mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-04 13:58:39 +08:00
Martin VogelandRares Popa
a45a99c9c7
Distilled from #2109 by Rares Popa. Two slices only; the rest of that PR is either frontend work the UI rebuild makes redundant, or a gating change that needs re-siting first. 1. Three jobs move from ubuntu-latest to ubuntu-24.04 _lint.yml `lint` and `lint-mem`, and _test.yml `test-diag`, each install a toolchain from an apt.llvm.org repo whose name contains the release: deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main noble IS 24.04. So these jobs already depend on a specific release while asking for whatever ubuntu-latest happens to mean that morning. The day GitHub advances ubuntu-latest, all three break at once, on a schedule nobody here chose, and the failure surfaces as an apt error far from its cause. Pinning the runner to the release the repo line already names costs nothing and removes the trapdoor. 2. actions/attest-sbom -> actions/attest attest-sbom is deprecated. Its remaining behaviour is to print "::warning::actions/attest-sbom has been deprecated" and forward to actions/attest with NODE_OPTIONS set, passing sbom-path through unchanged. Calling attest directly yields the same attestation minus the wrapper. Verified rather than assumed, because this sits on the release path: 59d89421af93a897026c735860bf21b6eb4f7b26 is exactly tag v4.1.0 of actions/attest, and sbom-path is a real input on that action at that SHA. The step keeps no continue-on-error, so a failed SBOM attestation still fails the release. That is the intended behaviour and the comment now says so: an unattested SBOM is worse than an absent one, because the artifact ships looking complete. Deliberately NOT taken from #2109, each for its own reason: - the actionlint job, as sited. _lint.yml is consumed by pr.yml, dry-run.yml and release.yml, pr.yml gates its whole test stage on `if lint succeeded`, and release.yml gates build on needs.lint.result == 'success'. A job there is merge-blocking and release-blocking with no branch-protection edit to make it visible, and this one curls a tarball from github.com releases with no cache and no fallback. actionlint is worth having; not on that path, and not before it has been run against current main. - the test-package-wrappers node matrix. It reruns the Go and PyPI suites a second time per OS to vary a Node version only the npm leg reads. - everything frontend: the test-frontend job, .node-version, and the dependabot graph-ui block. The UI is being rebuilt from the ground up, so gating on the current one buys coverage of a surface that is going away. Co-authored-by: Rares Popa <2606875+rarepops@users.noreply.github.com> Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>