Tyler/StepForge
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Pin Node toolchain, remove runtime npm repair, make CI and E2E truthful #21

Closed
Tyler wants to merge 0 commits from pr/01-toolchain-ci into main
pull from: pr/01-toolchain-ci
merge into: :main
Conversation 1 Commits - Files Changed -
Tyler commented 2026-07-03 18:11:06 +00:00
Owner
Copy Link
Copy Source

Phase 0 of the improvement plan (ai_prompts/prompt4.md), PR 1 of the recommended sequence. Mirrors GitHub PR Twest2/StepForge#5.

  • Pin Node >= 22.12 (engines + .nvmrc + engine-strict); entry points fail fast with clear guidance on older Nodes.
  • electron-launcher.js is diagnostics-only: all runtime npm install/rebuild/repair paths removed; npm ci is the only supported install path.
  • No silent --no-sandbox: user-namespace sandbox preferred, setuid helper accepted, otherwise a hard error with actionable fixes; explicit STEPFORGE_ALLOW_NO_SANDBOX/ELECTRON_DISABLE_SANDBOX opt-in for dev/CI (the Gitea workflow already sets it).
  • Click-capture E2E no longer masks startup crashes as SKIPPED; only a missing display server may skip, before launch. Startup smoke gets the same guard.
  • CI on pull_request for both forges; Node pinned from .nvmrc; separate blocking prod audit vs informational full audit on GitHub.
  • Lockfile refreshed on Node 22/npm 10; form-data and undici advisories fixed (npm audit clean).
  • Untracked generated build reports.

Verification: 203 unit tests pass; all non-capture E2E checks pass locally with a real Electron launch. The click self-test now truthfully reports the pre-existing Linux arm/debounce capture defect (already red on this repo's CI, run 177); the fix for that defect is PR 5 of the plan.

Phase 0 of the improvement plan (ai_prompts/prompt4.md), PR 1 of the recommended sequence. Mirrors GitHub PR Twest2/StepForge#5. - Pin Node >= 22.12 (engines + .nvmrc + engine-strict); entry points fail fast with clear guidance on older Nodes. - electron-launcher.js is diagnostics-only: all runtime npm install/rebuild/repair paths removed; npm ci is the only supported install path. - No silent --no-sandbox: user-namespace sandbox preferred, setuid helper accepted, otherwise a hard error with actionable fixes; explicit STEPFORGE_ALLOW_NO_SANDBOX/ELECTRON_DISABLE_SANDBOX opt-in for dev/CI (the Gitea workflow already sets it). - Click-capture E2E no longer masks startup crashes as SKIPPED; only a missing display server may skip, before launch. Startup smoke gets the same guard. - CI on pull_request for both forges; Node pinned from .nvmrc; separate blocking prod audit vs informational full audit on GitHub. - Lockfile refreshed on Node 22/npm 10; form-data and undici advisories fixed (npm audit clean). - Untracked generated build reports. Verification: 203 unit tests pass; all non-capture E2E checks pass locally with a real Electron launch. The click self-test now truthfully reports the pre-existing Linux arm/debounce capture defect (already red on this repo's CI, run 177); the fix for that defect is PR 5 of the plan.
Tyler added 1 commit 2026-07-03 18:11:06 +00:00
Pin the Node toolchain, remove runtime npm repair, make CI and E2E truthful
Template tests / tests (pull_request) Failing after 1m26s
Details
0f966a5fd0 
Phase 0 of the improvement plan (ai_prompts/prompt4.md): make the baseline
reproducible and stop the test runner from masking real failures.

- Pin Node >= 22.12 (engines + .nvmrc + engine-strict); every entry point
  fails fast with clear guidance instead of dying late with ERR_REQUIRE_ESM
  inside the packaging dependency graph.
- electron-launcher.js is diagnostics-only: all runtime npm install/rebuild/
  repair paths are removed. npm ci on the pinned toolchain is the only
  supported install path (README + GETTING_STARTED updated).
- Refuse to silently launch unsandboxed on Linux: --no-sandbox now requires
  an explicit STEPFORGE_ALLOW_NO_SANDBOX/ELECTRON_DISABLE_SANDBOX opt-in and
  is otherwise a hard error with actionable fixes; user-namespace sandboxing
  is detected and preferred.
- Click-capture E2E no longer converts startup crashes into "SKIPPED": the
  only allowed skip is the upfront absence of a display server. A missing
  shared library or crash now fails with the startup log. Same guard added
  to the startup smoke check.
- GitHub CI: run on pull_request, pin Node from .nvmrc, drop the macOS matrix
  entry (not a support target), and audit production and full dependency
  trees as separate signals. Gitea CI: pull_request trigger + pinned Node.
- Refresh package-lock on Node 22/npm 10 and remediate the form-data and
  undici advisories (npm audit: 0 vulnerabilities, prod and full tree).
- Stop tracking generated machine-specific build reports
  (build/build_report.md, build/artifacts_manifest.json).

Verified: 203 unit tests pass; repo-structure, startup-smoke, unit-workflows,
sample-artifacts, and build-release checks pass locally with a real Electron
launch. The click self-test now truthfully reports the pre-existing Linux
arm/debounce capture failures (also red on Gitea CI main run 177) instead of
hiding behind SKIPPED; that defect is scheduled for the capture-fix PR.

Co-Authored-By: Claude Fable 5 <[email protected]>
Tyler commented 2026-07-03 18:13:11 +00:00
Author
Owner
Copy Link
Copy Source

Merged into main as 6a3005f (same-SHA merge pushed to both forges to keep GitHub and Gitea identical; GitHub mirror PR Twest2/StepForge#5 shows MERGED). Closing.

Merged into main as 6a3005f (same-SHA merge pushed to both forges to keep GitHub and Gitea identical; GitHub mirror PR Twest2/StepForge#5 shows MERGED). Closing.
Tyler closed this pull request 2026-07-03 18:13:11 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Tyler (Tyler Westbrook)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Tyler/StepForge#21