mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-06 01:57:33 +02:00
DottaandPaperclip
4510bf7c9e
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Pull request CI uses a trusted workflow on the AWS runner fleet. > - The caller used a fixed SHA that also needed runner-group admission. > - A mainline pin update left CI queued because the group still allowed older SHAs. > - This pull request calls the trusted workflow on master, which requires code-owner review. > - New merged workflow versions can use the existing master runner-group entry. ## Linked Issues or Issue Description Related: #12968. That Dependabot PR proposes another SHA rotation. This change keeps this first-party workflow on master instead. **What happened?** CI run 34975562974 stayed queued because its trusted workflow SHA was absent from the runner-group allowlist. The fleet itself was healthy. **Expected behavior** New reviewed versions of the trusted workflow on master should receive runner access without a separate SHA allowlist update. **Steps to reproduce** Change the caller to a new trusted workflow SHA without adding that SHA to the restricted runner group. Its jobs remain queued. The master reference removes that recurring synchronization step. ## What Changed - Call `paperclipai/paperclip/.github/workflows/pr-trusted.yml@master`. - Exclude this exact first-party workflow from Dependabot updates. - Update the existing E2E shard workflow tests for the master caller contract. - Document the runner-group entry, required code-owner review, and old-reference retention. ## Verification - `actionlint .github/workflows/pr.yml` passed. - `node --test scripts/__tests__/e2e-shard.test.mjs .github/scripts/tests/cloud-runner-routing.test.mjs .github/scripts/tests/pr-runner-rust-cache.test.mjs .github/scripts/tests/pr-dependency-cache.test.mjs` passed: 35 tests. - Parsed Dependabot YAML and checked the exact workflow exclusion. - `git diff --check` passed. - Live GitHub checks confirmed `.github/**` has code owners, CODEOWNERS has no errors, and the active master ruleset requires code-owner review. This covers the trusted workflow, caller, and CODEOWNERS itself. - The approved organization setting now allows `paperclipai/paperclip/.github/workflows/pr-trusted.yml@refs/heads/master`. All previous references and other runner-group settings remain intact. - Full application typecheck, tests, and build were not repeated locally for this workflow-only change. This PR's CI and review are pending. ## Risks New versions of the trusted workflow take effect for new callers after merge to master. Keep code-owner review and master protection enabled. Existing administrator pull-request bypasses remain unchanged. Third-party action pins, runner routing, and infrastructure are unchanged. Older callers still use their SHA pins; their allowed refs remain in place. ## Model Used OpenAI GPT-6 through Codex performed implementation and orchestration; its exact runtime variant and context-window size were not exposed. OpenAI `gpt-5.6-luna` with high reasoning inspected workflow assumptions and applied the approved runner-group setting. Both used code and tool access. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>
43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: npm
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
# Each dependency update gets its own pull request, including major
|
|
# version bumps. A grouped major PR cannot merge when one member has
|
|
# a blocked upgrade, so it hides the other ready majors. Separate PRs
|
|
# let each major land on its own. The limit holds the initial burst
|
|
# of pending majors plus the regular minor and patch updates.
|
|
open-pull-requests-limit: 20
|
|
labels:
|
|
- "dependencies"
|
|
# Dependabot's npm parser reads only dependencies, devDependencies, and
|
|
# optionalDependencies — never peerDependencies. It cannot see the
|
|
# optional OpenTelemetry peer dependencies in server/package.json, so it
|
|
# never bumps their declared versions. The same limit applies to the
|
|
# optional @sentry/node peer dependency in server/package.json: Dependabot
|
|
# cannot bump it either, for the same reason. @sentry/browser stays a
|
|
# normal devDependency of ui/package.json, so Dependabot does track that
|
|
# one.
|
|
ignore:
|
|
# @types/node describes the APIs available in the supported Node runtime.
|
|
# Runtime major upgrades are deliberate compatibility changes, so keep
|
|
# Dependabot on the current major until the runtime baseline moves too.
|
|
- dependency-name: "@types/node"
|
|
update-types:
|
|
- "version-update:semver-major"
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
open-pull-requests-limit: 5
|
|
ignore:
|
|
# This first-party workflow follows CODEOWNERS-protected master.
|
|
- dependency-name: "paperclipai/paperclip/.github/workflows/pr-trusted.yml"
|