chore(deps): bump actions/download-artifact from 6 to 8 - #1
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump actions/download-artifact from 6 to 8#1dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v6...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
qnbs added a commit
that referenced
this pull request
May 12, 2026
…protection Pin all action references in ci.yml, tauri-build.yml, scorecard.yml and the composite action to immutable commit SHAs (# vN comment preserved). Simultaneously bump: actions/checkout v5→v6, configure-pages v5→v6, download-artifact v6→v8, dependency-review-action v4→v5, codecov/codecov-action v5→v6. This supersedes Dependabot PRs #1-5 for GitHub Actions. Add .github/workflows/codeql.yml: JavaScript/TypeScript CodeQL analysis on push, PR, and weekly cron → SARIF to Code Scanning (fixes OpenSSF SAST alert). Branch protection configured on main via API: 1 required review, stale-dismiss, conversation resolution, required status checks (security/quality/build), no force-push, no deletion (fixes OpenSSF Branch-Protection + Code-Review alerts). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ContributorAuthor
Looks like actions/download-artifact is up-to-date now, so this is no longer needed. |
dependabotBot
deleted the
dependabot/github_actions/actions/download-artifact-8
branch
May 12, 2026 08:24
qnbs added a commit
that referenced
this pull request
Jun 2, 2026
…#69) * perf(ai): unify inference pipeline LRU + dispose-on-evict (Phase 2.3) Both inference workers carried byte-identical pipeline-LRU logic and neither disposed the evicted pipeline -> VRAM/RAM leak (same class as the WebLLM eviction fix, AUDIT 2026-06-01 #1). Extract services/ai/pipelineLruCache.ts: dispose-on-evict, in-flight load dedup (no double-load of multi-MB models), injectable clock for deterministic tests. Rewire workers/inference.worker.ts and workers/v2/inference.worker.ts onto it; remove the duplication. Self-review of same-day commits logged in AUDIT.md (aiRetry property tests + useLoraView selector nit -> Phase 3). Latency telemetry already exists at the facade, so no new worker->main hop added. lint + typecheck green; 9 new cache tests + 7 existing worker tests pass (behavior-preserving). Coverage/smoke:prod via CI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(ai): aiRetry invariant tests + fix useLoraView selector recreation (Phase 3) Self-review hardening of the same-day commits: - aiRetry.ts: add property/invariant tests for computeRetryDelayMs (exponential, non-decreasing, capped at AI_RETRY_MAX_DELAY_MS, full-jitter in [0,capped)) and parseRetryAfterMs (ms/seconds/string/header forms, hostile-value clamp), plus an integration test asserting a server Retry-After beats the computed backoff. 19 tests. - useLoraView.ts: selectDatasetForProject(projectId) is a createSelector factory that returned a fresh memoized selector each render, defeating memoization. Wrap in useMemo keyed on projectId; module-level stable empty selector for the no-project path. 12 existing hook tests stay green (behavior-preserving). lint + typecheck green; 31 tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ai): dispose-on-replace + centralized safe disposal (CodeAnt PR #69) Address 3 CodeAnt findings on the pipeline LRU cache: - set() overwriting a live key now disposes the previous value (was a leak); a no-op when the value is identical. - PipelineLruCache.safeDispose() centrally swallows synchronous throws and async rejections from the dispose callback, so a failing backend disposal can never surface as an unhandled rejection in worker/main contexts. Both worker dispose callbacks simplified to return the (possibly async) result; the cache catches it. +4 tests (replace-disposes-old, identical-no-dispose, sync-throw-safe, async-reject-safe). lint + typecheck green; 13 cache + 7 worker tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(voice): cover KokoroTtsEngine cancel/pause/resume/dispose + no-WASM (Phase 2.4) Correction: sileroVadEngine.ts