dependabot[bot]
b21c45be7c
build(deps): bump the actions group across 1 directory with 9 updates
...
Bumps the actions group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4.4.0` | `7.0.1` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `6.0.0` | `7.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python ) | `5.6.0` | `7.1.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv ) | `5.4.2` | `10.3.3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `4.6.2` | `7.0.2` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `4.3.0` | `8.0.2` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) | `2.6.2` | `3.0.3` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `7.0.0` | `7.1.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) | `0.6.4` | `0.8.1` |
Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](11d5960a32...3d3c42e5aahttps://github.com/actions/setup-go/releases )
- [Commits](4469467582...b7ad1dad31https://github.com/actions/setup-python/releases )
- [Commits](a26af69be9...6d4fd22b20https://github.com/astral-sh/setup-uv/releases )
- [Commits](d4b2f3b6ec...68559e99cchttps://github.com/actions/upload-artifact/releases )
- [Commits](ea165f8d65...cf430e030dhttps://github.com/actions/download-artifact/releases )
- [Commits](d3f86a106a...9000827ccbhttps://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](3bb12739c2...efb35369e0https://github.com/actions/setup-node/releases )
- [Commits](8207627860...949feb2413https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](cc914d7f37...45d7276c9c
2026-11-10 06:54:57 +00:00
Ahmed Allam
0601550662
ci: fold CI into one workflow with job timeouts and path-gate the binary and workflow lint
Binary / binary (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / pytest (3.12) (push) Has been cancelled
CI / pytest (3.14) (push) Has been cancelled
CI / tui (push) Has been cancelled
CI / viewer (push) Has been cancelled
CI / wheel (push) Has been cancelled
Workflows / actionlint (push) Has been cancelled
Workflows / zizmor (push) Has been cancelled
2026-11-05 23:03:29 +02:00
alex s
a3c31236bd
build(deps): enforce a 5-day release cooldown for uv and npm resolution ( #1556 )
2026-10-21 11:30:08 -04:00
Ahmed Allam
7ce44ef69a
ci(package): check for a missing module without a bare negation so shellcheck is happy
2026-10-04 22:05:21 +03:00
Ahmed Allam
265e508d5c
fix(deps): declare boto3 directly and exercise Vertex AI and Bedrock auth from the frozen binary in CI
2026-10-04 22:05:21 +03:00
Ahmed Allam
6a3d2ec9b8
ci(release): publish a GitHub release only from a tag so a manual run just builds
2026-10-04 22:05:21 +03:00
Ahmed Allam
86edf1c5ff
fix(deps): ship google-auth with every install so Vertex AI works in release binaries
2026-10-04 22:05:21 +03:00
Ahmed Allam
881bc09a06
ci: drop the CodeQL workflow
2026-10-04 21:07:06 +03:00
Ahmed Allam
a5b80af428
ci: split CI into per-concern reusable workflows behind one ci-passed gate
...
Add uv lock --check, a wheel install smoke test, a PyInstaller dry run,
actionlint and zizmor on the workflows, CodeQL, and Dependabot for action
pins, uv, Go and npm dependencies. Release caches are disabled so zizmor's
cache-poisoning audit passes.
2026-10-04 21:07:06 +03:00
Ahmed Allam
2a7864a947
ci: run ruff, mypy, bandit, pytest, Go TUI and viewer checks on every pull request
2026-10-04 21:07:06 +03:00
Ahmed Allam
b08662449d
ci: publish nested standalone archives as release assets
2026-08-06 22:03:57 +03:00
Ahmed Allam
bda0f54342
ci: tolerate repr-escaped backslashes in the release TUI-sidecar check
2026-08-06 21:55:12 +03:00
Ahmed Allam
c6c8bb5ca6
ci: match Windows backslash paths in the release TUI-sidecar check
2026-08-06 21:26:23 +03:00
oyasumi
5bb9fe896b
feat(tui): replace Textual with a Go/Bubble Tea interface ( #941 )
2026-08-03 19:23:07 -07:00
Matthew Bright
427cdcd9d4
Add Linux ARM64 standalone release support ( #886 )
2026-07-26 16:27:02 -07:00
Tim Haines
960caf86aa
Pin release-workflow actions to commit SHAs + least-privilege token ( #862 )
...
Every `uses:` in build-release.yml was a mutable tag; the `release` job has
`contents: write` and publishes the binaries users install, so a compromised
action could tamper the release. Action tag-hijacking keeps recurring
(aquasecurity/trivy-action, 75 tags, Mar 2026 TeamPCP; tj-actions, 2025;
codfish/semantic-release-action, Jun 2026) and SHA-pinned workflows were immune
each time. Pin all six actions to the commit each @major resolves to today
(concrete version in a trailing comment; setup-uv's annotated tag dereferenced
to its commit, not the tag object, so Dependabot tracks it). Also add a
top-level `permissions: contents: read` (the release job keeps its explicit
write) and `persist-credentials: false` on the build checkout.
actionlint passes. Pairs with #860 (Dependabot github-actions keeps the pins
current).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-23 15:22:28 -04:00
Dustin Persek
e53b0bd11f
fix(ci): lower Linux release glibc baseline ( #707 )
...
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Ahmed Allam <49919286+0xallam@users.noreply.github.com>
2026-07-10 06:13:14 -07:00
STJ
38b2700553
feat: Migrate from Poetry to uv ( #379 )
2026-03-31 17:20:41 -07:00
0xallam
eb0c52b720
feat: add PyInstaller build for standalone binary distribution
...
- Add PyInstaller spec file and build script for creating standalone executables
- Add install.sh for curl | sh installation from GitHub releases
- Add GitHub Actions workflow for multi-platform builds (macOS, Linux, Windows)
- Move sandbox-only deps (playwright, ipython, libtmux, etc.) to optional extras
- Make google-cloud-aiplatform optional ([vertex] extra) to reduce binary size
- Use lazy imports in tool actions to avoid loading sandbox deps at startup
- Add -v/--version flag to CLI
- Add website and Discord links to completion message
- Binary size: ~97MB (down from ~120MB with all deps)
2025-12-15 08:21:03 -08:00
