fix: make the build workflow install runtime deps only and refresh the audit scripts - #11
Merged
Merged
Conversation
…e audit scripts Every run of the build workflow has failed at `composer install`. The lock was regenerated on PHP 8.4 by the Dependabot cleanup, and the dev packages it pins — phpinsights 2.14 (php ^8.3) and symfony 8 (php >=8.4.1) — cannot be installed on the PHP 8.2 the workflow uses, which is the plugin's declared minimum. The runtime set installs fine there, and it is all the build needs: type-check, build and tests are Node-side, and `scripts/build-plugin.mjs` already packages the release from `composer install --no-dev`. The workflow and the readme's build line now install the same way. Behind that, the "free code only" step would have failed next: this tree's copies of `scripts/public-repo/manifest.mjs` and `assert-no-pro.mjs` were stale against the ones the add-on repository audits with, and did not list the committed `version-panel.pro.tsx` stub. Both are refreshed from the add-on repository's copies, which pass against this tree. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The action refuses to run without a version in its config or a `packageManager` field. Pinning it here also fixes the version for anyone building from source. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
heyKhoaiz
added a commit
that referenced
this pull request
Sep 9, 2026
fix: make the build workflow install runtime deps only and refresh the audit scripts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every run of the
buildworkflow has failed atcomposer install: the lock was regenerated on PHP 8.4 and pins dev packages (phpinsights 2.14, symfony 8) that need PHP 8.3+/8.4+, while the workflow installs on the plugin's declared minimum, PHP 8.2. The runtime set installs cleanly on 8.2 and is all the build needs, andscripts/build-plugin.mjsalready packages the release with--no-dev. The workflow and the readme build line now match it.Behind that, the "free code only" step would have failed next: this tree's copies of the two
scripts/public-repoaudit scripts were stale and did not list the committedversion-panel.pro.tsxstub. Both are refreshed from the add-on repository's copies.Verified locally:
composer install --no-devdry-run on a PHP 8.2 container,pnpm ts-check,pnpm build:free, the asset assertions,assert-no-pro.mjs --tree .andpnpm testall pass.🤖 Generated with Claude Code