* [AI] Enforce append-only migration files in CI
Shipped migrations are append-only: existing installs never re-run
them, so editing one silently forks the database schema across the user
base, and deleting one breaks the migration check for every existing
budget file. The CI migration check now diffs blob hashes against the
merge base to reject edits/deletions, keeps the existing
timestamp-ordering rule, emits advisory PR annotations for migrations
containing DROP/RENAME statements, and fails loudly when git commands
fail instead of passing on empty output.
First of a series that makes clients on different app versions sync
safely against the same budget file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Derive the newest upstream migration id with an explicit max
The ls-tree listing is alphabetical, so taking the last entry only
worked while every migration id has the same digit count.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Post advisory migration warnings as a PR comment
The risky-SQL warnings were only visible as job annotations, and since
the job passes there was no prompt to look at them. The migrations job
now uploads its findings as an artifact, and a new workflow_run workflow
(trusted base-repo context, so it also works for fork PRs whose tokens
are read-only) validates the artifact against a fixed allowlist and
posts/updates a PR comment — removing it again once the warnings are
resolved.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Align overview numbering with the inline check comments
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Adds the knip tool with a monorepo-tuned config (knip.json) and a CI gate
in check.yml, plus the dead-code and dependency cleanup it surfaced. The
unused-export/type/duplicate rules are disabled so exporting an unused
symbol is allowed.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-22 22:11:48 +00:00
Matt FiddamanGitHubautofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* [AI] Migrate CI workflows to Depot-managed runners
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Rename release notes to match PR number
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Empty commit to trigger CI
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Keep VRT jobs on GitHub-hosted runners
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Use 4-vCPU Depot Windows runners for Electron builds
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Use 4-vCPU Depot Ubuntu runners for Electron builds
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Use 4-vCPU Depot runners for functional e2e tests
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Scale Electron build runners to 8 vCPUs
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Scale Ubuntu Electron builds to 4 vCPUs and move Windows builds back to GitHub runners
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Move Microsoft Store publish back to GitHub Windows runner
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* [AI] Add actionlint config for Depot runner labels
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Matiss Janis Aboltins <MatissJanis@users.noreply.github.com>
The `Publish nightly npm packages` workflow started failing at the
"Pack the core package" step with:
Cannot find module '@actual-app/crdt' or its corresponding type declarations.
PR #7541 switched `@actual-app/crdt`'s package.json to conditional
exports (`types` → `./dist/index.d.ts`). `yarn pack` for
`@actual-app/core` triggers a prepack that runs `tsgo -b`, which now
resolves `@actual-app/crdt` via the `types` condition and expects
`packages/crdt/dist/index.d.ts`. Nothing was building crdt first
because loot-core's tsconfig didn't declare it as a project
reference.
Fix: declare the project reference so `tsgo -b` walks the graph and
builds crdt before loot-core. Sibling packages already do this.
Also adopt `@monorepo-utils/workspaces-to-typescript-project-references`
to keep each package's tsconfig `references` in sync with its
`workspace:*` deps, and wire it into a new `yarn check:tsconfig-references`
step in the `check` CI job plus lint-staged. Running the tool added
`../desktop-client` references to sync-server and desktop-electron
(both declare `@actual-app/web` as a workspace dep even though they
only use it at runtime via `require.resolve`); the extra references
are harmless — in CI the corresponding build is already cached by
earlier steps.
https://claude.ai/code/session_01AA2gEMqX24GWeq5BovNmaz
* [AI] Run setup once per workflow and fan out via needs
Add a prep `setup` job at the top of `check.yml` and `build.yml`, and
make every other job in those workflows declare `needs: setup`.
The composite action in `.github/actions/setup` caches `node_modules`
keyed on `yarn.lock`. When that hash changes (dep-bump PRs, master after
a merge), the cache is cold and every fan-out job races to run
`yarn --immutable` in parallel — one wins the cache save, the rest do
redundant work. Serialising through a single `setup` job warms the
cache once so downstream jobs restore instantly and skip yarn install
via the existing `if: steps.cache.outputs.cache-hit != 'true'` guard.
No changes to the composite action or cache keys. `e2e-test.yml` is
intentionally left alone.
* [AI] Harden setup jobs and add release note
Address zizmor code-scanning findings on the new `setup` jobs added in
the previous commit:
- Scope `permissions: contents: read` so the job no longer inherits
workflow-default write permissions.
- Pass `persist-credentials: false` to `actions/checkout` so the GitHub
token isn't left on disk for later steps that don't need it.
Add `upcoming-release-notes/7551.md` to satisfy the release-notes PR
check.
* [AI] Disable credential persistence on build.yml checkouts
Each of `api`, `crdt`, `web`, `cli`, `server` in build.yml does
`actions/checkout` (which writes the GitHub token into `.git/config`)
and then uploads build artifacts in the same job. Zizmor flags this as
"credential persistence through GitHub Actions artifacts" because a
misconfigured upload path could capture `.git/config` and leak the
token.
None of these jobs push or write to git, so drop the credential
persistence via `persist-credentials: false` on the checkout.
* [AI] Disable credential persistence on check.yml checkouts
None of the jobs in check.yml (`constraints`, `lint`, `typecheck`,
`validate-cli`, `test`, `migrations`) push or write to git, so pass
`persist-credentials: false` to their `actions/checkout` calls to
resolve the zizmor "credential persistence" finding. Mirrors the fix
just applied to build.yml.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* [AI] Add yarn constraints to enforce consistent dependency versions
Adds a `yarn.config.cjs` that uses Yarn 4's built-in constraints feature
to detect when the same dependency is declared with different version
ranges across workspaces. Workspace protocol references and
peerDependencies are excluded from the check.
Also adds a `yarn constraints` convenience script and the `@yarnpkg/types`
dev dependency for type-checked constraint authoring.
https://claude.ai/code/session_01B1xRjZXn6b18anZjo8cbqb
* Add release notes for PR #7229
* Add constraints job to GitHub Actions workflow
* Fix constraints
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* Enhance CI workflows to support repository dispatch events and improve branch handling
- Added support for `repository_dispatch` events in build, check, and codeql workflows.
- Updated concurrency group to include `client_payload.pr_number` for better context.
- Modified checkout steps to reference the correct branch from `client_payload` if available.
* Add release notes for PR #5586
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* use build directory in dockerfiles
* add release notes
* add test
* Add test for cli, try to fix image test
* - fail
* try again
* try again to fail
* done testing
* Code review
* publish is unecessary
Good catch @Jackenmen in
https://github.com/actualbudget/actual/pull/948#issuecomment-1580501909
— I’ve also added a CI check to ensure bad migrations aren’t introduced
in the future.
I think if you have a budget that has managed to have this migration
applied successfully, you’ll need to manually patch
`getAppliedMigrations` in
`packages/loot-core/src/server/migrate/migrations.ts` and inject a query
to remove the old migration ID and insert the new one.
Roger GoldfingerandGitHub
Jed FoxandGitHub