From 7bf6c8a2d21bbb6c452f10d201013ec1c2b8b413 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:23:09 +0000 Subject: [PATCH 01/10] build: bump the python-minor group with 2 updates Bumps the python-minor group with 2 updates: [openadapt-types](https://github.com/OpenAdaptAI/openadapt-types) and [onnxruntime](https://github.com/microsoft/onnxruntime). Updates `openadapt-types` from 0.10.0 to 0.17.0 - [Release notes](https://github.com/OpenAdaptAI/openadapt-types/releases) - [Changelog](https://github.com/OpenAdaptAI/openadapt-types/blob/main/CHANGELOG.md) - [Commits](https://github.com/OpenAdaptAI/openadapt-types/compare/v0.10.0...v0.17.0) Updates `onnxruntime` from 1.20.1 to 1.29.0 - [Release notes](https://github.com/microsoft/onnxruntime/releases) - [Changelog](https://github.com/microsoft/onnxruntime/blob/main/docs/ReleaseNotesWorkflow.md) - [Commits](https://github.com/microsoft/onnxruntime/compare/v1.20.1...v1.29.0) --- updated-dependencies: - dependency-name: openadapt-types dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor - dependency-name: onnxruntime dependency-version: 1.29.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor ... Signed-off-by: dependabot[bot] --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 8e7f628..ba0fe13 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -42,7 +42,7 @@ dependencies = [ # exporter and by the generated TypeScript projection checked into src/. # 0.10.0 carries the portable business-decision V2 contract used by the # Desktop phone portal and Flow's governed runner. - "openadapt-types==0.10.0", + "openadapt-types==0.17.0", "pydantic>=2.0", "pydantic-settings>=2.0", "PyYAML>=6.0,<7", @@ -95,7 +95,7 @@ build = [ "playwright>=1.44", # ONNX Runtime 1.27 dropped macOS Intel wheels. Flow's RapidOCR dependency # accepts this universal2 release, which retains Python 3.12 Intel support. - "onnxruntime==1.20.1; sys_platform == 'darwin' and platform_machine == 'x86_64'", + "onnxruntime==1.29.0; sys_platform == 'darwin' and platform_machine == 'x86_64'", # Keep the current runtime everywhere it publishes a compatible wheel. "onnxruntime==1.27.0; sys_platform != 'darwin' or platform_machine != 'x86_64'", ] From 49ab2527d07313b98353a00dcaf966570e202423 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:23:11 +0000 Subject: [PATCH 02/10] build: bump the npm-minor group with 4 updates Bumps the npm-minor group with 4 updates: [@tauri-apps/plugin-notification](https://github.com/tauri-apps/plugins-workspace), [@tauri-apps/plugin-updater](https://github.com/tauri-apps/plugins-workspace), [@testing-library/react](https://github.com/testing-library/react-testing-library) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react). Updates `@tauri-apps/plugin-notification` from 2.3.3 to 2.4.0 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/nfc-v2.3.3...fs-v2.4.0) Updates `@tauri-apps/plugin-updater` from 2.10.1 to 2.11.0 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/updater-v2.10.1...updater-v2.11.0) Updates `@testing-library/react` from 16.3.2 to 16.3.3 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3) Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) --- updated-dependencies: - dependency-name: "@tauri-apps/plugin-notification" dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: "@tauri-apps/plugin-updater" dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: "@testing-library/react" dependency-version: 16.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 32 ++++++++++++++++---------------- package.json | 4 ++-- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/package-lock.json b/package-lock.json index 78be0d6..fa602f1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,10 +16,10 @@ }, "devDependencies": { "@tauri-apps/cli": "^2", - "@testing-library/react": "^16.3.2", + "@testing-library/react": "^16.3.3", "@types/react": "^18.3.31", "@types/react-dom": "^18.3.7", - "@vitejs/plugin-react": "^6.1.0", + "@vitejs/plugin-react": "^6.1.1", "jsdom": "^30.0.1", "typescript": "^5.5.4", "vite": "^8.2.2", @@ -782,21 +782,21 @@ } }, "node_modules/@tauri-apps/plugin-notification": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-notification/-/plugin-notification-2.3.3.tgz", - "integrity": "sha512-Zw+ZH18RJb41G4NrfHgIuofJiymusqN+q8fGUIIV7vyCH+5sSn5coqRv/MWB9qETsUs97vmU045q7OyseCV3Qg==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-notification/-/plugin-notification-2.4.0.tgz", + "integrity": "sha512-xlJXMcUoKOjNupzDue5wrEsa1wytf+l/2gCAPhafHyP683Y3N7J/8clUWLZ3vpnwkpT2C1zcLMMQFjjecIG2xg==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.8.0" + "@tauri-apps/api": "^2.11.0" } }, "node_modules/@tauri-apps/plugin-updater": { - "version": "2.10.1", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.10.1.tgz", - "integrity": "sha512-NFYMg+tWOZPJdzE/PpFj2qfqwAWwNS3kXrb1tm1gnBJ9mYzZ4WDRrwy8udzWoAnfGCHLuePNLY1WVCNHnh3eRA==", + "version": "2.11.0", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.11.0.tgz", + "integrity": "sha512-AE36XkOoSna24G40jZMY15nzAnkXEPL/73tGoseGrtGOHuI/cZwWzHpZFLjKXDPgzYZ435z1gHu28LgrsBwIxQ==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.10.1" + "@tauri-apps/api": "^2.11.0" } }, "node_modules/@testing-library/dom": { @@ -821,9 +821,9 @@ } }, "node_modules/@testing-library/react": { - "version": "16.3.2", - "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.2.tgz", - "integrity": "sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g==", + "version": "16.3.3", + "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.3.tgz", + "integrity": "sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg==", "dev": true, "license": "MIT", "dependencies": { @@ -910,9 +910,9 @@ } }, "node_modules/@vitejs/plugin-react": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.0.tgz", - "integrity": "sha512-qd2BzUBehkov86WFhg0JkEFEYyCLG9uPCe6qWTY/kRlss9OvJrOF2UbIWT7p+8IzZHkEu0DNGHc4HSv+JdDLsw==", + "version": "6.1.1", + "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.1.tgz", + "integrity": "sha512-yxLaQV9gkhS8ezJqCM6+ndU7mDY6gqAg75NQ+0IjwEI8IYOmQCgkRwHKVSfWXW076DsqMo0Dk+0FK1U+M5RgFw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index e36bc96..65ac7d8 100644 --- a/package.json +++ b/package.json @@ -15,10 +15,10 @@ }, "devDependencies": { "@tauri-apps/cli": "^2", - "@testing-library/react": "^16.3.2", + "@testing-library/react": "^16.3.3", "@types/react": "^18.3.31", "@types/react-dom": "^18.3.7", - "@vitejs/plugin-react": "^6.1.0", + "@vitejs/plugin-react": "^6.1.1", "jsdom": "^30.0.1", "typescript": "^5.5.4", "vite": "^8.2.2", From 34cfb8fdaa6455a9ee69265765b2e909499a6691 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:23:23 +0000 Subject: [PATCH 03/10] build: bump the cargo-minor group in /src-tauri with 5 updates Bumps the cargo-minor group in /src-tauri with 5 updates: | Package | From | To | | --- | --- | --- | | [tauri-plugin-shell](https://github.com/tauri-apps/plugins-workspace) | `2.3.5` | `2.3.6` | | [tauri-plugin-notification](https://github.com/tauri-apps/plugins-workspace) | `2.3.3` | `2.4.0` | | [tauri-plugin-updater](https://github.com/tauri-apps/plugins-workspace) | `2.10.1` | `2.11.0` | | [tauri-plugin-deep-link](https://github.com/tauri-apps/plugins-workspace) | `2.4.9` | `2.4.10` | | [tauri-plugin-single-instance](https://github.com/tauri-apps/plugins-workspace) | `2.4.3` | `2.4.4` | Updates `tauri-plugin-shell` from 2.3.5 to 2.3.6 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/nfc-v2.3.5...nfc-v2.3.6) Updates `tauri-plugin-notification` from 2.3.3 to 2.4.0 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/nfc-v2.3.3...fs-v2.4.0) Updates `tauri-plugin-updater` from 2.10.1 to 2.11.0 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/updater-v2.10.1...updater-v2.11.0) Updates `tauri-plugin-deep-link` from 2.4.9 to 2.4.10 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/deep-link-v2.4.9...deep-link-v2.4.10) Updates `tauri-plugin-single-instance` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/fs-v2.4.3...fs-v2.4.4) --- updated-dependencies: - dependency-name: tauri-plugin-shell dependency-version: 2.