Repository navigation
Consolidate to 5 crates and 1 npm package; TypeScript 7 + oxlint; signed OIDC release pipeline - #37
Merged
Merged
Conversation
Bumps the github-actions group with 3 updates: [Swatinem/rust-cache](https://github.com/swatinem/rust-cache), [taiki-e/install-action](https://github.com/taiki-e/install-action) and [rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action). Updates `Swatinem/rust-cache` from 2.9.2 to 2.9.3 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](Swatinem/rust-cache@6323deb...d1527c8) Updates `taiki-e/install-action` from 2.87.29 to 2.87.32 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@8cca091...5488ac5) Updates `rust-lang/crates-io-auth-action` from 1.0.5 to 1.0.6 - [Release notes](https://github.com/rust-lang/crates-io-auth-action/releases) - [Commits](rust-lang/crates-io-auth-action@c6f97d4...3268eb4) --- updated-dependencies: - dependency-name: Swatinem/rust-cache dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.87.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: rust-lang/crates-io-auth-action dependency-version: 1.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps the cargo group with 3 updates: [tokio](https://github.com/tokio-rs/tokio), [rmcp](https://github.com/modelcontextprotocol/rust-sdk) and [notify](https://github.com/notify-rs/notify). Updates `tokio` from 1.53.3 to 1.54.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.3...tokio-1.54.1) Updates `rmcp` from 3.5.1 to 3.8.0 - [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml) - [Commits](modelcontextprotocol/rust-sdk@rmcp-v3.5.1...rmcp-v3.8.0) Updates `notify` from 8.2.0 to 8.2.1 - [Release notes](https://github.com/notify-rs/notify/releases) - [Changelog](https://github.com/notify-rs/notify/blob/notify-8.2.1/CHANGELOG.md) - [Commits](notify-rs/notify@notify-8.2.0...notify-8.2.1) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.54.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: rmcp dependency-version: 3.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: notify dependency-version: 8.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo ... Signed-off-by: dependabot[bot] <[email protected]>
…-actions-b5a5127023' into updates
…AGENTS.md - AGENTS.md: normalized against Deslop, SharpLsp, DataProvider and osprey; adds TypeScript 7 and C#/F# rules; CLAUDE.md now imports it correctly. - Both TS packages on typescript@^7. ESLint/typescript-eslint (no TS 7 support) replaced by one shared packages/.oxlintrc.json: every category at error, each disabled rule documented. - lspkit-debug is now linted and tested by make lint / make test and CI. - dotnet: AnalysisLevel latest-all, F# warnings 1182/3390; CA2000 and CA1031 fixed; every project builds in make lint. - Lint fixes in progress (UI tests done, remaining files underway).
…ows, npm publish script
…istry bootstrap script, release setup doc - supply-chain.yml: zizmor (pedantic, medium) job; osv-scanner covers both npm lockfiles - release.yml: npm audit gate; npm provenance via NPM_CONFIG_PROVENANCE - scripts/bootstrap-registries.sh: one-time first publish of the 4 unpublished packages from a clean HEAD export - docs/release-setup.md: the manual registry + GitHub settings checklist - [PROF-WIRE-PACKAGED] spec heading for the packaged lsp-profiler build Co-Authored-By: Claude Opus 5.5 <[email protected]>
- lsp-profiler-ui and lspkit-debug: hand-fixed oxlint violations (334 -> 54 in UI, 6 -> 1 in debug); tsc clean, tests and counts unchanged. - lspkit-debug: pollUntilResult/waitForCondition take one options object; assertLocalVariable, assertWatch and evaluate take spec objects. - Consumed lsp-profiler-ui API (every symbol SharpLsp and osprey import) verified unchanged against HEAD declarations. - .oxlintrc.json: enums exempt from no-magic-numbers, class-methods-use-this skips interface implementations, require-post-message-target-origin off (VS Code postMessage has no targetOrigin), src/testing shares the test override. - Skills rewritten as bullet steps; submit-pr loops until CI is green.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