and kokoroTtsEngine.ts already had tests since 2026-05-31 — the TODO 'covered 0 tests' note was stale. Real gap was the Kokoro playback-control surface: add cancel() (no-op + stops an in-flight source), pause()/resume() + dispose() AudioContext delegation, and the no-WebAssembly isAvailable() branch. +4 tests (10 total). Inference-worker LRU is covered via pipelineLruCache.test.ts. typecheck + lint green; 10 Kokoro + 5 Silero tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: add ADRs (state boundaries, local-AI layering) + README 60-second Quick Start (Phase 4) - docs/adr/0001-state-management-boundaries.md — formalizes Redux (persisted/undo) vs Zustand transientUiStore (ephemeral) so the recurring 'why two state libs?' audit question has a decision record instead of prose. - docs/adr/0002-local-ai-stack-layering.md — WebLLM->ONNX->Transformers.js->heuristic fallback chain, shared infra (pipelineLruCache, aiInferenceCache, aiRetry, worker-bus), and the honest-degradation contract. - docs/adr/README.md — ADR index; linked from README Documentation Hub. - README: '⚡ Quick Start (60 seconds)' section + TOC entry — browser-first, no-key onboarding path to first value. Docs-only; no code or i18n keys changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test: ratchet coverage thresholds to CI-measured floor (L74/B60/F66/S72) After Phase 2.3/2.4 tests, CI (PR #69, Node 22 & 24) measured coverage at 75.15 L / 61.23 B / 67.84 F / 73.14 S. Bump vitest.config.ts thresholds from L72/F64/B58/S70 to L74/F66/B60/S72 — ~1pt under measured so the gate absorbs Node 22/24 variance without flaking. C-7 target remains L85/B75/F80. Update README coverage badge (L75/B61/F68) and AUDIT.md per the CI-first post-merge metric-update policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
qnbs added a commit
that referenced
this pull request
Jun 10, 2026
…i18n Addresses every inline review comment on PR #106: - #2 proForgeHistoryStore: reset cached dbPromise on open error so a failed IDB open can be retried instead of poisoning the singleton. - #3 proForgeHistoryStore: resolve/reject on tx.oncomplete/onerror/onabort (not request.onsuccess) so a save only resolves once durably committed. - #4 applyReviewEdits: anchor stale-offset edits to the occurrence nearest the original range and skip already-claimed positions, so duplicate phrases map to distinct occurrences deterministically. - #5 baseAgent.gatherMemoryContext: feed a project-derived query (title/logline/genre) + ragMode into memory-bank retrieval instead of an undefined query; all 6 AI agents now route through it. - #6 PipelineReviewPanel: await submitReview before announce/navigate. - #7 useProForgeOrchestrator: always dispatch loadRunHistory (even []) so switching projects clears stale history. - #1 i18n: translate ~55 proforge.review.*/stageName.* keys to es/fr/it (were English fallback); rebuild bundles. Tests updated for the 4-arg gatherMemoryContext signature (diagnostic/structural/publishing) + duplicate-phrase edit cases. Local gates green: typecheck (--checkers 4), lint, full proForge suite. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
qnbs added a commit
that referenced
this pull request
Jun 10, 2026
- #5 MCP memory re-seed duplicates: cache capability per payload (sha1 of payload) in capability.ts + deterministic seed ids (projectId:category:key) in nodeProForgeCapability so rebuilds overwrite instead of minting fresh ids. - #7 Copilot stuck 'streaming' on close: useGlobalCopilot.close() now resets finishLastAssistant + setStatus('idle') when streaming, so future sends work. - #4 import-time crash on bad --project: read the file lazily inside resolveCapability, wrapped in an actionable ProForgeError(VALIDATION). - #6 empty-string runId: runId -> z.string().min(1).optional() in both getSupervisorStatus + getHistory schemas (now a VALIDATION error). - #8 disabling enableGlobalCopilot: useSettingsView clears + closes the copilot session on toggle-off so re-enabling never restores a stale panel. - #1-3 raw err in MCP responses: fail() returns a generic 'Internal error' for unexpected errors and writes detail to stderr only; our own ProForgeError messages still pass through (actionable). Tests: capabilityLayer empty-runId VALIDATION, idempotent node seeding, useGlobalCopilot.close reset, useSettingsView copilot clear-on-disable; MCP smoke extended with idempotent-seed + missing-project VALIDATION assertions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
