chore(dev): release 5.3.1-beta.3 - #122
Open
dcd-cli-release-please[bot] wants to merge 2 commits into
Open
Conversation
finalerock44
added a commit
that referenced
this pull request
Aug 18, 2026
`lint-and-test` has failed on every same-repo PR since dcd#1036 deleted `mock-api/` from the private devicecloud-dev/dcd repo this morning. CI checked that directory out over an SSH deploy key and ran `pnpm install` in it; the sparse-checkout now matches nothing, so the job dies at that step — before the linter — and takes #120, #122 and #123 down with it. Rather than re-point at a mock, this removes the linkage. dcd-cli is PUBLIC and was holding `DCD_SSH_DEPLOY_KEY`, a credential granting read access to the private repo, and pulling the API's `swagger.json` onto the runner on every same-repo PR. Deleting the checkout drops both. * The `Checkout dcd (mock-api)` and `Install Mock API dependencies` steps are gone, along with the `HAS_PRIVATE_ACCESS` gate that existed only to keep them off fork and Dependabot PRs. Every PR now takes the same path, so forks stop being second-class. * CI runs `pnpm test:unit` — a new script that is the existing runner with `--unit`. `test/unit/*` is pure and needs no backend, so unit coverage is kept rather than dropped along with the integration suite. * `scripts/test-runner.mjs` no longer defaults `MOCK_API_DIR` to `../../dcd/mock-api`. With no mock available it degrades to the unit suite and says so, instead of the bare ENOENT it throws today. Set `MOCK_API_DIR` and the integration specs run exactly as before. `DCD_SSH_DEPLOY_KEY` can now be deleted from the repo's secrets — nothing reads it. That is a separate manual step, not something this commit can do. Two things are genuinely lost, both worth stating plainly rather than discovering later: * `test/integration/*` no longer runs anywhere automatically. * With it goes the CLI<->swagger contract-drift check. Drift used to surface as a Prism 422 — that is how the `googlePlay` multipart break and the `tempPath` missing-example break were both caught. Nothing replaces it yet. Verified locally: `pnpm test:unit` and a bare `pnpm test` both run the unit suite only and print the notice; 81 pass and the 7 `flow-paths` failures are Windows-only, asserting POSIX paths against win32 `path`. The same specs ran green on ubuntu in the last full CI run (job 94750122384, 2026-08-14), which is the platform CI uses. `pnpm lint`, `pnpm typecheck`, `pnpm build` and `pnpm audit --audit-level moderate` are all clean.
14 tasks
finalerock44
added a commit
that referenced
this pull request
Aug 18, 2026
* chore: promote the grouped deps bump into 5.3.1 Promote from dev to stable, picking up the one change that landed after the 5.3.1 promotion (#119) and so missed the pending release PR (#120): * deps: bump the minor-and-patch group with 6 updates (#121) — @supabase/supabase-js 2.112.2 -> 2.112.3, js-yaml 5.2.3 -> 5.3.0, @types/node 26.1.2 -> 26.2.0, eslint 10.8.0 -> 10.8.1, tsx 4.23.11 -> 4.23.12, typescript-eslint 8.66.0 -> 8.67.0. Carries only `pnpm-lock.yaml`. Dependabot left `package.json` untouched — every range already admitted the new versions — so this changes nothing for npm consumers, who resolve from those ranges. It matters only for the bun-compiled standalone binaries, which bake in the locked versions. `Release-As: 5.3.1` keeps the pending release PR (#120) on 5.3.1 rather than rolling it to 5.3.2. Release-please regenerates the 5.3.1 section from this commit's bullet alongside #119's three, so the changelog ends up carrying all four entries. Verified locally, because CI cannot check this branch: `pnpm install --frozen-lockfile` (the lockfile agrees with production's package.json), `pnpm lint` (0 errors, the same 32 pre-existing warnings — the eslint 10.8.1 and typescript-eslint 8.67.0 bumps add no findings), `pnpm typecheck`, `pnpm build`, and `pnpm audit --audit-level moderate` (no known vulnerabilities). The integration tests did NOT run: dcd#1036 deleted `mock-api/`, which is also what fails CI's `lint-and-test`, at a step that runs before the linter. Release-As: 5.3.1 * ci: stop reaching into the private dcd repo for the mock-api `lint-and-test` has failed on every same-repo PR since dcd#1036 deleted `mock-api/` from the private devicecloud-dev/dcd repo this morning. CI checked that directory out over an SSH deploy key and ran `pnpm install` in it; the sparse-checkout now matches nothing, so the job dies at that step — before the linter — and takes #120, #122 and #123 down with it. Rather than re-point at a mock, this removes the linkage. dcd-cli is PUBLIC and was holding `DCD_SSH_DEPLOY_KEY`, a credential granting read access to the private repo, and pulling the API's `swagger.json` onto the runner on every same-repo PR. Deleting the checkout drops both. * The `Checkout dcd (mock-api)` and `Install Mock API dependencies` steps are gone, along with the `HAS_PRIVATE_ACCESS` gate that existed only to keep them off fork and Dependabot PRs. Every PR now takes the same path, so forks stop being second-class. * CI runs `pnpm test:unit` — a new script that is the existing runner with `--unit`. `test/unit/*` is pure and needs no backend, so unit coverage is kept rather than dropped along with the integration suite. * `scripts/test-runner.mjs` no longer defaults `MOCK_API_DIR` to `../../dcd/mock-api`. With no mock available it degrades to the unit suite and says so, instead of the bare ENOENT it throws today. Set `MOCK_API_DIR` and the integration specs run exactly as before. `DCD_SSH_DEPLOY_KEY` can now be deleted from the repo's secrets — nothing reads it. That is a separate manual step, not something this commit can do. Two things are genuinely lost, both worth stating plainly rather than discovering later: * `test/integration/*` no longer runs anywhere automatically. * With it goes the CLI<->swagger contract-drift check. Drift used to surface as a Prism 422 — that is how the `googlePlay` multipart break and the `tempPath` missing-example break were both caught. Nothing replaces it yet. Verified locally: `pnpm test:unit` and a bare `pnpm test` both run the unit suite only and print the notice; 81 pass and the 7 `flow-paths` failures are Windows-only, asserting POSIX paths against win32 `path`. The same specs ran green on ubuntu in the last full CI run (job 94750122384, 2026-08-14), which is the platform CI uses. `pnpm lint`, `pnpm typecheck`, `pnpm build` and `pnpm audit --audit-level moderate` are all clean.
