fix(ci): re-pin GitHub Actions to valid commit SHAs#739
Merged
Conversation
The pinned SHAs for nearly every action were invalid (fabricated/stale), causing Trunk Check and CodeQL to fail at job setup with 'unable to find version' on all PRs and pushes. Re-pinned each action to the verified commit SHA for its release tag: - actions/checkout v6.0.0 - actions/setup-node v6.0.0 - crowdin/github-action v2.16.2 - trunk-io/trunk-action v1.2.4 - cloudflare/wrangler-action v4.0.0 - github/codeql-action v4.0.0 -> v4.35.5 - preactjs/compressed-size-action v3.0.0 (nonexistent) -> 2.9.1 Closes #738.
Deploying zsh with
|
| Latest commit: |
075c72e
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://fb9802c2.zsh.pages.dev |
| Branch Preview URL: | https://bug-738-ci-action-pins.zsh.pages.dev |
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes broken GitHub Actions workflow setup by re-pinning third-party actions to valid commit SHAs (and correcting a couple of non-existent/fictional version references), restoring CI jobs like Trunk Check and CodeQL that were failing at the “Set up job” stage.
Changes:
- Re-pins
actions/checkout,actions/setup-node,trunk-io/trunk-action,crowdin/github-action, andcloudflare/wrangler-actionto updated, resolvable commit SHAs. - Updates CodeQL action pins to
v4.35.5with matching commit SHA for bothinitandanalyze. - Replaces the non-existent
preactjs/compressed-size-action@v3.0.0pin with a valid2.9.1pin.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/trunk-check.yml | Updates actions/checkout and trunk-io/trunk-action pins to valid SHAs so Trunk Check can start reliably. |
| .github/workflows/r2-sync.yml | Updates actions/checkout and actions/setup-node pins to valid SHAs for the R2 sync workflow. |
| .github/workflows/pages-deployment.yml | Updates actions/checkout, actions/setup-node, and cloudflare/wrangler-action pins to valid SHAs for Pages deploy. |
| .github/workflows/knowledge-search-index.yml | Updates actions/checkout and actions/setup-node pins to valid SHAs for the indexing job. |
| .github/workflows/crowdin-upload.yml | Updates actions/checkout and crowdin/github-action pins to valid SHAs for Crowdin upload. |
| .github/workflows/crowdin-download.yml | Updates actions/checkout and crowdin/github-action pins to valid SHAs for Crowdin download. |
| .github/workflows/codeql.yml | Updates actions/checkout pin and bumps CodeQL pins to v4.35.5 with valid SHAs. |
| .github/workflows/ci-perf.yml | Updates actions/checkout, actions/setup-node pins and switches compressed-size-action to a valid 2.9.1 pin. |
| node-version: "20" | ||
| cache: "pnpm" | ||
| - uses: preactjs/compressed-size-action@75744b386426020d674c9af68311bd71901bbe5b # v3.0.0 | ||
| - uses: preactjs/compressed-size-action@66325aad6443cb7cf89c4bfcd414aea2367cda94 # 2.9.1 |
Member
Author
There was a problem hiding this comment.
Intentional: preactjs/compressed-size-action does not publish v-prefixed semver tags — the release tag is literally 2.9.1 (alongside a moving v2 tag). Pinning the SHA with # 2.9.1 matches the real tag; # v2.9.1 would reference a tag that does not exist and mislead future SHA verification. Keeping # 2.9.1.
The local composite action used by Trunk Check pinned the same invalid actions/setup-node SHA, causing Trunk Check to still fail at setup after the workflow-level pins were fixed.
ss-o
added a commit
that referenced
this pull request
May 22, 2026
* docs(annexes): update available meta-plugins list
Signed-off-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
* docs: update Zi paths to XDG base dir defaults and refresh short URLs
- Replace hardcoded ~/.zi paths with ${XDG_DATA_HOME:-$HOME/.local/share}/zi
- Update ZI[HOME_DIR]/ZI[BIN_DIR] defaults in installation and commands guides
- Update ZPFX/polaris references across plugin standard, customization,
bin-gem-node annex, syntax guide, and zi_console docs
- Replace deprecated git.io short URLs with zshell.dev equivalents
* docs(community): add ZUnit testing framework section
Introduces community/04_zunit/ with eight pages covering installation,
test syntax, assertions, running tests, configuration, and CI integration.