qnbs added a commit
that referenced
this pull request
Jun 11, 2026
CI: suppression-debt ratchet failed (+2). CopilotMessageList used biome-ignore-start/end pair around dangerouslySetInnerHTML; replaced with MarkdownContent sub-component that writes via useEffect+innerHTML so no suppression is needed (57 → 57, ratchet passes). CodeAnt #1 (InlineAnnotationLayer): badge click only opened the panel but left InsightSection collapsed. Added copilotInsightExpanded to transientUiStore; badge sets it true; InsightSection consumes + resets it via useEffect so findings are immediately visible. CodeAnt #2 (applyLastSuggestion): always passed original='' which forces whole-section replacement, risking data loss for partial snippets. Added 70% length gate — only full-chapter-rewrite blocks (codeBlock.length ≥ 70% of section) are applied; shorter blocks return error status without touching content. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
qnbs added a commit
that referenced
this pull request
Jun 11, 2026
…co bridge, routing observability
* feat(copilot): Phase 2 — markdown rendering, sidebar mode, Apply-to-chapter, InlineAnnotationLayer
- CopilotMessageList: micro-markdown renderer (~80 lines, zero deps) + DOMPurify-sanitized
dangerouslySetInnerHTML for assistant messages; user messages remain plain text.
"Apply to chapter" button on last assistant message when it contains a fenced code block
and an active manuscript section is available.
- CopilotPanel: sidebar/dialog mode toggle persisted in localStorage ('copilot.mode').
Sidebar docks to the inline-end at full height; dialog keeps the existing floating
behaviour. Toggle hidden on mobile (< md breakpoint). Apply feedback strip (success/error)
shown below the composer.
- actionApplier.ts (new): thin wrapper around applyReviewEditsToSection for copilot-
initiated edits. applyTextEdit() does whole-section replacement when original is empty
(AI full-rewrite path) or offset-safe partial replacement otherwise. extractCodeBlock()
pulls the first fenced block from a markdown string.
- InlineAnnotationLayer.tsx (new): absolute-positioned badge inside the manuscript editor
that shows a count of heuristic findings matching the current section title. Clicking
opens the Copilot panel. Gated behind enableGlobalCopilot.
- transientUiStore: added activeSectionId + setter; useManuscriptView writes it on every
section change so copilot apply-flow and InlineAnnotationLayer can read it without
prop-drilling.
- useGlobalCopilot: applyLastSuggestion() dispatches updateManuscriptSection (undo-able),
applyStatus drives button state. Added activeSectionId read from transient store.
- i18n: 7 new keys across all 11 locales: sidebarMode, dialogMode, apply,
applyingChange, changeApplied, changeApplyFailed, annotationCount (2530 keys total).
- Tests: actionApplier.test.ts (9 tests); transientUiStore mock extended for Phase 2 keys.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(copilot): suppression ratchet + CodeAnt findings on PR #111
CI: suppression-debt ratchet failed (+2). CopilotMessageList used
biome-ignore-start/end pair around dangerouslySetInnerHTML; replaced
with MarkdownContent sub-component that writes via useEffect+innerHTML
so no suppression is needed (57 → 57, ratchet passes).
CodeAnt #1 (InlineAnnotationLayer): badge click only opened the panel
but left InsightSection collapsed. Added copilotInsightExpanded to
transientUiStore; badge sets it true; InsightSection consumes + resets
it via useEffect so findings are immediately visible.
