync_pr == true
runs-on: ubuntu-latest
needs: [pr-policy, pr-evidence]
needs: pr-policy
outputs:
preview_manifest_digest: ${{ steps.preview_manifest.outputs.manifest_digest }}
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0
persist-credentials: false
- name: Set up Python
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
with:
python-version: "3.10"
- name: Install Python dependencies
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: pip install -r tools/requirements.txt
- name: Set up Node
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: "lts/*"
- name: Fetch base branch
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: git fetch origin "${{ github.base_ref || 'main' }}"
- name: Install npm dependencies
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: npm ci
- name: Verify directory structure
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: |
test -d skills/
test -d apps/web-app/
@@ -172,9 +190,11 @@ jobs:
test -f CONTRIBUTING.md
- name: Validate source changes
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: npm run validate
- name: Enforce validation warning budget
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: npm run check:warning-budget
- name: Verify README source credits for changed skills
@@ -182,44 +202,98 @@ jobs:
run: npm run check:readme-credits -- --base "origin/${{ github.base_ref }}" --head HEAD
- name: Validate references
if: needs.pr-policy.outputs.requires_references == 'true'
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true' && needs.pr-policy.outputs.requires_references == 'true'
run: npm run validate:references
- name: Refresh ephemeral derived sources for tests
run: npm run plugin-compat:sync && npm run index && npm run bundles:sync && npm run sync:metadata && npm run catalog && npm run build:aas-v1-catalog
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: npm run plugin-compat:sync && npm run index && npm run bundles:sync && npm run sync:metadata && npm run catalog && npm run build:aas-v1-catalog && npm run sync:web-assets
- name: Run tests
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: npm run test
- name: Run docs security checks
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: npm run security:docs
- name: Create exact-head artifact preview manifest
id: preview_manifest
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
env:
CATEGORIES_CSV: ${{ needs.pr-policy.outputs.categories }}
PRIMARY_CATEGORY: ${{ needs.pr-policy.outputs.primary_category }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
set -euo pipefail
mapfile -t managed_files < <(node tools/scripts/generated_files.js --include-mixed)
if [ "${#managed_files[@]}" -eq 0 ]; then
echo "::error::No managed files resolved from generated_files contract."
exit 1
fi
mapfile -d '' -t drift_files < <(git diff --name-only -z -- "${managed_files[@]}")
categories_json=$(node -e 'process.stdout.write(JSON.stringify(process.argv[1].split(",").filter(Boolean).sort()))' "$CATEGORIES_CSV")
args=()
for drift_file in "${drift_files[@]}"; do
args+=(--drift-file "$drift_file")
done
node tools/scripts/ci_artifact_preview.cjs create \
--output .tmp/artifact-preview/manifest.json \
--mode source-preview \
--repository "$GITHUB_REPOSITORY" \
--run-id "$GITHUB_RUN_ID" \
--run-attempt "$GITHUB_RUN_ATTEMPT" \
--workflow-sha "$GITHUB_WORKFLOW_SHA" \
--head-sha "$PR_HEAD_SHA" \
--primary-category "$PRIMARY_CATEGORY" \
--categories-json "$categories_json" \
"${args[@]}" \
--write-github-output
- name: Upload exact-head artifact preview manifest
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: source-preview-${{ github.run_id }}-${{ github.run_attempt }}
path: .tmp/artifact-preview/manifest.json
if-no-files-found: error
retention-days: 14
- name: Record canonical source-validation boundary
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
run: echo "Canonical source state and exact generated tree were reproduced by required pr-policy."
pr-evidence:
if: github.event_name == 'pull_request' || inputs.canonical_sync_pr == true
runs-on: ubuntu-latest
needs: pr-policy
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
with:
fetch-depth: 0
persist-credentials: false
- name: Set up Python
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
with:
python-version: "3.10"
- name: Set up Node
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: "lts/*"
- name: Install trusted dependencies
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: |
pip install -r tools/requirements.txt
npm ci --ignore-scripts
- name: Fetch base branch
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
run: git fetch origin "${{ github.base_ref || 'main' }}"
- name: Generate PR intake JSON
@@ -294,31 +368,52 @@ jobs:
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
fetch-depth: 0
persist-credentials: false
- name: Set up Python
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
with:
python-version: "3.10"
- name: Install Python dependencies
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
run: pip install -r tools/requirements.txt
- name: Set up Node
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: "lts/*"
- name: Install npm dependencies
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
run: npm ci
- name: Generate canonical artifacts preview
- name: Download exact-head artifact preview manifest
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: source-preview-${{ github.run_id }}-${{ github.run_attempt }}
path: .tmp/artifact-preview
- name: Verify and report exact-head artifact preview
if: env.IS_TRUSTED_CANONICAL_SYNC_PR != 'true'
env:
EXPECTED_DIGEST: ${{ needs.source-validation.outputs.preview_manifest_digest }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
npm run chain
npm run catalog
npm run sync:web-assets
node "$GITHUB_WORKSPACE/tools/scripts/ci_artifact_preview.cjs" verify-summary \
--manifest .tmp/artifact-preview/manifest.json \
--expected-repository "$GITHUB_REPOSITORY" \
--expected-run-id "$GITHUB_RUN_ID" \
--expected-run-attempt "$GITHUB_RUN_ATTEMPT" \
--expected-workflow-sha "$GITHUB_WORKFLOW_SHA" \
--expected-head-sha "$PR_HEAD_SHA" \
--expected-digest "$EXPECTED_DIGEST" \
--write-step-summary
- name: Reproduce canonical-sync PR from main
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
@@ -327,6 +422,7 @@ jobs:
run: npm run sync:repo-state
- name: Report generated drift
if: env.IS_TRUSTED_CANONICAL_SYNC_PR == 'true'
run: |
mapfile -t managed_files < <(node tools/scripts/generated_files.js --include-mixed)
if [ "${#managed_files[@]}" -eq 0 ]; then
@@ -350,19 +446,9 @@ jobs:
exit 0
fi
if [ "$IS_TRUSTED_CANONICAL_SYNC_PR" = "true" ]; then
echo "::error::Canonical-sync PR is not byte-for-byte reproducible from main."
printf '%s\n' "$drift_files"
exit 1
fi
echo "::notice::Generated drift detected in artifact preview."