* docs: update raw GitHub URLs from zi-src to source
* fix(docs): correct raw GitHub URLs from zi-src to src
* fix(docs): repair zunit community links (#727)
Co-authored-by: ss-o <ss-o@users.noreply.github.com>
* docs(gallery): fix zsh-eza repository reference
* fix(gallery): replace dead startify reference
* fix(ci): disable stale trunk cache
* fix(docs): update legacy startify references
* feat(docs): add syntax highlighting + restructure community contributing section (#728)
* feat(docs): add z-shell syntax highlighting
* docs(community): restructure contributing section with SVG illustrations
- Create community/00_contributing/ as first-priority section
- index.mdx: overview with banner SVG + card grid layout
- 01_getting_started.mdx: org-wide fork/branch/commit/PR guide
- 02_contributing_to_zi.mdx: zi-specific contributing guide
- 03_zsh_plugin_standard.mdx: moved from community root (slug preserved)
- 04_contributing_docs.mdx: wiki MDX authoring and Crowdin guide
- 05_project_management.mdx: absorbs project tracker + labels content
- Add six SVG illustrations to static/img/svg/community/:
- contributing-banner.svg: wide workflow diagram (fork→code→PR→merge)
- contributing-getting-started.svg: git branch tree (120×120)
- contributing-zi.svg: gear with zi logo (120×120)
- contributing-plugin-standard.svg: plug/socket icon (120×120)
- contributing-docs.svg: document with pen (120×120)
- contributing-project-management.svg: kanban board (120×120)
- Renumber community top-level:
- 02_zsh_plugin_standard.mdx removed (moved into 00_contributing/)
- 03_zsh_native_scripting_handbook.mdx → 02_
- 04_zunit/ → 03_zunit/ (update _category_.json position + doc link)
- Fix ZUnit broken links in index.mdx, 01_installation.mdx, 04_running-tests.mdx
by adding .mdx extension (forces correct file-based resolution)
- Update community/index.mdx with contributing CTA section
Closes: docs/project-tracker-and-labels branch (content absorbed)
* feat(highlight): unified zsh/zi/zunit prism grammar with token colors
- Expand zsh grammar: adds zsh-builtin (30+ builtins), zsh-expansion-flag,
zsh-special-parameter, zsh-glob-qualifier alongside existing zi/zunit tokens
- Simplify prism-include-languages.ts to swizzle delegation pattern
- Add comprehensive CSS token palette (9 token types, light + dark themes)
- Fix dead link in zsh_startify.mdx (z-shell/zsh-startify repo is gone)
- Migrate 44 MDX files from shell to zsh/zi/zunit language fences
* fix(docs): remove dead links to non-existent GitHub repositories
- ecosystem/plugins/zsh_startify.mdx: remove link to z-shell/zsh-startify (404)
and remove FontAwesome icon from heading (FA kit removed from wiki)
- community/gallery/collection/06_plugins.mdx: remove hyperlink from
zsh-startify heading (repo no longer exists)
- community/00_contributing/index.mdx: fix broken CODE_OF_CONDUCT link
(z-shell/zi repo has no CODE_OF_CONDUCT.md) — use contributor-covenant.org
- community/00_contributing/02_contributing_to_zi.mdx: fix same broken
CODE_OF_CONDUCT link; remove link to z-shell/community guidelines (repo 404)
* feat(highlight): implement zsh/zi/zunit prism grammar and token CSS
- z-shell-languages.ts: rewrite grammar using named capture groups for
ESLint prefer-named-capture-group compliance; expand zsh-builtin list
to 50+ builtins; rename zsh-keyword → zsh-builtin; add zsh-expansion-flag
token; reorganize insertBefore calls for correct priority ordering
- prism-include-languages.ts: replace manual additionalLanguages loop with
clean swizzle delegation to @theme-original/prism-include-languages
- custom.css: add 9-token semantic color palette (light + dark) for
zsh-builtin, zsh-expansion-flag, zsh-special-parameter, zsh-glob-qualifier,
zi-command keyword, zi-command subcommand function, zi-ice, zunit-command,
zunit-directive, zunit-assertion; uses CSS custom properties and nested rules
* fix(docs): fix admonition titles and lychee exclusion
- Convert space-separated admonition titles to bracket syntax (MDX v3
requirement): :::note Title -> :::note[Title] in 4 files
- Add z-shell/zsh-startify to lychee exclude list — repo is archived/removed
and is referenced in existing docs on the target (next) branch; Trunk
checks both PR and base versions, causing false CI failures
* fix(ci): correct build-script for compressed-size-action
The action prepends 'pnpm run' to the build-script value, so passing
'pnpm build:en' ran 'pnpm run pnpm build:en' — a non-existent script.
