Repository navigation
Update GitHub Actions - #115
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
added
dependencies
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
🔦 Lighthouse audit
Run |
lwwmanning
added a commit
that referenced
this pull request
Oct 28, 2026
main's GitHub Actions update (#115) moved the other workflows to v7.1.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io>
lwwmanning
added a commit
that referenced
this pull request
Oct 28, 2026
* Squashed 'bench/' content from commit 827dc55 The develop tree of vortex-data/benchmarks-website at 827dc55, unmodified. Its 39-commit history stays in that repository, which is archived with a pointer here after the cutover. git-subtree-dir: bench git-subtree-split: 827dc55fa492d5861cef30667b045aad4523d6a3 Signed-off-by: Will Manning <will@willmanning.io> * Give bench its own PostCSS config Next.js looks for a PostCSS config in the app directory and every parent, so inside this repository bench/web picked up the marketing site's Tailwind config at the root and failed with "Cannot find module '@tailwindcss/postcss'". The new config reproduces the plugins Next.js applies when it finds no config. A build with it produces byte-identical CSS to a build with no config at all. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Patch bench's runtime advisories and add a pnpm cooldown bench pinned next 15.5.19, which has critical and high advisories, and dependency-review would block this import on them. Move next and eslint-config-next to 15.5.27, the newest 15.5 release past the 14-day cooldown. It fixes GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4 and the 15.5.21 advisories. Two remain until 15.5.28 clears the cooldown on 2026-10-28 at 17:36 UTC: GHSA-2464-fhr4-w9xw (critical, image optimizer) and GHSA-p3m5-59mp-jv5r (high). bench doesn't use next/image, and Vercel serves /_next/image itself. Override next's exact postcss pin to the patched 8.5 line, and force sharp onto 0.35.5, which next's own range already accepts. Add pnpm's minimumReleaseAge (14 days), matching the Bun and Renovate cooldowns at the root. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Skip marketing-site CI on bench-only changes Add a changed-paths action that reports whether a push or pull request touches the marketing site, bench, or both. ci.yml gates its build and audit jobs on it with `if:` rather than an `on.paths` filter, because "Lint, build, verify" is a required check: a skipped job reports success, while a workflow that never starts leaves the check pending and blocks the merge. Dependency review, the secret scan and REUSE still run on every change. Lighthouse isn't required, so a plain paths-ignore filter is enough there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Move bench's workflows into .github/workflows Rename them with a bench- prefix and adapt them to this repository: - Trigger on main instead of develop. bench-ci gates its job with the changed-paths action, so it can become a required check; bench-deploy filters on bench/**. - Pin every action by SHA and run on ubuntu-24.04. setup-uv comes from astral-sh directly rather than through a wrapper action, and configure-aws-credentials moves to v6.3.0, the pin the vortex monorepo uses for the same AWS account. - Install the Vercel CLI (64.0.2) from bench/vercel-cli's lockfile instead of `npm install -g vercel@latest`, so the job holding VERCEL_TOKEN never resolves a freshly published package. - Read VERCEL_TOKEN from the bench-preview or bench-production environment. The environment replaces the hand-rolled GitHub Deployment calls, and bench-production can be limited to main. The deploy job stays off until BENCH_VERCEL_PROJECT_ID is set. - Post the preview URL with the sticky-comment action under its own header. `gh pr comment --edit-last` would overwrite the Lighthouse comment, which the same bot posts. - Use the root .nvmrc for Node and drop persisted checkout credentials. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Cover bench's config files and logos in REUSE.toml bench's source files carry SPDX headers, but its JSON, YAML and .gitignore files can't, and its four logo files had no annotation. Map the config to Apache-2.0, and add the logos and icons to the Vortex brand assets, which are CC-BY-4.0 with the trademark note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Keep the root's TypeScript and Biome checks off bench/ The root tsconfig includes **/*.ts and Biome includes **, so both would check bench's code under the marketing site's rules. With bench/ in scope, `tsc --noEmit` reports 268 errors from bench's files. bench keeps its own tsconfig, ESLint and Prettier until it moves to Biome. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Skip marketing-site builds for bench-only commits Set the `vortex` project's Ignored Build Step in vercel.json. It skips the build when nothing outside bench/ and the bench workflows changed since the branch's last successful deployment. With nothing to compare against, it builds. bench deploys to its own Vercel project from GitHub Actions, so rebuilding the marketing site for its commits only republishes the same site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Document bench and keep its Renovate updates manual CLAUDE.md now describes the two-app layout, bench's pnpm equivalents of the supply-chain layers, and its advisories at import. Renovate gives bench's updates their own branches and doesn't automerge them. Platform automerge waits only for required checks, and bench CI isn't one yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Point bench's OIDC trust, footer link and docs at vortex.dev - provision.sh takes a branch for each role. The schema role now trusts vortex-data/vortex.dev on main; the ingest role still trusts vortex-data/vortex on develop. The trust test pins both. AWS changes only when someone applies the rendered policy, as a cutover step. - The build-SHA footer linked to commits in benchmarks-website. Deploys now build from vortex.dev commits, so it links there. - Docs: workflow file names, main as the production branch, where the Vercel variables and token live, and a note on the setup runbook that it describes the standalone repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * License bench's Markdown as CC-BY-4.0 Section 7.b.iv of the Vortex Technical Charter receives and licenses all documentation under CC-BY-4.0, but bench's 13 Markdown files carried Apache-2.0 SPDX headers from the standalone repository. A file's own header wins over REUSE.toml, so correct the headers themselves. Code keeps Apache-2.