finalerock44
added a commit
that referenced
this pull request
Aug 18, 2026
* ci: stop reaching into the private dcd repo for the mock-api `lint-and-test` has failed on every same-repo PR since dcd#1036 deleted `mock-api/` from the private devicecloud-dev/dcd repo this morning. CI checked that directory out over an SSH deploy key and ran `pnpm install` in it; the sparse-checkout now matches nothing, so the job dies at that step — before the linter — and takes #120, #122 and #123 down with it. Rather than re-point at a mock, this removes the linkage. dcd-cli is PUBLIC and was holding `DCD_SSH_DEPLOY_KEY`, a credential granting read access to the private repo, and pulling the API's `swagger.json` onto the runner on every same-repo PR. Deleting the checkout drops both. * The `Checkout dcd (mock-api)` and `Install Mock API dependencies` steps are gone, along with the `HAS_PRIVATE_ACCESS` gate that existed only to keep them off fork and Dependabot PRs. Every PR now takes the same path, so forks stop being second-class. * CI runs `pnpm test:unit` — a new script that is the existing runner with `--unit`. `test/unit/*` is pure and needs no backend, so unit coverage is kept rather than dropped along with the integration suite. * `scripts/test-runner.mjs` no longer defaults `MOCK_API_DIR` to `../../dcd/mock-api`. With no mock available it degrades to the unit suite and says so, instead of the bare ENOENT it throws today. Set `MOCK_API_DIR` and the integration specs run exactly as before. `DCD_SSH_DEPLOY_KEY` can now be deleted from the repo's secrets — nothing reads it. That is a separate manual step, not something this commit can do. Two things are genuinely lost, both worth stating plainly rather than discovering later: * `test/integration/*` no longer runs anywhere automatically. * With it goes the CLI<->swagger contract-drift check. Drift used to surface as a Prism 422 — that is how the `googlePlay` multipart break and the `tempPath` missing-example break were both caught. Nothing replaces it yet. Verified locally: `pnpm test:unit` and a bare `pnpm test` both run the unit suite only and print the notice; 81 pass and the 7 `flow-paths` failures are Windows-only, asserting POSIX paths against win32 `path`. The same specs ran green on ubuntu in the last full CI run (job 94750122384, 2026-08-14), which is the platform CI uses. `pnpm lint`, `pnpm typecheck`, `pnpm build` and `pnpm audit --audit-level moderate` are all clean. * docs: align the contributor docs with the new CI behaviour Follow-up to 5a713f6, which changed how CI treats the mock-api but only updated CLAUDE.md's Commands section — leaving three descriptions of the machinery it removed. Flagged on #124 for CLAUDE.md; CONTRIBUTING.md and README.md carried the same claim and are the ones contributors actually read. * CLAUDE.md's Contributing bullet said integration tests need the private devicecloud-dev/dcd mock-api via DCD_SSH_DEPLOY_KEY, that `pnpm test` is skipped on fork/Dependabot PRs, and that a maintainer runs the full suite before merge. None of that is true now: every PR runs identical steps and nothing runs the integration suite. * CONTRIBUTING.md's "About the test suite" said the same, framed as forks being the special case. Rewritten around the actual split — test/unit/* everywhere, test/integration/* only with MOCK_API_DIR set — and the reason CI does not reach for a mock: this repo is public and holds no credentials for private infrastructure. * Both command tables and README's quickstart now list `pnpm test:unit` and note it is what CI runs. Each of the three states the consequence rather than burying it: a green PR says nothing about the integration suite. CONTRIBUTING.md asks contributors touching the API surface to flag it so a maintainer can exercise it before merge. Docs only — no workflow or script changes.
…evicecloud.dev/dcd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 I have created a release beep boop
5.3.1-beta.3 (2026-08-18)
Dependencies
This PR was generated with Release Please. See documentation.