Repository navigation
chore(deps): cli-core 0.651.0, cli-base 0.99.0, family audit through cli-dev - #156
Merged
Merged
Conversation
…cli-dev - Pin @wirecat/cli-core 0.651.0 and @wirecat/cli-base 0.99.0, so a CLI made from the template starts on them. cli-testing stays on 0.7.0. - Refresh contracts/help.snap: cli-core 0.651.0 lists pbx on the first screen. mcp-tools.json and mcp-catalogue.json are unchanged. - audit:commands and CI run `cli-dev audit --family --cli dist/bin/clidev.js` inside scripts/sandboxed.ts in place of scripts/audit.sh. template.json no longer keeps scripts/audit.sh in step; the file waits in CLEANUP.md. - config/parity-groups.json: one dated difference (review_after 2026-11-27), same-error-reason meeting-project.stale. cli-core 0.651.0 makes it conflict, while the published CLIs still give configuration_error. None of cli-base 0.99.0's 11 shared rows name clidev, so none is copied. - Move every cli-base reusable workflow pin to v0.99.0 (release-checks and release-start were on v0.85.1; their workflow_call inputs are unchanged). Covers Dependabot #154. - Changelog fragment changes/chore-round-2026-11-13.md. Rules: WC-CI-7 (cancel setting left as is), WC-TEST-14. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…e by commit - CI runs `pnpm exec cli-dev audit --family --cli dist/bin/clidev.js --differences lint/audit-differences.json`, the line mail, gcal and beeline use, so the next template upgrade in each CLI takes it without asking. audit:commands runs the same inside scripts/sandboxed.ts. - Delete scripts/audit.sh: nothing calls it any more. - lint/audit-differences.json starts empty, so a new CLI gets a valid file whatever parity groups it joins. The template's own meeting-project.stale row stays in config/parity-groups.json, which new CLIs do not get, so no dated row reaches them. - The v0.99.0 pins named the annotated tag object (7018773), which Actions cannot resolve; they now name its commit (32ebca3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task
Round 2 (2026-11-13): adopt cli-core 0.651.0 and cli-base 0.99.0 in the template, so new CLIs start on them, and
move the family audit onto cli-base's
cli-dev audit --family(IDEA-294, IDEA-288 pins). Plan:fix-plan.mdof theround, in cli-private's review reports.
Why
same-entity-schemaandsame-error-reasonfail the family audit, and shipscli-dev audit --family, which replaces each CLI's copy ofscripts/audit.sh.What
@wirecat/cli-core0.651.0,@wirecat/cli-base0.99.0;@wirecat/cli-testingalready 0.7.0.contracts/help.snap: the first screen listspbx(cli-core 0.651.0).mcp-tools.jsonand themcp-catalogue.json(ownCatalogue) pin need no change.checkscallpnpm exec cli-dev audit --family --cli dist/bin/clidev.js --differences lint/audit-differences.json, andaudit:commandsruns the same insidescripts/sandboxed.ts.scripts/audit.shand itstemplate.jsonentry aregone.
lint/audit-differences.jsonstarts empty, so a new CLI gets a valid file whatever parity groups it joins.config/parity-groups.json: one dated difference,same-error-reason reason meeting-project.stale: code,review_after2026-11-27. cli-core 0.651.0 makes that reasonconflict; the published CLIs still giveconfiguration_error. None of cli-base 0.99.0's 11 shared rows nameclidev(the template's groups have no b24 orgcal, and the messenger rows do not reach it), so none is copied. The row lives in
config/parity-groups.json, notin
lint/audit-differences.json, because new CLIs do not get that file and so get no dated row.32ebca3.release-checks.ymlandrelease-start.ymlwere on v0.85.1; theirworkflow_callinputs are the same at both tags. Covers Dependabot build(deps): bump the actions group with 2 updates #154.main.ymlandstandards.ymlstays as it is (family-wide, WC-CI-7).contracts/wirecat.jsonin the template, so no shared host to drop; noschedule run/execMCP exclusionexists (NEED-2604 A holds already).
changes/chore-round-2026-11-13.md.Testing
Local, in this order:
standards:check,lint,typecheck,test:coverage(169 passed),test:matrix:check,docs:check,generate:check,contracts:check,version:check,security:no-leak,package:check,peers check,kit:e2e, andaudit:commands(audit: 7 CLIs, 248 findings, 0 new that block). Before the parityrow, the family audit failed on the one
meeting-project.stalefinding.🤖 Generated with Claude Code