From 5030ae36eb0b162bca0eade97f1a714c494653aa Mon Sep 17 00:00:00 2001 From: its-mash Date: Wed, 15 Jul 2026 03:12:50 +0200 Subject: [PATCH 1/4] chore: add id-token write permission for codecov OIDC authentication --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d3320f81..1ad69394 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,7 @@ permissions: actions: read checks: write pull-requests: write + id-token: write env: CARGO_TERM_COLOR: always From c6cde01369e691d95d7da2b6266c9f937d29575a Mon Sep 17 00:00:00 2001 From: its-mash Date: Wed, 15 Jul 2026 03:06:28 +0200 Subject: [PATCH 2/4] chore: add Claude Code GitHub Actions workflows --- .github/workflows/claude-code-review.yml | 44 +++++++++++++++++++++ .github/workflows/claude.yml | 50 ++++++++++++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 .github/workflows/claude-code-review.yml create mode 100644 .github/workflows/claude.yml diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml new file mode 100644 index 00000000..b5e8cfd4 --- /dev/null +++ b/.github/workflows/claude-code-review.yml @@ -0,0 +1,44 @@ +name: Claude Code Review + +on: + pull_request: + types: [opened, synchronize, ready_for_review, reopened] + # Optional: Only run on specific file changes + # paths: + # - "src/**/*.ts" + # - "src/**/*.tsx" + # - "src/**/*.js" + # - "src/**/*.jsx" + +jobs: + claude-review: + # Optional: Filter by PR author + # if: | + # github.event.pull_request.user.login == 'external-contributor' || + # github.event.pull_request.user.login == 'new-developer' || + # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' + + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + issues: read + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Run Claude Code Review + id: claude-review + uses: anthropics/claude-code-action@v1 + with: + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' + plugins: 'code-review@claude-code-plugins' + prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' + # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md + # or https://code.claude.com/docs/en/cli-reference for available options + diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml new file mode 100644 index 00000000..6b15fac7 --- /dev/null +++ b/.github/workflows/claude.yml @@ -0,0 +1,50 @@ +name: Claude Code + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + issues: + types: [opened, assigned] + pull_request_review: + types: [submitted] + +jobs: + claude: + if: | + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + issues: read + id-token: write + actions: read # Required for Claude to read CI results on PRs + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Run Claude Code + id: claude + uses: anthropics/claude-code-action@v1 + with: + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + + # This is an optional setting that allows Claude to read CI results on PRs + additional_permissions: | + actions: read + + # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it. + # prompt: 'Update the pull request description to include a summary of changes.' + + # Optional: Add claude_args to customize behavior and configuration + # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md + # or https://code.claude.com/docs/en/cli-reference for available options + # claude_args: '--allowed-tools Bash(gh pr *)' + From baa44c991d34909e82a4f19da8660c4ac137c7b6 Mon Sep 17 00:00:00 2001 From: Mohammod Al Amin Ashik Date: Wed, 15 Jul 2026 09:59:19 +0800 Subject: [PATCH 3/4] chore(ci): pin apt-cache action and rotate cache key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `@latest` is a moving tag, so a broken upstream release rolls into CI unreviewed — v1.6.2 shipped broken and was superseded three days later. Pin to v1.6.3 by SHA. Bump the cache `version` to rotate the key: a 6 KB entry had been saved under the old one, which the action restored as a hit and then skipped installing libglib2.0-dev, failing rust-check and ts-check on every branch. --- .github/actions/install-linux-deps/action.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/actions/install-linux-deps/action.yml b/.github/actions/install-linux-deps/action.yml index 10ced8fe..3ad6ede3 100644 --- a/.github/actions/install-linux-deps/action.yml +++ b/.github/actions/install-linux-deps/action.yml @@ -13,18 +13,20 @@ runs: using: composite steps: # Cache apt packages to avoid re-downloading on every run + # Pinned to a SHA: `@latest` is a moving tag, so a broken upstream release + # (e.g. v1.6.2) would otherwise roll straight into CI unreviewed. - name: Cache apt packages (base) - uses: awalsh128/cache-apt-pkgs-action@latest + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: build-essential pkg-config libglib2.0-dev libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libsecret-1-dev libfuse2 - version: 1.1 + version: 1.2 - name: Cache apt packages (E2E) if: ${{ inputs.e2e == 'true' }} - uses: awalsh128/cache-apt-pkgs-action@latest + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: webkit2gtk-driver xvfb gnome-keyring gsettings-desktop-schemas dbus-x11 at-spi2-core libglib2.0-bin libwayland-server0 libwayland-client0 - version: 1.3 + version: 1.4 # Compile gsettings schemas (required after restore from cache) - name: Compile gsettings schemas From 457d2dbbb6f65f76ee24a5a6cd14cbd45bb9778d Mon Sep 17 00:00:00 2001 From: Mohammod Al Amin Ashik Date: Wed, 15 Jul 2026 10:07:06 +0800 Subject: [PATCH 4/4] fix(ci): refresh apt lists before installing Linux deps The runner image ships an apt index from its build date (2026-06-24), and cache-apt-pkgs-action's update_apt_lists_if_stale only runs under nektos/act -- it guards on ACT=true, so on real runners it is a no-op. Its premise ("GitHub Actions runners have fresh package lists") does not hold. Ubuntu published pipewire 1.0.5-1ubuntu3.3 and removed 3.2 from the pool, so apt resolved a .deb that 404s. The action runs apt-fast install without checking its exit code, so the failure was swallowed: it cached 0 packages as a 6 KB entry, which every later run restored as a hit and then skipped the install entirely -- leaving libglib2.0-dev absent and failing rust-check and ts-check on every branch, including main. Refreshing the index first makes apt resolve debs that actually exist. --- .github/actions/install-linux-deps/action.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/actions/install-linux-deps/action.yml b/.github/actions/install-linux-deps/action.yml index 3ad6ede3..420f3a8d 100644 --- a/.github/actions/install-linux-deps/action.yml +++ b/.github/actions/install-linux-deps/action.yml @@ -13,6 +13,16 @@ runs: using: composite steps: # Cache apt packages to avoid re-downloading on every run + # The runner image ships an apt index from its build date, and + # cache-apt-pkgs-action's own refresh (update_apt_lists_if_stale) is a + # no-op outside nektos/act -- it guards on ACT=true. A stale index names + # .debs that Ubuntu has since superseded and dropped from the pool, so the + # install 404s; the action then caches the empty result instead of failing, + # and every later run restores that as a hit and skips installing at all. + - name: Refresh apt lists + shell: bash + run: sudo apt-get update + # Pinned to a SHA: `@latest` is a moving tag, so a broken upstream release # (e.g. v1.6.2) would otherwise roll straight into CI unreviewed. - name: Cache apt packages (base)