Merge main and explain unavailable project environments

Author: juliusmarminge

.github/actions/setup-ci-deps/action.yml

@@ -1,5 +1,10 @@
 name: Setup CI dependencies
 description: Install Vite+ and the workspace dependencies from cache.
+inputs:
+  task-cache-read-token:
+    description: Read-only credential for the private maintainer task cache
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
@@ -65,3 +70,20 @@ runs:
     - name: Install dependencies
       shell: bash
       run: vp install
+
+    - name: Enable shared task cache
+      if: >-
+        github.repository == 'pingdotgg/t3code' &&
+        (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+        hashFiles('.task-cache.json') != '' &&
+        inputs.task-cache-read-token != ''
+      shell: bash
+      env:
+        T3_TASK_CACHE_READ_TOKEN: ${{ inputs.task-cache-read-token }}
+      run: |
+        node infra/task-cache/scripts/install-ci.ts
+        if [[ ( "$GITHUB_EVENT_NAME" == pull_request && "$GITHUB_BASE_REF" == main ) || ( "$GITHUB_EVENT_NAME" == push && "$GITHUB_REF" == refs/heads/main ) ]]; then
+          echo 'VP_REMOTE_CACHE=read-write' >> "$GITHUB_ENV"
+        else
+          echo 'VP_REMOTE_CACHE=read' >> "$GITHUB_ENV"
+        fi

.github/scripts/ci-changes.cjs

@@ -1,37 +1,24 @@
-// Decides which CI jobs a change needs. Prints `key=value` lines for
-// $GITHUB_OUTPUT; a job runs unless its key is "false".
-//
-//   node ci-changes.cjs --paths <file>          gate by the listed paths
-//   node ci-changes.cjs --paths <file> --full   run every Linux job, gate only the macOS lint
-//   node ci-changes.cjs                         changed paths unknown: run everything
-//
-// scripts/check-changed.ts requires the same decisions so local runs match CI.
-//
-// Every changed path maps to workspace packages, which then pull in their
-// dependents from package.json. A path this file does not recognize runs
-// everything, so a new root file or directory can only cost minutes.
+// Unknown paths run every job; recognized packages pull in their dependents.
+// scripts/check-changed.ts shares these decisions so local checks match CI.
 const fs = require("node:fs");
 const path = require("node:path");
 
 const root = path.resolve(__dirname, "../..");
 
-// Never read by a build, typecheck, or test. Lint still formats them.
 const INERT = [
   /^docs\//,
   /^\.(agents|cursor|vscode|devcontainer|macroscope|repos)\//,
   /^[^/]+\.md$/,
   /^LICENSE$/,
 ];
 
-// Run everything: the root vite.config.ts loads the first as setup for every
-// package's tests, and the vendored mobile tarballs are installed dependencies.
+// Shared test setup and vendored mobile dependencies affect every package.
 const RUNS_EVERYTHING = [
   /^packages\/shared\/src\/(HostProcess|testing\/longTempDir)\.ts$/,
   /^apps\/mobile\/deps\//,
 ];
 
-// Paths outside a package, or files inside one that other packages read
-// through relative imports rather than a package.json dependency.
+// Includes cross-package reads absent from package.json dependencies.
 const EXTRA_OWNERS = [
   // Vite configs and tsconfigs of these apps import scripts/lib directly.
   [/^scripts\/lib\//, ["@t3tools/desktop", "@t3tools/mobile", "@t3tools/web", "t3"]],
@@ -43,9 +30,7 @@ const EXTRA_OWNERS = [
 ];
 const RUST = /^native\/(resource-monitor|kde-snap-shot|hyprland-snap-shot)\//;
 
-// Tests that read another package's files without declaring it. The scripts
-// tests read app manifests, assets, and sources (cursor-sdk-packaging,
-// third-party-licenses, brand-assets, build-desktop-artifact).
+// These tests read other packages without declaring dependencies.
 const TEST_ONLY_DEPS = {
   "@t3tools/provider-pi": ["@t3tools/client-runtime"],
   "@t3tools/scripts": [
@@ -56,17 +41,12 @@ const TEST_ONLY_DEPS = {
     "@t3tools/provider-cursor",
   ],
 };
-// Declared dependencies that only feed a build step: the server bundles the
-// built web app (apps/server/vite.config.ts) but never imports it.
+// The server bundles the web build without importing it.
 const BUILD_ONLY_DEPS = { t3: ["@t3tools/web"] };
 
