* ci: run the merge checks on release branches too
All three `Policy` workflows filtered on `master`, so a pull request into `release/dsh-*`
got no `Master Change` and no `Pre-Merge Check`, and its review check only refreshed when
somebody submitted a review. The checks already take their base branch from the event, so
the filters now name the release branches as well.
* ci: limit the release branch filter to x.y.z
`release/dsh-*` also matched prerelease branches such as `release/dsh-0.1.2-alpha.4`;
the filter now spells the version digits, so only `release/dsh-x.y.z` counts.
* test(snapshot): carry the subagent identity section into the ptc-script-imports scenario
The runtime context gained a `subagent:identity` section and every session fixture but
this one was regenerated, so replay failed with a mismatch on the added section.
(cherry picked from commit c7a4119965cb26c69fd8fccbfd703c7d73351742)
---------
Co-authored-by: imccyu <[email protected]>
Limit the no-resign exemption to the staged helper so LibreOffice's
unsigned bundle keeps per-file signing, verify the helper's ticket and
Gatekeeper acceptance, stage it after the configuration check only for
sources that ship the bundle, and report a missing helper by path.
Refs #7514
Build and stage the helper before packaging, keep its bundle unpacked
outside app.asar, verify it instead of re-signing its files, and let the
provider open the unpacked copy.
Refs #7514
The scan now reads exactly the manifests the release tooling rewrites, names
every directory and file it cannot read, and refuses an empty corpus; the
command takes the root it checks so the exit code is tested, and the workflow
reports a crashed check as a warning in report mode.
Each step is a spawn whose stdio reaches the job log, the first failure stops
the list, and the script decides from CHECK_MODE whether to annotate as an
error or a warning, so the workflow only calls it.
The missing-script branch now fails in block mode instead of passing, the shell
block parses, the version walk refuses a directory it cannot read or one that
holds no manifest, the install is watched before anything else can throw, and a
spec runs `bash -n` over every Policy shell block.
`Policy / Pre-Merge Check` now runs `scripts/pre-merge-check.ts` under plain
Node and knows nothing else about the merged tree. That script installs the
dependencies, checks that every released manifest carries the root version
while the install runs, and builds the Host and Client contracts, reporting
which step failed.
* fix(ci): keep the pre-merge check off the report-mode failures
* fix(ci): fail the pre-merge check in block mode without a base commit
* fix(ci): report every pre-merge failure the way its mode asks
The merge step now separates a base commit it cannot fetch from a merge it
cannot do, both failures print an annotation, and a spec pins the mode
wiring of the three Policy workflows.
* test(ci): type the Policy workflow assertions
---------
Co-authored-by: imccyu <[email protected]>
The App token cannot update a run the job token created and vice versa, so
selecting runs by `app.slug === 'github-actions'` missed every App run: each
phase created another run, a published App success was never revoked, and a
head with an older job-token run made the App patch fail. Select runs by the
publishing app slug instead, pass `vars.DSH_APPROVAL_APP_SLUG`, and set the
external_id marker on the setup-phase run too.
Cover the App-owned update and the job-run coexistence, and align the note with
the measured earliest-suite rule and the App slug variable.
* ci: run native Windows PR jobs in a separate workflow
GitHub re-runs failed jobs only after a whole run finishes, so slow Windows jobs blocked re-running failed Linux jobs. CI Windows now owns the native Windows jobs and the Windows x64 Python runtime target, with its own required 'windows checks passed' verdict.
Refs #6893
* ci: run Python PR jobs in a separate workflow
Python rarely fails while the Windows lanes run long, so the Python SDK suite and the Linux/Windows x64 runtime matrix move into CI Python. The three pull-request workflows can now be re-run without waiting for each other, and branch protection gains "python checks passed" beside the existing verdicts.
Refs #6893
* docs: record the three PR verdicts in the failover runbook
* test: pin the shared environment across the PR workflows
* test: read the python SDK lane from CI Python
* test(sdk): parse session JSONL frames in the keyless smoke
Node 24.19 returned only the first frame of a concatenated zstd log, so the single JSON.parse saw just the header; 24.22 returns every frame and the JSONL body broke the parse. Read frames explicitly and select the main session by its header so both versions agree.
creatixchu