…nsumer API - Split oversized modules (max-dependencies, max-classes-per-file) into sibling files; originals re-export what SharpLsp and osprey deep-import. - Interface methods -> property signatures, polling loops -> recursive helpers, file log sink on createWriteStream, http listen via events.once, ProcessTreeItem takes an options object. - Consumer API (every symbol SharpLsp and osprey import) checked against HEAD declarations: unchanged. removeTestDir stays synchronous for osprey. - Residual errors, each a sync API consumers rely on or a 4-arg export: removeTestDir, flamegraph-artifact, sampled-view, editor-path-key (no-sync); colorForRank (max-params); PROFILER_REVIEW_HTML seam (no-process-env).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- lspkit (L0) absorbs config, vfs, sidecar, and treesitter (behind a feature) as modules - lspkit-server (L1) absorbs live and mcp (behind a feature) as modules - lsp-profiler-helper becomes a [[bin]] of the parked lsp-profiler-python - release.yml [REL-ORDER] publishes lsp-profiler, lsp-profiler-dotnet, lspkit, lspkit-server - The coverage gate accepts <crate>::<module> keys, so each absorbed crate keeps its floor - Spec gains [CRATE-LAYOUT*] and [CRATE-RETIRE]; README, release docs and plans updated Co-Authored-By: Claude Opus 5.5 <[email protected]>
…refuses non-UTF-8 names Co-Authored-By: Claude Opus 5.5 <[email protected]>
…c/debug One npm package instead of two: the DAP glue and test harness now live at out/src/debug and out/src/debug/testing. No consumer imported lspkit-debug, and every existing lsp-profiler-ui path is unchanged. CI, release, Dependabot, OSV and the bootstrap script now handle the one package.
…lspkit-debug into lsp-profiler-ui
Sync fs reads (realpath, SVG, speedscope, test-dir removal) are now async and
awaited at every caller; decoration passes prefetch path keys through one
shared rowAndEditorKeyer/groupByFile. The PROFILER_REVIEW_HTML env read is
replaced by registerCpuCaptureContract(capture, { reviewHtmlPath }).
Plan: tick the oxlint residuals item.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+56
to
+91
| - name: Clobber-merge the bump and retire the PR | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| PR_HEAD: ${{ github.event.pull_request.head.ref }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| set -euo pipefail | ||
| # Push through gh's credential helper; the token never lands in .git/config. | ||
| gh auth setup-git | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
| # Pull the bump branch into a stable local ref we can re-merge. | ||
| git fetch origin "+refs/heads/${PR_HEAD}:refs/remotes/origin/${PR_HEAD}" | ||
| # Re-merge onto the LIVE staging tip and retry: concurrent Dependabot | ||
| # PRs race to push here, so each run rebases on whatever already landed | ||
| # and the incoming branch always wins conflicts (-X theirs). | ||
| for attempt in 1 2 3 4 5; do | ||
| git fetch origin "+refs/heads/dependabot-upgrades:refs/remotes/origin/dependabot-upgrades" | ||
| git reset --hard "origin/dependabot-upgrades" | ||
| git merge -X theirs --no-edit "origin/${PR_HEAD}" \ | ||
| -m "build(deps): clobber-merge ${PR_HEAD} into dependabot-upgrades" | ||
| if git push origin "HEAD:dependabot-upgrades"; then | ||
| break | ||
| fi | ||
| if [ "$attempt" = "5" ]; then | ||
| echo "::error::could not push to dependabot-upgrades after 5 attempts" | ||
| exit 1 | ||
| fi | ||
| sleep 5 | ||
| done | ||
| # Retire the PR + its branch: the bump is already staged, so the PR | ||
| # (whether it targeted main or the staging branch) has served its | ||
| # purpose. `|| true` — GitHub may have auto-closed it on the push. | ||
| gh pr close "$PR_URL" --delete-branch \ | ||
| --comment "Swept into \`dependabot-upgrades\` (latest bump clobbers previous)." \ | ||
| || git push origin --delete "$PR_HEAD" || true |
…A-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249 Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
…ttaches Trusted Publishers via the crates.io API
…es the absorbed crates
…ing as configured
MelbourneDeveloper
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Consolidates 12 crates into 5 (4 published) and 2 npm packages into 1, moves TypeScript to 7 + oxlint, and replaces the release workflow with a signed, OIDC-only crates.io + npm + GitHub Release pipeline.