-// Sources scripts/mobile-native-static-check.ts lints, plus the tool and rule
-// configuration that decides how it lints them, plus the root package.json
-// that defines the lint:mobile command.
 const MOBILE_NATIVE =
   /^apps\/mobile\/.*\.(swift|kt|kts)$|^apps\/mobile\/(\.swiftlint\.yml|detekt\.yml|\.editorconfig|Brewfile)$|^scripts\/mobile-native-static-check\.ts$|^package\.json$|^\.github\/workflows\/ci\.yml$|^\.github\/scripts\/ci-changes\.cjs$|^\.github\/actions\/ci-changes\//;
 
-// Jobs that test every package except these, which have jobs of their own.
 const OWN_TEST_JOB = new Set(["t3", "@t3tools/web", "@t3tools/monorepo"]);
 
 function readWorkspace() {
@@ -108,8 +88,7 @@ function readWorkspace() {
   return packages;
 }
 
-// Returns the packages a path touches, [] for an inert path, or null when the
-// path is not understood and everything must run.
+// [] means inert; null means unknown and requires every job.
 function ownersOf(file, packages) {
   if (INERT.some((pattern) => pattern.test(file))) return [];
   // A manifest can change dependencies or versions other packages read.
@@ -148,7 +127,6 @@ function decide(files, packages, full) {
   if (everything) {
     affected = all;
   } else {
-    // Add dependents until nothing changes.
     let grew = true;
     while (grew) {
       grew = false;

.github/scripts/mirror-play-apk.cjs

@@ -1,7 +1,4 @@
-// Publishes closed-testing betas, or downloads the internal APK for a normal
-// nightly release. Play generates and signs the APK from the
-// uploaded bundle with the app signing key, so it carries the same signature
-// as the Play Store install. Run by .github/workflows/mobile-android-apk.yml.
+// Play signs generated APKs with the app signing key, matching Play Store installs.
 const { execFileSync } = require("node:child_process");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
@@ -50,10 +47,7 @@ async function play(token, method, url) {
   return response;
 }
 
-// Highest version code the track serves, with its release name. Play names a
-// release after the bundle's versionName unless the uploader sets one. This
-// endpoint reads without opening an edit; an edit would invalidate any open
-// EAS Submit edit made with the same service account.
+// Opening an edit would invalidate any EAS Submit edit using the same service account.
 async function newestTrackBuild(token, appUrl, trackName) {
   const { releases = [] } = await (
     await play(token, "GET", `${appUrl}/tracks/${trackName}/releases`)
@@ -82,8 +76,7 @@ function readRelease(tag) {
   }
 }
 
-// Download to a temporary directory so a failed request cannot leave a partial
-// APK among the release assets.
+// Stage downloads so failed requests cannot leave partial release assets.
 async function downloadApk({ token, appUrl, build, apkName }) {
   const generated = await (
     await play(token, "GET", `${appUrl}/generatedApks/${build.versionCode}`)

.github/scripts/stage-preview-bundle.py

@@ -12,8 +12,7 @@
     "server/dist/client/index.html",
     "desktop/dist-electron/main.cjs",
 }
-# The current bundle is about 32 MiB compressed. Bound extraction on the
-# trusted runner even when the PR replaces the uploader entirely.
+# Bound trusted-runner extraction even when a PR replaces the uploader.
 MAX_ARCHIVE_BYTES = 512 * 1024 * 1024
 MAX_EXPANDED_BYTES = 2 * 1024 * 1024 * 1024
 MAX_ENTRIES = 50_000
@@ -58,9 +57,7 @@ def stage_bundle(archive: Path, destination: Path):
                 files.add(name)
         if not REQUIRED_FILES <= files:
             raise ValueError("Preview bundle is missing required entry points")
-        # Validate all names before writing anything. This is a fresh directory
-        # outside the checkout; neither pre-existing links nor trusted files
-        # can be followed or overwritten. ZIP permissions are never restored.
+        # Validate before writing into a fresh directory so existing links/files cannot be followed or overwritten.
         destination.mkdir(parents=True, exist_ok=False)
         for entry in entries:
             target = destination / entry.filename

