Sync Primer view_components upstream through v0.51.6 - #499
Closed
myabc wants to merge 12 commits into
Closed
Conversation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
…lector lists (primer#4095) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
# Conflicts: # package-lock.json # package.json
Adds a step for referencing the upstream package version (read from package.json at TARGET) in PR titles instead of the raw merge SHA, which tells reviewers nothing on its own. Ports the change from the octicons fork's mirrored skill.
🦋 Changeset detectedLatest commit: 907b27e The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
Pull request overview
Syncs this fork with upstream primer/view_components through upstream package version 0.51.6, while carrying fork-specific conflict resolutions and adding a new published JS subpath export for CSS class name tooling.
Changes:
- Add a new
@openproject/primer-view-components/classnamessubpath export backed by generatedstatic/classnames.*. - Improve CSS style-recalc performance by removing universal-subject selectors and expanding merged selector lists in several component styles.
- Replay a security bump for
nokogiriin both root and demo lockfiles and extend internal sync guidance docs.
Reviewed changes
Copilot reviewed 13 out of 16 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| static/classnames.js | Adds ESM default export of a generated Set of CSS class names. |
| static/classnames.d.ts | Adds TypeScript typings for the classnames export. |
| static/classnames.cjs | Adds CommonJS build of the generated class name Set. |
| static/classes.json | Updates generated class-to-component mapping (new Popover caret variants, DataTable classes). |
| script/export-css-selectors | Enhances static export generation to emit classnames.* and collect class names across folders. |
| package.json | Adds exports field (including ./classnames) and includes new static artifacts in published files list. |
| Gemfile.lock | Replays nokogiri security bump to 1.19.4. |
| demo/Gemfile.lock | Replays nokogiri security bump to 1.19.4 for the demo app. |
| app/components/primer/beta/popover.pcss | Refactors caret selectors for better style-recalc performance; adds a stylelint suppression. |
| app/components/primer/beta/breadcrumbs.pcss | Refactors selectors to avoid merged :is(...) slow-path selector matching. |
| app/components/primer/alpha/text_field.pcss | Adds stylelint scoping rule suppression around mixin; refactors selectors for performance. |
| app/components/primer/alpha/auto_complete.pcss | Removes universal descendant color override for hover/selected states to reduce slow selector matching. |
| .devcontainer/Dockerfile | Removes Yarn apt source to avoid apt GPG verification failures. |
| .claude/skills/syncing-primer-fork/SKILL.md | Adds PR title guidance (prefer upstream version over merge SHA). |
| .changeset/fast-pumas-juggle.md | Adds changeset entry for CSS selector performance improvements. |
| .changeset/classnames-export.md | Adds changeset entry for the new classnames subpath export. |
|
Extends the include glob so nested component sources (alpha/, beta/, open_project/) are matched, and excludes generated .d.ts files that would otherwise conflict with their sources. Fixes the Vite dev server in the demo app: its per-file tsconfig resolution honours include patterns, so unmatched files were transformed without experimentalDecorators. Catalyst @controller decorators then reached the browser untransformed, aborting the whole JS module graph - no custom elements were registered and ActionMenu overlays rendered as static in-flow content. (cherry picked from commit ba86b76)
The zizmor hardening set persist-credentials: false on the checkout, but git-auto-commit-action pushes via the credentials checkout writes to git config. With them off the push failed with "could not read Username for https://github.com" and the job errored on every run. Re-enables persistence and suppresses the artipacked rule inline; the token is a scoped app-token (contents:write, this repo only), not the default GITHUB_TOKEN, so the exposure zizmor guards against is limited. (cherry picked from commit dd6de0e)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package.json: kept the fork's name/version/repository, gained upstream's newexportsfield (classnames subpath export)Gemfile.lock, whichmerge=ourswould otherwise have silently dropped; left other minor patch bumps (bootsnap, css_parser, msgpack, erb, irb) to the weekly Dependabot cycleview_componentstays pinned at 4.9.0 indemo/Gemfile(manifest constraint, not a lockfile-only bump)syncing-primer-forkskill (title by upstream version, not the merge SHA)Test plan
exportsfield inpackage.jsondoesn't break existing consumers