Details
Crates ([CRATE-LAYOUT-MODULES])
lspkit-config,lspkit-sidecar,lspkit-treesitter,lspkit-vfs→ modules oflspkit(src/config,src/sidecar,src/treesitter,src/vfs).lspkit-live,lspkit-mcp→ modules oflspkit-server(src/live,src/mcp).lsp-profiler-helper→lsp-profiler-python(publish = false), binary atsrc/bin/lsp-profiler-helper.lsp-profiler,lsp-profiler-dotnet,lspkit,lspkit-server.npm
@nimblesite/lspkit-debugfolded into@nimblesite/lsp-profiler-uiatsrc/debugandsrc/debug/testing; old package deleted. Noexportsmap, so consumer deep imports (out/src/...) keep resolving.lsp-profiler-uisplit into small single-purpose modules (memory-capture-*,process-*,profiler-*,bind-host,file-log-sink, …) to meet the 500-line/20-line limits.^7.0.2; ESLint removed;oxlint --type-aware --deny-warningswith one sharedpackages/.oxlintrc.json.0.0.0-dev;glob/minimatchoverrides lifted past GHSA-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249.Workflows
ci.yml: PRs tomainonly (no push trigger), skips Dependabot PRs ([REL-REGIME]).release.yml: CodeQL gate → package crates + npm → SBOM (CycloneDX) → cosign-signedSHA256SUMS→ provenance + SBOM attestations → OIDC publish → GitHub Release. Release-scoped concurrency, no cancellation.codeql.yml(Rust, TS, C#, actions; reusable as the release gate) anddependabot-automerge.yml(sweeps all Dependabot PRs intodependabot-upgrades, 7-day cooldown independabot.yml).scripts/bootstrap-crates.sh,bootstrap-npm.sh,bootstrap-common.sh,npm-publish-or-skip.shfor first publish + Trusted Publisher setup..NET
AnalysisLevelraised tolatest-all; F# warnings 1182 and 3390 on.make lintnow builds every .NET project.RequestPumpnarrows catches (fatal runtime exceptions propagate);SourceLocator.Openno longer leaks the PDB provider on failure.Makefile
_coverage_checkaccepts<crate>::<module>keys, so each absorbed crate keeps its old coverage floor incoverage-thresholds.json.make testruns the debug-module mocha suite under c8.Website — new Eleventy 3 site under
website/(make website-build/website-run), design spec indocs/specs/website-design-system.md.How Do The Automated Tests Prove It Works?
crates/lspkit/tests/vfs_*.rs,sidecar_*.rs,treesitter_*.rs,config_loader.rs;crates/lspkit-server/tests/live_*.rs,mcp_*.rs. All 478 nextest tests pass.lspkit::config100%,lspkit::vfs100%,lspkit-server::mcp100%,lspkit::sidecar99%,lspkit::treesitter95%,lspkit-server::live94% (Linux CI).scripts/coverage-gate.test.mjscovers the new::key parsing.src/debug/test/*.test.ts(adapter-resolution, dap-client, dap-messages, launch-config, launch-lifecycle, poll, profiling, ui-stubs, vscode-harness, assertions): 107 tests vianpm run test:debug, c8 thresholds enforced by.c8rc.json.src/test/suite/*(process-explorer, memory-leak-offer, flame-model, profile-server, editor-path-key, …): 190 extension-host tests drive the UI throughvscode.commands.executeCommand.dotnet test dotnet/LspProfiler.DotNet.Engine.Testsplus thelsp-profiler-dotnetC#/F# e2e suites (dotnet_fsharp_e2e,dotnet_held_e2e) cover the engine changes.make lint(clippy, oxlint, .NETlatest-all, profiler spec-ID check) is clean.Spec / doc changes
docs/specs/lspkit-spec.md: crate layout, [REL-ORDER] (4 crates, then 1 npm package), [REL-REGIME], Dependabot/CodeQL sections.docs/specs/LSP-PROFILER-SPEC.md: updated crate paths.docs/release-setup.md(one-time steps),docs/plans/crate-consolidation-plan.md,docs/plans/website-plan.md,docs/reports/crate-size-survey.md,docs/specs/website-design-system.md.Breaking changes
lspkit-config,lspkit-live,lspkit-mcp,lspkit-sidecar,lspkit-vfs,lspkit-treesitterno longer exist; importlspkit::{config,sidecar,treesitter,vfs}andlspkit_server::{live,mcp}. Their 0.0.1 releases on crates.io should be yanked (docs/release-setup.mdstep 3).@nimblesite/lspkit-debugis gone; use@nimblesite/lsp-profiler-ui/out/src/debugand.../out/src/debug/testing.lsp-profiler-helperis now built fromlsp-profiler-python.🤖 Generated with Claude Code