CodeAnt #2 (applyLastSuggestion): always passed original='' which
forces whole-section replacement, risking data loss for partial
snippets. Added 70% length gate — only full-chapter-rewrite blocks
(codeBlock.length ≥ 70% of section) are applied; shorter blocks
return error status without touching content.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(test): stub InlineAnnotationLayer in ManuscriptEditor unit tests
InlineAnnotationLayer was added to ManuscriptEditor in Phase 2 but
imports useAppDispatch + useTransientUiStore, neither of which was
mocked in the ManuscriptEditor test suite. Added useAppDispatch to
the app/hooks mock and stubbed InlineAnnotationLayer as a no-op so
ManuscriptEditor tests remain focused on the editor itself.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(copilot): Phase 3 — ProForge chip, E2E tests, docs, AUDIT/CHANGELOG
Phase 3 of Ultimate Copilot AI v2:
- ProForge PipelineReviewPanel: "Ask Copilot" chip on every ReviewItemCard
(gated by enableGlobalCopilot). Clicking pre-fills the Copilot composer
with the review item's severity + description and opens the panel — no
prop-drilling needed (copilotDraftMessage in transientUiStore consumed
once by CopilotComposer via useEffect).
- E2E: 2 new tests in copilot-flags.spec.ts — heuristics-only toggle
(aria-pressed state) + sidebar mode toggle (label flip on desktop).
- docs/COPILOT.md: full user-facing feature guide.
- docs/HEURISTIC-RULES.md: per-rule reference (8 rules, how to satisfy each).
- AUDIT.md + CHANGELOG.md: updated to v1.21.2 with Phase 2+3 summary.
- i18n: copilot.askCopilot + copilot.askAboutReviewItem × 11 locales (2532 keys).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(ai,palette): AI execution mode management + expanded command palette (Phase 4)
Adapts CannaGuide-2025 AI mode routing into StoryCraft — hybrid/cloud/local/eco
modes with full policy gate, Settings UI card picker, and 20+ new palette commands
for themes, appearance presets, accessibility, editor modes, and AI modes.
Also fixes CI quality-gate regression: PipelineReviewPanel tests failed because
the Phase 3 component gained direct useAppDispatch/useAppSelector calls (copilot
flag) without a corresponding mock in the test — added app/hooks mock to resolve
all 27 failures without needing a Redux Provider.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(tests): fix CommandPalette + commandTypes test regressions from palette expansion
CommandPalette mock was missing advancedEditor/appearancePreset/aiMode settings
fields added in Phase 4; commandTypes category count updated 8→10 for the new
appearance and accessibility categories.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(e2e): fix copilot E2E — role=switch/aria-checked + locale string alignment
HeuristicsModeToggle renders as <button role="switch" aria-checked> (ARIA switch
pattern); E2E test was querying getByRole('button') + aria-pressed — corrected to
getByRole('switch') + aria-checked.
Sidebar mode locale strings "Dock as sidebar"/"Float as dialog" didn't match test
regexes /Dock sidebar/i and /Float panel/i; updated to "Dock sidebar"/"Float panel"
across all 11 locales + rebuilt bundles.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(ai-mode): seed aiModeService from persisted settings on cold start
Cold-start bug G1: setupStore(preloadedState) hydrated Redux but
aiModeService singleton stayed at 'hybrid' default until first setting
change. Now seeded immediately from persisted Redux state after store
init, and OpenRouter config is also applied from persisted settings.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(ai-mode): positive routing + OpenRouter integration (G2, G10)
- shouldRouteLocally() now called in generateText() and inferenceGateway
to positively override provider to webllm when mode mandates local
- Hybrid mode is cloud-first: shouldRouteLocally() returns isOffline() only
- getLocalFallbackModel(): eco → SmolLM2-135M, others → Llama-3.2-1B
- getLocalModelsReady() exported so health panels can read readiness signal
- OpenRouter provider: circuit breaker (4 × 429 → 5min pause), exponential
backoff with Retry-After header, RPM tracking, isOpenRouterFreeModel()
- shouldUseOpenRouter(), getOpenRouterModel(), getOpenRouterFallbackProvider()
wired into routing chain in aiProviderService and inferenceGateway
- OpenRouterSettings type + settingsSlice reducer + idbProjectStore backfill
- All new symbols exported from services/ai/index.ts entry point
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(ai-mode): notifyLocalModelsReady wired from localAiFacade on model load (G4)
WebLLM inference success now calls notifyLocalModelsReady(true) so
hybrid mode has accurate readiness signal for faster offline recovery.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(ai-mode): phases 2-7 — eco bridge, observability, indicator, i18n, tests
Phase 2: notifyLocalModelsReady() wired from localAiFacade after successful
WebLLM inference — hybrid mode now has accurate readiness signal (G4).
