Sync from Rakuten upstream (v0.4.1 changes) - #6
Open
sanjay-0423 wants to merge 14 commits into
Open
Conversation
Bumps [@types/chrome](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/chrome) from 0.0.300 to 0.2.6. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/chrome) --- updated-dependencies: - dependency-name: "@types/chrome" dependency-version: 0.2.6 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.5 to 26.2.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.5 to 10.8.1. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.5...v10.8.1) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.8.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Resolves the single-codeowner gap that caused a require_code_owner_review + require_last_push_approval deadlock on PR #7 (Travis, as sole codeowner and last pusher, could not satisfy the code-owner gate on his own fix commits). Max agreed to be added 2026-08-24 (Slack DM D041J5ECQ3F).
The version bump commit that previously pushed straight to main in cd.yml's Publish job conflicts with this repo's own branch ruleset (require pull request before merging, no bypass actors) -- confirmed by a live 0.4.1 dry run that was rejected with GH013 and left a stray tag behind. Adds prepare-release.yml: a manually-triggered workflow that bumps package.json and opens a normal PR for review (goes through the same Compile check and codeowner approval as any other change). Trims cd.yml's Publish job to read the version from package.json on main instead of taking it as input, and to fail if a tag for that version already exists instead of deleting and recreating it (the previous behavior would have silently overwritten a published release on a re-run). Tag push is unaffected by the branch ruleset since it targets refs/tags, not refs/heads/main. New flow: run Prepare Release with a version -> review/merge that PR like normal -> run Publish (no input needed) to tag and release the merged commit.
- prepare-release.yml: route the version input through env vars in
the two run: steps that were splicing ${{ }} directly into shell
script text, closing a script-injection path (the input skips
npm's own semver validation entirely at that point). Also drop
the unused pnpm setup step -- this job only runs npm/git/gh.
- cd.yml: restrict Publish's workflow_dispatch to main via
`if: github.ref == 'refs/heads/main'`, so it can't tag/release a
commit that skipped the Prepare Release PR's review. Also make
the duplicate-tag check fail closed: `git ls-remote --exit-code`
returns non-zero both when a tag is missing (expected) and when
the check itself fails (network/auth), and the previous version
treated both cases as "safe to proceed."
git ls-remote --exit-code exits 2 when the tag is not found (the expected case for a first-time publish), but that line ran unprotected under bash -e, so the non-zero exit aborted the script before status=$? or the if/elif block ever ran. Every publish attempt failed on this step regardless of whether the tag actually existed. Guarding the command with && / || makes the compound statement itself succeed, so set -e has nothing to trip on.
# Conflicts: # package.json
…t links Addresses PR review: README install section now points users to the required Manifest V3 permissions and Quick Start after install.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Pulls in Rakuten upstream's changes onto our PayPal
main, merged via a review branch somainis never touched directly.Incoming from Rakuten (12 commits)
ci.yml,cd.yml,prepare-release.yml, CodeQL, dependency auditingpnpm-lock.yaml@types/chrome,@types/node,eslintsrc/api/index.ts,src/detection/tracker.ts+ testsPreserved from our fork
webNavigationremovalversion: 0.5.0(conflict resolution vs their 0.4.1)Validation
tsc --noEmitclean🤖 Generated with Claude Code