Skip to content

[codex] migrate to pnpm security defaults #1512

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
svarlamov wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[codex] migrate to pnpm security defaults #1512

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,8 +47,14 @@ jobs:
with:
node-version: '22'

- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- name: Install Graphite CLI
run: npm install -g @withgraphite/graphite-cli@stable
run: pnpm add --global @withgraphite/graphite-cli@stable

- name: Install cargo-llvm-cov
run: cargo install cargo-llvm-cov --locked
Expand Down
30 changes: 20 additions & 10 deletions .github/workflows/install-scripts-local.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,13 +46,13 @@ jobs:
os: [ubuntu-latest, macos-latest]
agent:
- name: claude
npm_pkg: "@anthropic-ai/claude-code"
package_spec: "@anthropic-ai/claude-code"
- name: codex
npm_pkg: "@openai/codex"
package_spec: "@openai/codex"
- name: gemini
npm_pkg: "@google/gemini-cli"
package_spec: "@google/gemini-cli"
- name: opencode
npm_pkg: "opencode-ai"
package_spec: "opencode-ai"

steps:
- name: Checkout code
Expand All @@ -72,8 +72,13 @@ jobs:
with:
node-version: '22'

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- name: Install agent CLI — ${{ matrix.agent.name }}
run: npm install -g "${{ matrix.agent.npm_pkg }}"
run: pnpm add --global "${{ matrix.agent.package_spec }}"

- name: Prepare test home
run: |
Expand Down Expand Up @@ -192,13 +197,13 @@ jobs:
matrix:
agent:
- name: claude
npm_pkg: "@anthropic-ai/claude-code"
package_spec: "@anthropic-ai/claude-code"
- name: codex
npm_pkg: "@openai/codex"
package_spec: "@openai/codex"
- name: gemini
npm_pkg: "@google/gemini-cli"
package_spec: "@google/gemini-cli"
- name: opencode
npm_pkg: "opencode-ai"
package_spec: "opencode-ai"

steps:
- name: Checkout code
Expand All @@ -218,8 +223,13 @@ jobs:
with:
node-version: '22'

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- name: Install agent CLI — ${{ matrix.agent.name }}
run: npm install -g "${{ matrix.agent.npm_pkg }}"
run: pnpm add --global "${{ matrix.agent.package_spec }}"

- name: Prepare test home
shell: pwsh
Expand Down
33 changes: 24 additions & 9 deletions .github/workflows/nightly-agent-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,11 @@ jobs:
outputs:
matrix: ${{ steps.build-matrix.outputs.matrix }}
steps:
- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '22'
Expand Down Expand Up @@ -73,17 +78,17 @@ jobs:
for agent, info in agents.items():
try:
stable_ver = subprocess.check_output(
["npm", "view", info["pkg"], "version"],
["pnpm", "view", info["pkg"], "version"],
text=True, stderr=subprocess.DEVNULL
).strip()
# Try the "next" dist-tag for a pre-release; fall back to stable
# to avoid doubling CI cost when no canary exists
try:
latest_ver = subprocess.check_output(
["npm", "view", info["pkg"], "dist-tags.next"],
["pnpm", "view", info["pkg"], "dist-tags.next"],
text=True, stderr=subprocess.DEVNULL
).strip()
# npm 10+ exits 0 with empty output or "undefined" when the
# pnpm view may exit 0 with empty output or "undefined" when the
# dist-tag doesn't exist, so CalledProcessError is not raised
if not latest_ver or latest_ver == "undefined":
latest_ver = stable_ver
Expand All @@ -100,23 +105,23 @@ jobs:
# stable — no additional coverage, just wastes CI resources
if channel == "latest" and latest_ver == stable_ver:
continue
npm_pkg = f"{info['pkg']}@{ver}" if channel == "stable" else f"{info['pkg']}@next"
package_spec = f"{info['pkg']}@{ver}" if channel == "stable" else f"{info['pkg']}@next"
matrix["include"].append({
"agent": agent,
"channel": channel,
"npm_pkg": npm_pkg,
"package_spec": package_spec,
"version": ver,
"api_key_var": info["key"],
"headless_cmd": headless_cmds[agent],
})