Phase 3: ecoModeService.setAiModeEco() bridged from listenerMiddleware aiMode
listener; battery auto-eco back-syncs to Redux via appStoreRef; GpuMetricsPanel
eco toggle routes through Redux dispatch instead of bypassing state (G3, G7).
Phase 4: baseAgent.buildAiOpts() consults shouldRouteLocally() + isEcoMode() —
ProForge pipeline no longer fires cloud calls regardless of aiMode (G5).
Phase 5: services/ai/routingLogger.ts — logRoutingDecision() called at every
routing branch in aiProviderService and inferenceGateway (G8).
Phase 6: AiModeIndicator component in Copilot panel header — shows current
mode chip + OpenRouter circuit/RPM status; 2583 keys × 11 locales (G9).
Phase 7: 49 unit tests across aiModeService, routingLogger, ecoModeBridge,
openrouterProvider — all passing; lint + typecheck clean.
TODO.md updated with all remaining follow-up items (OpenRouter Settings UI,
command palette integration, API key retrieval wiring, test coverage gaps).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(settings): OpenRouter settings panel + baseAgent routing fix (P1/P3)
P1 — OpenRouterSection.tsx: enable toggle (Redux), API key input (stored via
storageService AES-256-GCM), free-model selector + custom model input,
circuit-breaker status badge + reset button, RPM indicator (5s poll).
Wired into SettingsView NAV_GROUPS aiModels group + navCategories + renderContent.
12 new i18n keys × 11 locales (2594 keys total).
P3 — baseAgent routing fix: routingOverrideActive flag ensures getLocalFallbackModel()
is used as model when shouldRouteLocally() overrides provider to webllm. Previously
model stayed 'gemini-2.5-flash' (modelMap['webllm'] = undefined → fallback).
4 new tests cover routing: webllm override, no-override, local provider passthrough,
eco model. baseAgent.test.ts now mocks aiModeService.
P4 — confirmed already wired: aiProviderService case 'openrouter' already calls
storageService.getApiKey('openrouter') — no change needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(security): upgrade joi transitive dep from 17.13.3 to 18.2.1
GHSA-q7cg-457f-vx79 (Medium, CVSS 5.3) — joi@17.13.3 pulled transitively
by @storybook/test-runner→jest-process-manager→wait-on@7.2.0. Patched
lockfile to resolve wait-on@7.2.0 against the already-present joi@18.2.1.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(tests): GpuMetricsPanel — add useAppDispatch to mock, fix dispatch assertion
Mock for app/hooks was missing useAppDispatch, causing all 14 tests to fail
with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Eco-toggle test updated to assert
dispatch() call (component routes through Redux, not ecoModeService directly).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs(todo): add dependency-hygiene backlog items
Document follow-up tasks from joi CVE session: .npmrc hardening,
override housekeeping, Renovate grouping, audit threshold bump,
and AUDIT.md known-overrides table entry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>qnbs added a commit
that referenced
this pull request
Aug 1, 2026
- app/listenerMiddleware.ts: guard stageCompleted notification against invalid/missing ProForge run or stage (thread #13) - hooks/useExportView.ts: extract downloadPlainTextFormat() to reduce handleDownload cyclomatic complexity (thread #1, DeepSource) - locales/{el,eu,fa,fi,he,sv,zh}: translate desktop notification and export completion strings, previously English fallback text (threads #9, #10) - tests/unit/listenerMiddleware.test.ts: add regression coverage for invalid stageCompleted actions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/download-artifact from 6 to 8.
Release notes
Sourced from actions/download-artifact's releases.
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)