Change to the bare script name 'build:en' so the action runs
'pnpm run build:en' correctly.
* fix(highlight): correct CSS selector and override inline Prism theme colors
prism-react-renderer applies inline style="color:..." to token spans
using the Dracula/GitHub theme's alias colors, which beats plain CSS rules.
Two fixes:
- Selector: token colors were targeting <code> but Docusaurus puts
language-* on <pre>; change to pre.language-* selectors.
- Override: add !important to all custom token color declarations so
they win over the inline styles.
Also migrate z-shell/community membership links to z-shell/.github
(community repo is private; .github has the same 05_membership.yml
template and public issues enabled).
* fix(highlight): flatten CSS selectors — Docusaurus pipeline strips CSS nesting
Nested rules inside :is() and block selectors were mangled by the build,
producing invalid CSS like `.language-zsh,...) .token.zsh-builtin` with
the `pre` and `:is(` prefix stripped. Flattened all token color rules to
standard descendant selectors which the pipeline processes correctly.
* fix(highlight): expand zi/zunit grammar coverage
zi-command: add light-mode, self-update, cdreplay, cdlist, status
zi-ice: add compile, eval, extract, has, if, nocd, sbin, svn (all
appear in ecosystem/docs pages but were tokenized as plain text)
zunit-command: broaden pattern from strict lookahead to match bare
zunit and any subcommand/flag, using lookbehind for boundary
* feat(docs): redesign four landing pages with banner SVGs and card grids
Each page now matches the contributing page pattern:
- Full-width 720×140 banner SVG illustrating the section topic
- :::info/:::tip admonition with key links or quick facts
- CSS grid of cards (icon + title + description + arrow link)
Pages updated: docs/, ecosystem/, community/, community/zunit/
SVGs created: docs-banner, ecosystem-banner, community-banner, zunit-banner
All card links verified against actual built URLs.
* fix(highlight): fix zi-command compound selector and zi-ice token priority
prism-react-renderer v2 renders `inside` tokens as compound classes on the
same span, not nested spans — fix CSS to use .token.zi-command.keyword
instead of descendant .token.zi-command .token.keyword.
Move zi-ice insertBefore to fire before zsh-builtin so ice modifiers like
'wait' and 'src' are not mis-tokenized as shell builtins in zi blocks.
Also redesign docs/ecosystem/community/zunit banner SVGs with distinct
color palettes (blue/amber/purple/teal-red) so each section has a unique
visual identity.
* fix(docs): remove zsh-startify — plugin not under z-shell org
Remove ecosystem/plugins/zsh_startify.mdx (was draft: true) and the
corresponding gallery entry in 06_plugins.mdx. The plugin is hosted
under a third-party org that we do not reference in Z-Shell docs.