# Droid uses curl installer (latest only, no npm version pinning)
# Droid uses curl installer (latest only, no registry version pinning)
# Respect AGENTS_FILTER so an explicit agents=claude excludes droid
if not agents_filter or agents_filter == "all" or "droid" in {a.strip() for a in agents_filter.split(",")}:
matrix["include"].append({
"agent": "droid",
"channel": "latest",
"npm_pkg": "",
"package_spec": "",
"version": "latest",
"api_key_var": "FACTORY_API_KEY",
"headless_cmd": "droid exec --auto high",
Expand Down Expand Up @@ -164,13 +169,18 @@ jobs:
with:
node-version: '22'

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- name: Install agent CLI — ${{ matrix.agent }} (${{ matrix.channel }})
run: |
if [ "${{ matrix.agent }}" = "droid" ]; then
curl -fsSL https://app.factory.ai/cli | sh
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
else
npm install -g "${{ matrix.npm_pkg }}"
pnpm add --global "${{ matrix.package_spec }}"
fi

- name: Verify agent binary is present
Expand Down Expand Up @@ -272,13 +282,18 @@ jobs:
with:
node-version: '22'

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- name: Install agent CLI — ${{ matrix.agent }} (${{ matrix.channel }})
run: |
if [ "${{ matrix.agent }}" = "droid" ]; then
curl -fsSL https://app.factory.ai/cli | sh
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
else
npm install -g "${{ matrix.npm_pkg }}"
pnpm add --global "${{ matrix.package_spec }}"
fi

- name: Create test repository
Expand Down
21 changes: 16 additions & 5 deletions .github/workflows/opencode-type-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,15 @@ on:
branches: [main, master]
paths:
- 'agent-support/opencode/**'
- 'package.json'
- 'pnpm-lock.yaml'
- 'pnpm-workspace.yaml'
pull_request:
paths:
- 'agent-support/opencode/**'
- 'package.json'
- 'pnpm-lock.yaml'
- 'pnpm-workspace.yaml'

jobs:
type-check:
Expand All @@ -23,16 +29,21 @@ jobs:
- name: Checkout code
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: agent-support/opencode/package-lock.json
cache: 'pnpm'
cache-dependency-path: pnpm-lock.yaml

- name: Install dependencies
run: npm ci
run: pnpm install --frozen-lockfile

- name: Run type check
run: npm run type-check

run: pnpm run type-check
52 changes: 36 additions & 16 deletions .github/workflows/release-vscode-extension.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,23 +29,28 @@ jobs:
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: agent-support/vscode/package-lock.json
cache: 'pnpm'
cache-dependency-path: pnpm-lock.yaml

- name: Install dependencies
run: npm ci
run: pnpm install --frozen-lockfile

- name: Compile
run: npm run compile
run: pnpm run compile

- name: Lint
run: npm run lint
run: pnpm run lint

- name: Package extension
run: npm run package
run: pnpm run package

- name: Get version
id: version
Expand All @@ -72,14 +77,19 @@ jobs:
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: agent-support/vscode/package-lock.json
cache: 'pnpm'
cache-dependency-path: pnpm-lock.yaml

- name: Install dependencies
run: npm ci
run: pnpm install --frozen-lockfile

- name: Download extension artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand All @@ -88,7 +98,7 @@ jobs:
path: agent-support/vscode

- name: Publish to VS Code Marketplace
run: npx @vscode/vsce@3.9.1 publish --packagePath *.vsix
run: pnpm exec vsce publish --packagePath *.vsix
env:
VSCE_PAT: ${{ secrets.VSCE_PAT }}

Expand All @@ -103,14 +113,19 @@ jobs:
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: agent-support/vscode/package-lock.json
cache: 'pnpm'
cache-dependency-path: pnpm-lock.yaml

- name: Install dependencies
run: npm ci
run: pnpm install --frozen-lockfile

- name: Download extension artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand All @@ -119,7 +134,7 @@ jobs:
path: agent-support/vscode

- name: Publish to OpenVSX
run: npx ovsx@0.10.12 publish *.vsix
run: pnpm exec ovsx publish *.vsix
env:
OVSX_PAT: ${{ secrets.OVSX_PAT }}

Expand Down Expand Up @@ -150,18 +165,23 @@ jobs:
with:
token: ${{ steps.release-bot-token.outputs.token }}

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
with:
version: 11.5.2
run_install: false

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: '20'

- name: Bump patch version
run: npm version patch --no-git-tag-version
run: pnpm version patch --no-git-tag-version

- name: Commit version bump
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add package.json package-lock.json
git add package.json ../../pnpm-lock.yaml
git commit -m "chore(vscode): bump version to $(node -p "require('./package.json').version")"
git pull --rebase origin main
git push origin main
Loading
Loading