{
echo "- Generated drift: detected"
echo
echo "Predicted file updates:"
printf '%s\n' "$drift_files" | sed "s/^/- \`/; s/\$/\`/"
} >> "$GITHUB_STEP_SUMMARY"
echo "::error::Canonical-sync PR is not byte-for-byte reproducible from main."
printf '%s\n' "$drift_files"
exit 1
main-validation-and-sync:
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.canonical_sync_pr != true && github.ref == 'refs/heads/main')
antigravity-awesome-skills/.github/workflows/codeql.yml
Vendored
+4
View File
@@ -14,6 +14,10 @@ permissions:
contents: read
security-events: write
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
analyze:
name: Analyze (${{ matrix.language }})
antigravity-awesome-skills/.github/workflows/dependency-review.yml
Vendored
+4
View File
@@ -7,6 +7,10 @@ on:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
dependency-review:
runs-on: ubuntu-latest
antigravity-awesome-skills/.github/workflows/pages.yml
Vendored
+38
View File
@@ -29,6 +29,44 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Verify release provenance
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
if [[ "${GITHUB_REF_TYPE}" != "tag" ]]; then
echo "Pages deployment must be dispatched from an immutable release tag." >&2
exit 1
fi
if [[ ! "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Pages deployment tag must match vX.Y.Z exactly: ${GITHUB_REF_NAME}" >&2
exit 1
fi
package_version="$(jq -r '.version // empty' package.json)"
expected_tag="v${package_version}"
if [[ "${GITHUB_REF_NAME}" != "${expected_tag}" ]]; then
echo "Pages deployment tag ${GITHUB_REF_NAME} does not match package.json ${expected_tag}." >&2
exit 1
fi
tag_commit="$(git rev-parse "refs/tags/${GITHUB_REF_NAME}^{commit}")"
head_commit="$(git rev-parse HEAD)"
if [[ "${tag_commit}" != "${GITHUB_SHA}" || "${head_commit}" != "${GITHUB_SHA}" ]]; then
echo "Pages deployment tag, checkout, and workflow SHA must resolve to the same commit." >&2
exit 1
fi
release_json="$(gh api --method GET "repos/${GITHUB_REPOSITORY}/releases/tags/${GITHUB_REF_NAME}")"
if ! jq -e --arg tag "${GITHUB_REF_NAME}" \
'.tag_name == $tag and .draft == false and (.published_at | type == "string" and length > 0)' \
<<<"${release_json}" >/dev/null; then
echo "Pages deployment requires a published, non-draft GitHub Release for ${GITHUB_REF_NAME}." >&2
exit 1
fi
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
antigravity-awesome-skills/.github/workflows/pages.yml.disabled
Vendored
-86
View File
@@ -1,86 +0,0 @@
# Build and deploy the web app to GitHub Pages.
# Enable in repo: Settings → Pages → Source: GitHub Actions.
# Site URL: https://<owner>.github.io/<repo>/
name: Deploy Web App to GitHub Pages
on:
push:
branches: ["main", "master"]
workflow_dispatch:
permissions:
contents: read
pages: write
id-token: write
concurrency:
group: "pages"
cancel-in-progress: false
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v5
- name: Setup Node
uses: actions/setup-node@v5
with:
node-version: "lts/*"
cache: "npm"
- name: Install root dependencies
run: npm ci
- name: Prepare web app (index + skills)
run: npm run app:setup
- name: Install web-app dependencies
run: cd apps/web-app && npm ci
- name: Build web app for GitHub Pages
run: cd apps/web-app && npm run build
env:
VITE_BASE_PATH: /${{ github.event.repository.name }}/
SEO_SITE_URL: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}
- name: Validate SEO artifact quality
run: cd apps/web-app && npm run verify:seo
- name: Validate generated sitemap and asset consistency
run: |
cd apps/web-app
test -f dist/robots.txt
test -f dist/sitemap.xml
test -f dist/site.webmanifest
- name: Prepare artifact (404 + .nojekyll)
run: |
cd apps/web-app/dist
cp index.html 404.html
touch .nojekyll
test -f 404.html
- name: Configure GitHub Pages
uses: actions/configure-pages@v5
- name: Upload Pages artifact
uses: actions/upload-pages-artifact@v4
with:
path: apps/web-app/dist
deploy:
needs: build
runs-on: ubuntu-latest
environment:
name: github-pages
url: ${{ steps.deploy.outputs.page_url }}
steps:
- name: Deploy to GitHub Pages
id: deploy
uses: actions/deploy-pages@v4
antigravity-awesome-skills/.github/workflows/skill-review.yml
Vendored
+4
View File
@@ -8,6 +8,10 @@ on:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('run-{0}', github.run_id) }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
review-state:
runs-on: ubuntu-latest