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Patch bench's dev-dependency advisories Dependency review reads pnpm lockfiles without telling dev dependencies from runtime ones, so the high advisories in bench's test and lint tooling block this PR too. Refresh @grpc/grpc-js, brace-expansion, js-yaml and source-map-js within their parents' ranges, all to releases past the 14-day cooldown. vite needs a direct devDependency (^8.3.4). It is vitest's peer, and pnpm kept the vulnerable locked 8.0.16 even with an override in place. undici 7.30.1 is the one dev fix left; it clears the cooldown on 2026-10-29 at 14:18 UTC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Install bench's Vercel CLI by exact version, without a lockfile Dependency review flagged 13 packages in the CLI's lockfile, among them a critical in tar. The CLI and its framework builders pin those versions exactly, and patching undici alone would mean a 5 to 6 major inside the CLI's HTTP client. A committed lockfile would leave every bench PR red on advisories that nothing in this repository can fix. Install it with `npm install -g vercel@<exact>`, never `@latest`, and set `--before` to 14 days ago so its whole tree gets the cooldown. A Renovate custom manager bumps VERCEL_CLI_VERSION through its `# renovate:` comment, and the bench rule now also covers the bench workflows, so a CLI bump is not automerged before a deploy has exercised it. CLAUDE.md records the accepted advisories and how to re-audit them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Point bench's setup runbook at the tracking issue The cutover steps moved from the import PR's description to #113. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Potential fix for pull request finding 'CodeQL / Improper code sanitization' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Will Manning <will@willmanning.io> * Load bench's heading font from a constant inline script CodeQL flagged js/bad-code-sanitization because the font loader built its inline script by interpolating a value. The Copilot fix escaped that value, but its helper doubles every backslash after JSON.stringify. That breaks the escapes JSON.stringify adds, so a value containing a quote would end the string early. Here the value is a constant URL, so nothing was exploitable. Write the URL into the script instead, so the script is a constant and nothing needs sanitizing. The emitted script is byte-identical to the one before the Copilot fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Pin bench workflows to setup-node v7.1.0 main's GitHub Actions update (#115) moved the other workflows to v7.1.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Run bench CI when .nvmrc changes Both bench workflows read the Node version from .nvmrc. The changed-paths action counted a change to it as site-only, so a Node bump could merge without running bench's build and tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Correct two stale bench comments summary.ts still said the compression-size query used a JSON field lookup that tolerates databases from before migration 009. bench #29 replaced that lookup with a plain column read because it timed out in production, so the query now requires migration 009. The web README said the deploy workflow probes CDN caching after each deploy. No workflow has ever done that, so the README now describes the manual check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> * Move bench to next 15.5.28 and undici 7.30.1 next 15.5.28 fixes GHSA-2464-fhr4-w9xw (critical) and GHSA-p3m5-59mp-jv5r, the last advisories that dependency review flags. undici 7.30.1 fixes the remaining dev-only advisories. Both are inside the 14-day cooldown, so pnpm-workspace.yaml exempts exactly these versions, as approved on 2026-10-28. Remove the exemptions after 2026-10-29 14:18 UTC, when both are past the window. pnpm audit for bench/web now reports no high or critical advisories. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io> --------- Signed-off-by: Will Manning <will@willmanning.io> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v7.0.0→v7.1.0v7.0.1→v7.0.2v1.0.241→v1.0.249v1.0.264(+14)1.4.2→1.4.31.4.4v4.38.2→v4.38.3v4.39.1(+1)v2.4.4→v2.5.0v3.97.9→v3.99.2v3.99.7(+4)Release Notes
actions/setup-node
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v7.0.0...v7.1.0
actions/upload-artifact
v7.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2
anthropics/claude-code-action
v1.0.249Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.248...v1.0.249
v1.0.248Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.247...v1.0.248
v1.0.247Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.246...v1.0.247
v1.0.246Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.245...v1.0.246
v1.0.245Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.244...v1.0.245
v1.0.244Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.243...v1.0.244
v1.0.243Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.242...v1.0.243
v1.0.242Compare Source
Full Changelog: anthropics/claude-code-action@v1.0.241...v1.0.242
oven-sh/bun (bun)
v1.4.3: Bun v1.4.3Compare Source
To install Bun v1.4.3
Windows:
powershell -c "irm bun.sh/install.ps1|iex"To upgrade to Bun v1.4.3:
Read Bun v1.4.3's release notes on Bun's blog
Thanks to 8 contributors!
github/codeql-action
v4.38.3Compare Source
ossf/scorecard-action
v2.5.0Compare Source
What's Changed
This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.
For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.
@justaugustus in #1716
cmd/installer) now creates.github/workflows/scorecard.yml, and stillrecognizes existing
scorecards.ymlandscorecards-analysis.ymlworkflows. by @justaugustus in #1716with. by @justaugustus in #1718
@arpitjain099 in #1709
results_formatacceptsintoto, which wraps the JSON results in an in-toto attestationstatement. by @puerco in #1702
Other
RELEASE.md by @justaugustus in #1716
New Contributors
Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0
trufflesecurity/trufflehog
v3.99.2Compare Source
What's Changed
Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2
v3.99.1Compare Source
What's Changed
Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1
v3.99.0Compare Source
What's Changed
Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0
v3.98.1Compare Source
What's Changed
New Contributors
Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1
v3.98.0Compare Source
What's Changed
3142cc9by @renovate[bot] in #5280New Contributors
Full Changelog: trufflesecurity/trufflehog@v3.97.9...v3.98.0
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.