ci: gate workspace membership, cover npm in dependabot#647
Closed
dev-jodee wants to merge 1 commit into
Closed
Conversation
- rust.yml gains a workspace-membership job: any crate with a [package] section must be a root workspace member or listed in .github/.workspace-ignore, so fmt/clippy coverage can no longer drop silently. The ignore file is seeded with the 53 crates currently outside the workspace as a ratchet. - dependabot now updates npm across all example directories (grouped, biweekly, patch-only — same posture as cargo), covering the manual dependency-bump toil. - typescript.yml renamed to Lint: it runs Biome only; typechecking lives in the build workflows.
Greptile SummaryThis PR expands automated dependency and CI coverage.
Confidence Score: 5/5The PR appears safe to merge, with no concrete defects identified in the changed CI or dependency-update configuration. The workspace gate matches the repository’s current root and standalone crate layouts, while the remaining changes preserve existing workflow behavior and dependency-update policy. Important Files Changed
Reviews (1): Last reviewed commit: "ci: gate workspace membership, cover npm..." | Re-trigger Greptile |
Collaborator
Author
|
Superseded by a single combined PR. |
dev-jodee
added a commit
that referenced
this pull request
Jul 24, 2026
…#650) ## Summary Combined CI overhaul (supersedes the closed stack #643–#647, #649). Six commits, reviewable one by one: - **Hardening** — fix the matrix stride bug (jobs sliced with hardcoded `MIN_PROJECTS_PER_JOB` while the matrix was sized with the computed `projects_per_job`, silently skipping projects past 256 dirs of one type); cancel superseded PR runs; `timeout-minutes` on every job; top-level `permissions: contents: read`; third-party actions pinned to commit SHAs. - **Beta → nightly** — Solana beta legs ran double the build on every PR while `continue-on-error` made them unfailable. They now run only on the nightly schedule, skip the test leg when beta setup fails, and report passed/failed/skipped explicitly in the job summary. - **Typecheck** — nothing in CI ran `tsc` (Biome only lints; ts-mocha/tsx transpile without checking). Every build workflow now runs `tsc --noEmit` per project — after `anchor build` for anchor so generated `target/types`/`target/idl` resolve. 79 of ~100 projects failed the initial audit; all CI-covered projects were repaired (tsconfig hygiene, `@types/node`, TS 4→5 bumps, lockfile regens) including real bugs: `counter/native` called `createIncrementInstruction` with two args, `close-account/native` was missing its `borsh` dependency. - **Caching** — pnpm store, shared cargo-registry cache, Solana toolchain cache, sbpf binary keyed on its pinned rev. - **Repo checks** — workspace-membership ratchet: crates outside the root Cargo workspace escape fmt/clippy; `.github/.workspace-ignore` seeds the 53 current gaps and CI fails on new ones. Dependabot now covers npm (grouped, biweekly, patch-only). `typescript.yml` renamed to Lint. - **Unified setup action** — single `.github/actions/setup` with `install-*` toggles + version inputs (pnpm/Node, Solana, Anchor, just, sbpf) and built-in caching, called by every build workflow. Absorbs the vendored setup-anchor and removes all remote `heyAyushh/setup-solana` references — that action checks out its own default branch at runtime, so even SHA-pinned it executed unpinned code. Also fixes an inherited bug that is live today: with no beta tag, `channel-info.sh`'s positional output shifts stable into the beta slot and "stable" resolves to nothing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[package] section must be a root workspace member or listed in
.github/.workspace-ignore, so fmt/clippy coverage can no longer drop
silently. The ignore file is seeded with the 53 crates currently
outside the workspace as a ratchet.
biweekly, patch-only — same posture as cargo), covering the manual
dependency-bump toil.
lives in the build workflows.
Stack created with GitHub Stacks CLI • Give Feedback 💬