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: tauri-plugin-notification dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor - dependency-name: tauri-plugin-updater dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor - dependency-name: tauri-plugin-deep-link dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: tauri-plugin-single-instance dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor ... Signed-off-by: dependabot[bot] --- src-tauri/Cargo.lock | 63 +++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 15 deletions(-) diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 225628c..b84f313 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -523,6 +523,16 @@ dependencies = [ "version_check", ] +[[package]] +name = "core-foundation" +version = "0.9.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "core-foundation" version = "0.10.1" @@ -546,7 +556,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97" dependencies = [ "bitflags 2.13.1", - "core-foundation", + "core-foundation 0.10.1", "core-graphics-types", "foreign-types", "libc", @@ -559,7 +569,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb" dependencies = [ "bitflags 2.13.1", - "core-foundation", + "core-foundation 0.10.1", "libc", ] @@ -1612,9 +1622,11 @@ dependencies = [ "percent-encoding", "pin-project-lite", "socket2", + "system-configuration", "tokio", "tower-service", "tracing", + "windows-registry", ] [[package]] @@ -3075,7 +3087,7 @@ version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0" dependencies = [ - "core-foundation", + "core-foundation 0.10.1", "core-foundation-sys", "jni 0.22.4", "log", @@ -3195,7 +3207,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d" dependencies = [ "bitflags 2.13.1", - "core-foundation", + "core-foundation 0.10.1", "core-foundation-sys", "libc", "security-framework-sys", @@ -3660,6 +3672,27 @@ dependencies = [ "syn 2.0.119", ] +[[package]] +name = "system-configuration" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b" +dependencies = [ + "bitflags 2.13.1", + "core-foundation 0.9.4", + "system-configuration-sys", +] + +[[package]] +name = "system-configuration-sys" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4" +dependencies = [ + "core-foundation-sys", + "libc", +] + [[package]] name = "system-deps" version = "6.2.2" @@ -3681,7 +3714,7 @@ checksum = "d1c93047acf68669466a34690ac58cca7010bd1b201e1ec86f1fd0a75d3dd4a9" dependencies = [ "bitflags 2.13.1", "block2", - "core-foundation", + "core-foundation 0.10.1", "core-graphics", "crossbeam-channel", "dbus", @@ -3872,9 +3905,9 @@ dependencies = [ [[package]] name = "tauri-plugin-deep-link" -version = "2.4.9" +version = "2.4.10" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70ee75bc5627f77bfdf40c913255ebc258117b10ebe2b2239a1a1cf40b0b58aa" +checksum = "92d489b8ecceae1cd09f6e1f7606f2095ac721cc8d54cf2f0e6bb377cc52cff6" dependencies = [ "dunce", "plist", @@ -3893,9 +3926,9 @@ dependencies = [ [[package]] name = "tauri-plugin-notification" -version = "2.3.3" +version = "2.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "01fc2c5ff41105bd1f7242d8201fdf3efd70749b82fa013a17f2126357d194cc" +checksum = "ad2fd40946aef810c4be9fd33a2d1b9b397cb79042b2d21c81a0a8f204354fd1" dependencies = [ "log", "notify-rust", @@ -3912,9 +3945,9 @@ dependencies = [ [[package]] name = "tauri-plugin-shell" -version = "2.3.5" +version = "2.3.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8457dbf9e2bab1edd8df22bb2c20857a59a9868e79cb3eac5ed639eec4d0c73b" +checksum = "8548af174c5516e4f71f142acea4d02e00316296ea9aafa58798851481003e3c" dependencies = [ "encoding_rs", "log", @@ -3933,9 +3966,9 @@ dependencies = [ [[package]] name = "tauri-plugin-single-instance" -version = "2.4.3" +version = "2.4.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b3214becf9ef5783c0ae99a3bb25adf5353a7a16ebf53e74b909e29205735c6c" +checksum = "5cd0cb5c412a5071b69bab6a6df1583cbb89460d4a83b6a24769b08d15b6b1e1" dependencies = [ "serde", "serde_json", @@ -3950,9 +3983,9 @@ dependencies = [ [[package]] name = "tauri-plugin-updater" -version = "2.10.1" +version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af" +checksum = "b28d8cabdeb0564f03ae261963de4bc3d98321cd3d213e76a81b7d344e5df606" dependencies = [ "base64 0.22.1", "dirs", From 61e2dad306d8e0980d26fe8a672b01ec3f2af0fb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:26:32 +0000 Subject: [PATCH 04/10] ci: bump the actions group with 3 updates Bumps the actions group with 3 updates: [anchore/sbom-action](https://github.com/anchore/sbom-action), [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) and [python-semantic-release/publish-action](https://github.com/python-semantic-release/publish-action). Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) Updates `python-semantic-release/python-semantic-release` from 10.6.1 to 10.6.2 - [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases) - [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst) - [Commits](https://github.com/python-semantic-release/python-semantic-release/compare/39dd2052f2ce8282a5d932c31d58a2ca06d2550e...9a026e9303981c866c3425723009becb2437c757) Updates `python-semantic-release/publish-action` from 10.6.1 to 10.6.2 - [Release notes](https://github.com/python-semantic-release/publish-action/releases) - [Changelog](https://github.com/python-semantic-release/publish-action/blob/main/releaserc.toml) - [Commits](https://github.com/python-semantic-release/publish-action/compare/5a5718ce47b892ef699f2972dae122297771d641...6d89e2de8d40ecb3717316ecbbf15a6fa8ea9039) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: python-semantic-release/python-semantic-release dependency-version: 10.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: python-semantic-release/publish-action dependency-version: 10.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/native-release.yml | 2 +- .github/workflows/release.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/native-release.yml b/.github/workflows/native-release.yml index 19d9692..8b94d95 100644 --- a/.github/workflows/native-release.yml +++ b/.github/workflows/native-release.yml @@ -630,7 +630,7 @@ jobs: run: python scripts/native_release.py validate-set --directory release-assets - name: Generate a machine-readable SBOM from the exact installer set - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: release-assets format: cyclonedx-json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 016449b..bfc7164 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -141,7 +141,7 @@ jobs: - name: Python Semantic Release if: steps.check_skip.outputs.skip != 'true' id: release - uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1 + uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2 with: github_token: ${{ secrets.ADMIN_TOKEN }} @@ -151,7 +151,7 @@ jobs: - name: Publish to GitHub Releases if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true' - uses: python-semantic-release/publish-action@5a5718ce47b892ef699f2972dae122297771d641 # v10.6.1 + uses: python-semantic-release/publish-action@6d89e2de8d40ecb3717316ecbbf15a6fa8ea9039 # v10.6.2 with: github_token: ${{ secrets.ADMIN_TOKEN }} From 1b5489c982a12face29808dfd7a3a6aae3e5af46 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:34:57 -0400 Subject: [PATCH 05/10] chore: preserve token drift checks for dependency pull requests --- .github/workflows/build.yml | 6 +----- pyproject.toml | 2 +- scripts/vendor-design-tokens.mjs | 35 ++++++++++++-------------------- tests/test_public_metadata.py | 4 ++-- 4 files changed, 17 insertions(+), 30 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0e1c4fd..e22f89f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -67,14 +67,10 @@ jobs: run: npm run test:ui && npm run build # The offline half of this guard runs in test:ui above. This half needs - # the network: it fails when openadapt-web moves the canonical palette and + # the network: it fails when openadapt-web publishes the canonical palette and # the vendored copy here does not follow, which is how the installed app # and the marketing site drift into looking like two products. - name: Check the vendored design tokens against openadapt-web - env: - # github.token cannot read private OpenAdaptAI/openadapt-web. - # ADMIN_TOKEN can; fall back so local/fork runs still try github.token. - GITHUB_TOKEN: ${{ secrets.ADMIN_TOKEN || github.token }} run: npm run tokens:check python-distribution: diff --git a/pyproject.toml b/pyproject.toml index 8e7f628..4116c07 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -120,7 +120,7 @@ packages = ["engine"] # python-semantic-release 10.6.2 still accepts click 8.1.8, which pip-audit # reports as PYSEC-2026-2132 (fix: 8.3.3). The GitHub Action is SHA-pinned at -# v10.6.1 and does not use this lock; the constraint keeps the local extra +# v10.6.2 and does not use this lock; the constraint keeps the local extra # from regressing the audited tree. [tool.uv] constraint-dependencies = ["click>=8.3.3"] diff --git a/scripts/vendor-design-tokens.mjs b/scripts/vendor-design-tokens.mjs index b8698d2..fd9e213 100755 --- a/scripts/vendor-design-tokens.mjs +++ b/scripts/vendor-design-tokens.mjs @@ -26,28 +26,19 @@ const write = process.argv.includes('--write'); const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex'); async function fetchCanonical(entry) { - // openadapt-web is private, so raw.githubusercontent.com 404s. CI already - // passes GITHUB_TOKEN; use the Contents API the same way --write does. - const token = process.env.GITHUB_TOKEN; - if (token) { - const url = - `https://api.github.com/repos/${provenance.canonical_repository}` + - `/contents/${entry.canonical_path}` + - `?ref=${encodeURIComponent(provenance.canonical_branch)}`; - const response = await fetch(url, { - headers: { - accept: 'application/vnd.github.raw', - authorization: `Bearer ${token}`, - }, - }); - if (!response.ok) { - throw new Error(`GET ${url} -> HTTP ${response.status}`); - } - return Buffer.from(await response.arrayBuffer()); + // Web publishes byte-identical canonical files during its build. Public + // reads also work for Dependabot and fork PRs without private-repo tokens. + const url = write + ? `https://api.github.com/repos/${provenance.canonical_repository}` + + `/contents/${entry.canonical_path}?ref=${encodeURIComponent(provenance.canonical_branch)}` + : `https://openadapt.ai/${entry.canonical_path}`; + const headers = { accept: write ? 'application/vnd.github.raw' : 'text/plain' }; + if (write && process.env.GITHUB_TOKEN) { + headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`; } - const response = await fetch(entry.raw_url, { headers: { accept: 'text/plain' } }); + const response = await fetch(url, { headers }); if (!response.ok) { - throw new Error(`GET ${entry.raw_url} -> HTTP ${response.status}`); + throw new Error(`GET ${url} -> HTTP ${response.status}`); } return Buffer.from(await response.arrayBuffer()); } @@ -90,7 +81,7 @@ for (const [name, entry] of Object.entries(provenance.files)) { if (canonicalSha !== vendoredSha) { failures.push( - `${name}: drifted from ${provenance.canonical_repository}@${provenance.canonical_branch}.\n` + + `${name}: drifted from the published ${provenance.canonical_repository} palette.\n` + ` canonical ${entry.canonical_path} is ${canonicalSha}\n` + ` the vendored copy is ${vendoredSha}\n` + ` Run: node scripts/vendor-design-tokens.mjs --write`, @@ -113,4 +104,4 @@ if (failures.length > 0) { process.exit(1); } -console.log(`\nVendored design tokens match ${provenance.canonical_repository}@${provenance.canonical_branch}.`); +console.log(`\nVendored design tokens match the published ${provenance.canonical_repository} palette.`); diff --git a/tests/test_public_metadata.py b/tests/test_public_metadata.py index f9ea220..3e38596 100644 --- a/tests/test_public_metadata.py +++ b/tests/test_public_metadata.py @@ -180,7 +180,7 @@ def test_release_workflow_uses_matching_pinned_actions() -> None: assert uses assert all(re.fullmatch(r"[0-9a-f]{40}", revision) for revision in uses) - assert "# v10.6.1" in workflow + assert "# v10.6.2" in workflow assert "# v9.15.2" not in workflow assert "token: ${{ secrets.ADMIN_TOKEN }}" in workflow assert workflow.count("github_token: ${{ secrets.ADMIN_TOKEN }}") == 2 @@ -223,7 +223,7 @@ def test_dev_semantic_release_floor_matches_the_pinned_v10_action() -> None: lock, flags=re.MULTILINE, ) - assert "# v10.6.1" in workflow + assert "# v10.6.2" in workflow assert "python-semantic-release>=9" not