.github/scripts/thread-transfer-report.cjs

@@ -294,8 +294,7 @@ async function resolve({ github, context, core }) {
 
   const sourceArtifacts = await artifactsForRun(github, owner, repo, source.id);
   const sourceArtifact = findResultArtifact(sourceArtifacts);
-  // CI requires the artifact whenever the server tests run, so a passing run
-  // without one skipped them because the PR cannot affect the server.
+  // Successful server tests require this artifact; its absence means CI skipped them.
   if (!sourceArtifact && source.conclusion === "success") {
     core.info("CI skipped the server tests for this change; nothing to report.");
     core.setOutput("publish", "false");

.github/workflows/ci.yml

@@ -59,6 +59,9 @@ jobs:
   # file, docs included. The `Check` job at the end of this file passes only
   # when every other job passes or was skipped by `changes`.
   lint:
+    permissions:
+      contents: read
+      id-token: write
     name: Lint
     runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
@@ -82,6 +85,8 @@ jobs:
 
       - name: Setup Vite+
         uses: ./.github/actions/setup-ci-deps
+        with:
+          task-cache-read-token: ${{ secrets.T3_TASK_CACHE_READ_TOKEN }}
 
       # electron's install.js (run by ensure:electron) reads this cache before it
       # downloads from GitHub. The key changes only with the Electron version.
@@ -108,6 +113,9 @@ jobs:
         run: vp check
 
   build:
+    permissions:
+      contents: read
+      id-token: write
     name: Build and Typecheck
     needs: changes
     if: ${{ !cancelled() && (needs.changes.outputs.build != 'false' || needs.changes.outputs.typecheck != 'false') }}
@@ -139,6 +147,8 @@ jobs:
 
       - name: Setup Vite+
         uses: ./.github/actions/setup-ci-deps
+        with:
+          task-cache-read-token: ${{ secrets.T3_TASK_CACHE_READ_TOKEN }}
 
       # electron's install.js (run by ensure:electron) reads this cache before it
       # downloads from GitHub. The key changes only with the Electron version.
@@ -197,6 +207,9 @@ jobs:
   # dependency layers. The concurrency limit stays at the default 4 so peak load
   # per runner is unchanged.
   test:
+    permissions:
+      contents: read
+      id-token: write
     name: Test
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.test != 'false' }}
@@ -237,6 +250,8 @@ jobs:
 
       - name: Setup Vite+
         uses: ./.github/actions/setup-ci-deps
+        with:
+          task-cache-read-token: ${{ secrets.T3_TASK_CACHE_READ_TOKEN }}
 
       # electron's install.js (run by ensure:electron) reads this cache before it
       # downloads from GitHub. The key changes only with the Electron version.
@@ -278,6 +293,9 @@ jobs:
   # started last and ran alone for about 40s after everything else finished.
   # release.yml mirrors this test, test_web, and test_server split.
   test_web:
+    permissions:
+      contents: read
+      id-token: write
     name: Test Web
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.test_web != 'false' }}
@@ -295,6 +313,8 @@ jobs:
 
       - name: Setup Vite+
         uses: ./.github/actions/setup-ci-deps
+        with:
+          task-cache-read-token: ${{ secrets.T3_TASK_CACHE_READ_TOKEN }}
 
       # The browser project runs React tests in headless Chromium. Same cache key as
       # test_server, so both jobs share one downloaded browser.
@@ -333,6 +353,9 @@ jobs:
   # The shards are the longest jobs, so they gate themselves instead of waiting
   # ~15s for `changes`: a shard the change cannot affect stops after checkout.
   test_server:
+    permissions:
+      contents: read
+      id-token: write
     name: Test Server ${{ matrix.shard }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
@@ -359,6 +382,8 @@ jobs:
       - name: Setup Vite+
         if: steps.changes.outputs.test_server != 'false'
         uses: ./.github/actions/setup-ci-deps
+        with:
+          task-cache-read-token: ${{ secrets.T3_TASK_CACHE_READ_TOKEN }}
 
       # No Electron setup here: `t3` (apps/server) has no Electron dependency
       # and none of its tests touch the runtime. Only the non-server `test`
@@ -495,6 +520,9 @@ jobs:
         run: vp run lint:mobile
 
   release_smoke:
+    permissions:
+      contents: read
+      id-token: write
     name: Release Smoke
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.release_smoke != 'false' }}
@@ -512,6 +540,8 @@ jobs:
 
       - name: Setup Vite+
         uses: ./.github/actions/setup-ci-deps
+        with:
+          task-cache-read-token: ${{ secrets.T3_TASK_CACHE_READ_TOKEN }}
 
       - name: Exercise release-only workflow steps
         run: node scripts/release-smoke.ts