---------
Co-authored-by: ss-o <ss-o@users.noreply.github.com>
* docs(wiki): address PR 732 review feedback
* chore(meta): secure workflows and unify agent instructions
* chore(meta): update legacy zdharma references to z-shell
* chore(meta): final zdharma archival cleanup
* fix(docs): repair broken revolver and color snippet links
* fix(docs): pin snippet links to SHA to resolve 404s
* chore: remove unused codebase boilerplate templates
* chore(ci): remove emoji prefixes from workflow and job names
* feat(search): add Supabase knowledge search
* fix(search): use Supabase secret key
* chore(cf): generate Pages Function env types from wrangler bindings
* chore(cf): gitignore generated worker-env.d.ts
* feat(cf): add Pages Function to proxy offloaded R2 assets
* fix(cf): add CORS and robots headers, add functions tsconfig
* fix(cf): standalone functions tsconfig and OPTIONS preflight handler
* fix(cf): align module/moduleResolution in functions tsconfig
* fix(cf): guard non-GET/HEAD methods and add Allow-Headers to preflight
* fix(ci): re-pin GitHub Actions to valid commit SHAs (#739)
Re-pinned every action (workflows + .trunk/setup-ci) to verified release SHAs; fixes Trunk Check + CodeQL failing at job setup. Closes #738.
* docs: move maintainer tooling to community/ and define content-root boundaries (#736)
Reconciles the divergent docs/maintainers vs community/maintainers duplicate (kept canonical SB_SECRET_KEY copy), moves it to community/10_maintainers/, and hardens AGENTS.md + authoring instructions so docs/ stays Zi-user-docs-only.
* fix(search): harden Edge Function + indexer and add local Supabase config
- query.mjs: parse response as text first; surface HTTP status + body on non-JSON errors instead of crashing
- index.ts: wrap the Edge Function handler in try/catch returning internal_error
- migration: schema-qualify vector distance as OPERATOR(extensions.<=>) so match_public_docs works under 'set search_path = '''
- add supabase/config.toml (local CLI config) and supabase/.gitignore
* fix: address PR #740 review feedback
- functions/[[path]].ts: implement Range + If-None-Match handling (206/304) so the advertised preflight headers are actually supported; add Accept-Ranges
- prism: use plain capturing groups instead of named groups for Prism lookbehind (older-browser regex compatibility)
- embed-docs: skip re-embedding sources whose content_hash is unchanged, and batch embeddings into one request per document instead of one per chunk
* docs: move maintainer runbook out of the wiki
The Supabase Knowledge Search maintainer guide is operational documentation
(secret names, infra topology, ops CLIs) and does not belong on the public wiki.
Relocated to z-shell/.github/runbooks/supabase-knowledge-search.md. Updates the
content-root boundaries: community/ holds community content only; maintainer /
operational runbooks live in z-shell/.github/runbooks/. Refs ADR 0006.
* fix(deps): regenerate pnpm-lock.yaml after next<-main merge
The lockfile auto-merge left a dangling ws@8.20.0 reference (main bumped ws to
8.20.1), breaking 'pnpm i --frozen-lockfile' in CI. Re-resolved the lockfile.
* fix(search): do not expose internal error details in Edge Function responses
Addresses CodeQL 'information exposure through a stack trace': log error
details server-side and return only a generic error code to the client.
* fix(prism): keep named capture groups for lookbehind patterns
Reverts the plain-capture-group change: the repo's eslint config enforces
prefer-named-capture-group, and Prism's lookbehind:true requires a capturing
(not non-capturing) group, so named groups are the only option that satisfies
both. Named capture groups are ES2018 and supported across the project's
browserslist targets.
---------
Signed-off-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
Co-authored-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
ss-o
added a commit
that referenced
this pull request
May 25, 2026
* docs(annexes): update available meta-plugins list
Signed-off-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
* docs: update Zi paths to XDG base dir defaults and refresh short URLs
- Replace hardcoded ~/.zi paths with ${XDG_DATA_HOME:-$HOME/.local/share}/zi
- Update ZI[HOME_DIR]/ZI[BIN_DIR] defaults in installation and commands guides
- Update ZPFX/polaris references across plugin standard, customization,
bin-gem-node annex, syntax guide, and zi_console docs
- Replace deprecated git.io short URLs with zshell.dev equivalents
* docs(community): add ZUnit testing framework section
Introduces community/04_zunit/ with eight pages covering installation,
test syntax, assertions, running tests, configuration, and CI integration.
* docs: update raw GitHub URLs from zi-src to source
* fix(docs): correct raw GitHub URLs from zi-src to src
* fix(docs): repair zunit community links (#727)
Co-authored-by: ss-o <ss-o@users.noreply.github.com>
* docs(gallery): fix zsh-eza repository reference
* fix(gallery): replace dead startify reference
* fix(ci): disable stale trunk cache
* fix(docs): update legacy startify references
* feat(docs): add syntax highlighting + restructure community contributing section (#728)
* feat(docs): add z-shell syntax highlighting
* docs(community): restructure contributing section with SVG illustrations
- Create community/00_contributing/ as first-priority section
- index.mdx: overview with banner SVG + card grid layout
- 01_getting_started.mdx: org-wide fork/branch/commit/PR guide
- 02_contributing_to_zi.mdx: zi-specific contributing guide
- 03_zsh_plugin_standard.mdx: moved from community root (slug preserved)
- 04_contributing_docs.mdx: wiki MDX authoring and Crowdin guide
- 05_project_management.mdx: absorbs project tracker + labels content
- Add six SVG illustrations to static/img/svg/community/:
- contributing-banner.svg: wide workflow diagram (fork→code→PR→merge)
- contributing-getting-started.svg: git branch tree (120×120)
- contributing-zi.svg: gear with zi logo (120×120)
- contributing-plugin-standard.svg: plug/socket icon (120×120)
- contributing-docs.svg: document with pen (120×120)
- contributing-project-management.svg: kanban board (120×120)
- Renumber community top-level:
- 02_zsh_plugin_standard.mdx removed (moved into 00_contributing/)
- 03_zsh_native_scripting_handbook.mdx → 02_
- 04_zunit/ → 03_zunit/ (update _category_.json position + doc link)
- Fix ZUnit broken links in index.mdx, 01_installation.mdx, 04_running-tests.mdx
by adding .mdx extension (forces correct file-based resolution)
- Update community/index.mdx with contributing CTA section
Closes: docs/project-tracker-and-labels branch (content absorbed)
* feat(highlight): unified zsh/zi/zunit prism grammar with token colors
- Expand zsh grammar: adds zsh-builtin (30+ builtins), zsh-expansion-flag,
zsh-special-parameter, zsh-glob-qualifier alongside existing zi/zunit tokens
- Simplify prism-include-languages.ts to swizzle delegation pattern
- Add comprehensive CSS token palette (9 token types, light + dark themes)
- Fix dead link in zsh_startify.mdx (z-shell/zsh-startify repo is gone)
- Migrate 44 MDX files from shell to zsh/zi/zunit language fences
* fix(docs): remove dead links to non-existent GitHub repositories
- ecosystem/plugins/zsh_startify.mdx: remove link to z-shell/zsh-startify (404)
and remove FontAwesome icon from heading (FA kit removed from wiki)
- community/gallery/collection/06_plugins.mdx: remove hyperlink from
zsh-startify heading (repo no longer exists)
- community/00_contributing/index.mdx: fix broken CODE_OF_CONDUCT link
(z-shell/zi repo has no CODE_OF_CONDUCT.md) — use contributor-covenant.org
- community/00_contributing/02_contributing_to_zi.mdx: fix same broken
CODE_OF_CONDUCT link; remove link to z-shell/community guidelines (repo 404)
* feat(highlight): implement zsh/zi/zunit prism grammar and token CSS
- z-shell-languages.ts: rewrite grammar using named capture groups for
ESLint prefer-named-capture-group compliance; expand zsh-builtin list
to 50+ builtins; rename zsh-keyword → zsh-builtin; add zsh-expansion-flag
token; reorganize insertBefore calls for correct priority ordering
- prism-include-languages.ts: replace manual additionalLanguages loop with
clean swizzle delegation to @theme-original/prism-include-languages
- custom.css: add 9-token semantic color palette (light + dark) for
zsh-builtin, zsh-expansion-flag, zsh-special-parameter, zsh-glob-qualifier,
zi-command keyword, zi-command subcommand function, zi-ice, zunit-command,
zunit-directive, zunit-assertion; uses CSS custom properties and nested rules
* fix(docs): fix admonition titles and lychee exclusion
- Convert space-separated admonition titles to bracket syntax (MDX v3
requirement): :::note Title -> :::note[Title] in 4 files
- Add z-shell/zsh-startify to lychee exclude list — repo is archived/removed
and is referenced in existing docs on the target (next) branch; Trunk
checks both PR and base versions, causing false CI failures
* fix(ci): correct build-script for compressed-size-action
The action prepends 'pnpm run' to the build-script value, so passing
'pnpm build:en' ran 'pnpm run pnpm build:en' — a non-existent script.
Change to the bare script name 'build:en' so the action runs
'pnpm run build:en' correctly.
* fix(highlight): correct CSS selector and override inline Prism theme colors
prism-react-renderer applies inline style="color:..." to token spans
using the Dracula/GitHub theme's alias colors, which beats plain CSS rules.
Two fixes:
- Selector: token colors were targeting <code> but Docusaurus puts
language-* on <pre>; change to pre.language-* selectors.
- Override: add !important to all custom token color declarations so
they win over the inline styles.
Also migrate z-shell/community membership links to z-shell/.github
(community repo is private; .github has the same 05_membership.yml
template and public issues enabled).
* fix(highlight): flatten CSS selectors — Docusaurus pipeline strips CSS nesting
Nested rules inside :is() and block selectors were mangled by the build,
producing invalid CSS like `.language-zsh,...) .token.zsh-builtin` with
the `pre` and `:is(` prefix stripped. Flattened all token color rules to
standard descendant selectors which the pipeline processes correctly.
* fix(highlight): expand zi/zunit grammar coverage
zi-command: add light-mode, self-update, cdreplay, cdlist, status
zi-ice: add compile, eval, extract, has, if, nocd, sbin, svn (all
appear in ecosystem/docs pages but were tokenized as plain text)
zunit-command: broaden pattern from strict lookahead to match bare
zunit and any subcommand/flag, using lookbehind for boundary
* feat(docs): redesign four landing pages with banner SVGs and card grids
Each page now matches the contributing page pattern:
- Full-width 720×140 banner SVG illustrating the section topic
- :::info/:::tip admonition with key links or quick facts
- CSS grid of cards (icon + title + description + arrow link)
Pages updated: docs/, ecosystem/, community/, community/zunit/
SVGs created: docs-banner, ecosystem-banner, community-banner, zunit-banner
All card links verified against actual built URLs.
* fix(highlight): fix zi-command compound selector and zi-ice token priority
prism-react-renderer v2 renders `inside` tokens as compound classes on the
same span, not nested spans — fix CSS to use .token.zi-command.keyword
instead of descendant .token.zi-command .token.keyword.
Move zi-ice insertBefore to fire before zsh-builtin so ice modifiers like
'wait' and 'src' are not mis-tokenized as shell builtins in zi blocks.
Also redesign docs/ecosystem/community/zunit banner SVGs with distinct
color palettes (blue/amber/purple/teal-red) so each section has a unique
visual identity.
* fix(docs): remove zsh-startify — plugin not under z-shell org
Remove ecosystem/plugins/zsh_startify.mdx (was draft: true) and the
corresponding gallery entry in 06_plugins.mdx. The plugin is hosted
under a third-party org that we do not reference in Z-Shell docs.
---------
Co-authored-by: ss-o <ss-o@users.noreply.github.com>
* docs(wiki): address PR 732 review feedback
* chore(meta): secure workflows and unify agent instructions
* chore(meta): update legacy zdharma references to z-shell
* chore(meta): final zdharma archival cleanup
* fix(docs): repair broken revolver and color snippet links
* fix(docs): pin snippet links to SHA to resolve 404s
* chore: remove unused codebase boilerplate templates
* chore(ci): remove emoji prefixes from workflow and job names
* feat(search): add Supabase knowledge search
* fix(search): use Supabase secret key
* chore(cf): generate Pages Function env types from wrangler bindings
* chore(cf): gitignore generated worker-env.d.ts
* feat(cf): add Pages Function to proxy offloaded R2 assets
* fix(cf): add CORS and robots headers, add functions tsconfig
* fix(cf): standalone functions tsconfig and OPTIONS preflight handler
* fix(cf): align module/moduleResolution in functions tsconfig
* fix(cf): guard non-GET/HEAD methods and add Allow-Headers to preflight
* fix(ci): re-pin GitHub Actions to valid commit SHAs (#739)
Re-pinned every action (workflows + .trunk/setup-ci) to verified release SHAs; fixes Trunk Check + CodeQL failing at job setup. Closes #738.
* docs: move maintainer tooling to community/ and define content-root boundaries (#736)
Reconciles the divergent docs/maintainers vs community/maintainers duplicate (kept canonical SB_SECRET_KEY copy), moves it to community/10_maintainers/, and hardens AGENTS.md + authoring instructions so docs/ stays Zi-user-docs-only.
* fix(search): harden Edge Function + indexer and add local Supabase config
- query.mjs: parse response as text first; surface HTTP status + body on non-JSON errors instead of crashing
- index.ts: wrap the Edge Function handler in try/catch returning internal_error
- migration: schema-qualify vector distance as OPERATOR(extensions.<=>) so match_public_docs works under 'set search_path = '''
- add supabase/config.toml (local CLI config) and supabase/.gitignore
* fix: address PR #740 review feedback
- functions/[[path]].ts: implement Range + If-None-Match handling (206/304) so the advertised preflight headers are actually supported; add Accept-Ranges
- prism: use plain capturing groups instead of named groups for Prism lookbehind (older-browser regex compatibility)
- embed-docs: skip re-embedding sources whose content_hash is unchanged, and batch embeddings into one request per document instead of one per chunk
* docs: move maintainer runbook out of the wiki
The Supabase Knowledge Search maintainer guide is operational documentation
(secret names, infra topology, ops CLIs) and does not belong on the public wiki.
Relocated to z-shell/.github/runbooks/supabase-knowledge-search.md. Updates the
content-root boundaries: community/ holds community content only; maintainer /
operational runbooks live in z-shell/.github/runbooks/. Refs ADR 0006.
* fix(deps): regenerate pnpm-lock.yaml after next<-main merge
The lockfile auto-merge left a dangling ws@8.20.0 reference (main bumped ws to
8.20.1), breaking 'pnpm i --frozen-lockfile' in CI. Re-resolved the lockfile.
* fix(search): do not expose internal error details in Edge Function responses
Addresses CodeQL 'information exposure through a stack trace': log error
details server-side and return only a generic error code to the client.
* fix(prism): keep named capture groups for lookbehind patterns
Reverts the plain-capture-group change: the repo's eslint config enforces
prefer-named-capture-group, and Prism's lookbehind:true requires a capturing
(not non-capturing) group, so named groups are the only option that satisfies
both. Named capture groups are ES2018 and supported across the project's
browserslist targets.
* ci(workflows): require Node 22 for wrangler@4 deploy
Wrangler 4 dropped Node 20 support, which broke the Deploy Wiki and r2-sync workflows. Bump setup-node to 22 across the wrangler and CI workflows.
* chore(search): remove Supabase knowledge-search implementation
The Supabase-backed semantic search had no live frontend consumer (site search is Algolia DocSearch; SearchBar.tsx only tweaks aria attributes), and its indexer workflow was failing on main. Remove the supabase/ project, scripts/knowledge-search/, the indexer workflow, the openai and postgres dependencies, and the stale AGENTS.md reference.
* ci(trunk): align setup-ci and docs with Node 22 requirement
Follow-up to the wrangler@4 Node bump: the Trunk Check composite action still installed deps under Node 20, mismatching engines.node >=22. Bump it and update the AGENTS.md prerequisite.
---------
Signed-off-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
Co-authored-by: Salvydas Lukosius <ss-o@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Nearly every action pin in
.github/workflows/referenced an invalid (fabricated or stale) commit SHA, so Trunk Check and CodeQL failed at job setup (unable to find version …) on every PR and push. Two version comments were also fictional (codeql-action@v4.0.0predates the real tag we now use;compressed-size-action@v3.0.0never existed).Each pin was re-resolved against the action's official release tag via the GitHub API and corrected:
Closes #738.
Atomic CI-hygiene change, kept separate from content PRs per workspace conventions. Once merged to
next, dependent PRs (#736) update fromnextto go green.