in "\n".join(dev) assert " push:" not in workflow[workflow.index("\non:\n") : workflow.index("\njobs:\n")] uv = pyproject["tool"]["uv"] From 2931ec921e3ec621e37e8dbecd33b52e1bf066bf Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:37:55 -0400 Subject: [PATCH 06/10] chore: pair published Flow 1.35.1 with Types 0.17 --- docs/RELEASE_CANDIDATE_INSTALLERS.md | 2 +- pyproject.toml | 6 +++--- scripts/sync_control_overlay_contract.py | 2 +- src/overlay/generated/contract.ts | 2 +- tests/test_build_frozen_engine.py | 8 ++++---- tests/test_public_metadata.py | 6 +++--- uv.lock | 17 +++++++++-------- 7 files changed, 22 insertions(+), 21 deletions(-) diff --git a/docs/RELEASE_CANDIDATE_INSTALLERS.md b/docs/RELEASE_CANDIDATE_INSTALLERS.md index 1a8ab9b..449eefb 100644 --- a/docs/RELEASE_CANDIDATE_INSTALLERS.md +++ b/docs/RELEASE_CANDIDATE_INSTALLERS.md @@ -10,7 +10,7 @@ only the fixed `openadapt://connect` action and forwards it to the sidecar's strict, transactional pairing flow. The canonical compiler and governed runtime remain in `openadapt-flow`. Each -native installer freezes the exact `openadapt-flow[browser,console]==1.34.0` +native installer freezes the exact `openadapt-flow[browser,console]==1.35.1` runtime and its `playwright==1.61.0` browser automation dependency into the Desktop sidecar. The `console` extra is what lets an installed application serve the attended decision console the mobile decision portal relays; the diff --git a/pyproject.toml b/pyproject.toml index ba0fe13..f87337c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -40,7 +40,7 @@ dependencies = [ "openadapt-privacy>=1.0.0", # Exact cross-surface status/target contract used by the presentation # exporter and by the generated TypeScript projection checked into src/. - # 0.10.0 carries the portable business-decision V2 contract used by the + # 0.17.0 retains the portable business-decision V2 contract used by the # Desktop phone portal and Flow's governed runner. "openadapt-types==0.17.0", "pydantic>=2.0", @@ -88,14 +88,14 @@ build = [ # purpose (see the pin below and the embedded ``-m playwright`` process # mode). Without it the driver becomes build-only and the artifact gate # correctly refuses the archive. - "openadapt-flow[browser,console]==1.34.0", + "openadapt-flow[browser,console]==1.35.1", # Desktop deliberately embeds the optional browser driver so selecting a # web workflow is one click. It does NOT bundle Chromium: that larger # runtime is fetched only after the operator chooses the browser surface. "playwright>=1.44", # ONNX Runtime 1.27 dropped macOS Intel wheels. Flow's RapidOCR dependency # accepts this universal2 release, which retains Python 3.12 Intel support. - "onnxruntime==1.29.0; sys_platform == 'darwin' and platform_machine == 'x86_64'", + "onnxruntime==1.20.1; sys_platform == 'darwin' and platform_machine == 'x86_64'", # Keep the current runtime everywhere it publishes a compatible wheel. "onnxruntime==1.27.0; sys_platform != 'darwin' or platform_machine != 'x86_64'", ] diff --git a/scripts/sync_control_overlay_contract.py b/scripts/sync_control_overlay_contract.py index f306293..e2ceed3 100644 --- a/scripts/sync_control_overlay_contract.py +++ b/scripts/sync_control_overlay_contract.py @@ -23,7 +23,7 @@ ROOT = Path(__file__).resolve().parents[1] OUTPUT = ROOT / "src" / "overlay" / "generated" / "contract.ts" SCHEMA_DIR = ROOT / "src" / "overlay" / "generated" / "schemas" -PINNED_TYPES_VERSION = "0.10.0" +PINNED_TYPES_VERSION = "0.17.0" SCHEMA_NAMES = ( "control-overlay-frame-v2.json", "control-overlay-timeline-v2.json", diff --git a/src/overlay/generated/contract.ts b/src/overlay/generated/contract.ts index 2b0949a..539c151 100644 --- a/src/overlay/generated/contract.ts +++ b/src/overlay/generated/contract.ts @@ -1,4 +1,4 @@ -// Generated from openadapt-types 0.10.0. Do not edit by hand. +// Generated from openadapt-types 0.17.0. Do not edit by hand. export const CONTROL_OVERLAY_FRAME_VERSION = "openadapt.control-overlay-frame/v2" as const; export const CONTROL_OVERLAY_TIMELINE_VERSION = "openadapt.control-overlay-timeline/v2" as const; diff --git a/tests/test_build_frozen_engine.py b/tests/test_build_frozen_engine.py index cc90617..e8ce331 100644 --- a/tests/test_build_frozen_engine.py +++ b/tests/test_build_frozen_engine.py @@ -447,15 +447,15 @@ def _pyproject(pin: str) -> Path: return root version, extras = frozen_notices.bundled_flow_pin(build.ROOT) - assert version == "1.34.0" + assert version == "1.35.1" assert set(frozen_notices.FLOW_REQUIRED_EXTRAS) <= set(extras) with pytest.raises(ValueError, match="console"): - frozen_notices.bundled_flow_pin(_pyproject("openadapt-flow==1.34.0")) + frozen_notices.bundled_flow_pin(_pyproject("openadapt-flow==1.35.1")) with pytest.raises(ValueError, match="browser"): - frozen_notices.bundled_flow_pin(_pyproject("openadapt-flow[console]==1.34.0")) + frozen_notices.bundled_flow_pin(_pyproject("openadapt-flow[console]==1.35.1")) with pytest.raises(ValueError, match="exact openadapt-flow build pin"): - frozen_notices.bundled_flow_pin(_pyproject("openadapt-flow[browser,console]>=1.34.0")) + frozen_notices.bundled_flow_pin(_pyproject("openadapt-flow[browser,console]>=1.35.1")) def test_frozen_runtime_roots_carry_the_pinned_flow_extras() -> None: diff --git a/tests/test_public_metadata.py b/tests/test_public_metadata.py index f9ea220..1c122dd 100644 --- a/tests/test_public_metadata.py +++ b/tests/test_public_metadata.py @@ -279,7 +279,7 @@ def test_candidate_release_notes_describe_the_bundled_flow_runtime() -> None: flow_dependencies = [ dependency for dependency in build_dependencies if dependency.startswith("openadapt-flow") ] - assert flow_dependencies == ["openadapt-flow[browser,console]==1.34.0"] + assert flow_dependencies == ["openadapt-flow[browser,console]==1.35.1"] # At or above the floor the bundled Flow declares for its ``capture`` # extra; ``tests/test_capture_runtime_contract.py`` compares the two # authoritatively. 1.2.1 specifically, because 1.2.0 and every release @@ -289,8 +289,8 @@ def test_candidate_release_notes_describe_the_bundled_flow_runtime() -> None: assert "openadapt-privacy>=1.0.0" in dependencies assert not any(item.startswith("Development Status ::") for item in classifiers) assert "Development Status :: 2 - Pre-Alpha" not in classifiers - assert bundled_flow_version() == "1.34.0" - assert bundled_flow_banner() == "openadapt-flow 1.34.0" + assert bundled_flow_version() == "1.35.1" + assert bundled_flow_banner() == "openadapt-flow 1.35.1" assert 'name = "playwright"\nversion = "1.61.0"' in lock assert flow_dependencies[0] in notes assert "playwright==1.61.0" in notes diff --git a/uv.lock b/uv.lock index 6398f10..6dfa5cf 100644 --- a/uv.lock +++ b/uv.lock @@ -1381,9 +1381,9 @@ requires-dist = [ { name = "onnxruntime", marker = "(platform_machine != 'x86_64' and extra == 'build') or (sys_platform != 'darwin' and extra == 'build')", specifier = "==1.27.0" }, { name = "openadapt-capture", specifier = ">=1.2.1" }, { name = "openadapt-desktop", extras = ["enterprise"], marker = "extra == 'full'" }, - { name = "openadapt-flow", extras = ["browser", "console"], marker = "extra == 'build'", specifier = "==1.34.0" }, + { name = "openadapt-flow", extras = ["browser", "console"], marker = "extra == 'build'", specifier = "==1.35.1" }, { name = "openadapt-privacy", specifier = ">=1.0.0" }, - { name = "openadapt-types", specifier = "==0.10.0" }, + { name = "openadapt-types", specifier = "==0.17.0" }, { name = "packaging", specifier = ">=24" }, { name = "playwright", marker = "extra == 'build'", specifier = ">=1.44" }, { name = "psutil" }, @@ -1402,22 +1402,23 @@ provides-extras = ["enterprise", "full", "build", "dev"] [[package]] name = "openadapt-flow" -version = "1.34.0" +version = "1.35.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, { name = "httpx" }, { name = "idna" }, { name = "numpy" }, + { name = "openadapt-types" }, { name = "opencv-python" }, { name = "pillow" }, { name = "pydantic" }, { name = "pyyaml" }, { name = "rapidocr-onnxruntime" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/18/27/aa3986b135964f7a6f4992a08873922d36bbb64a83a126f272497668fec4/openadapt_flow-1.34.0.tar.gz", hash = "sha256:a941a70015fe91897e655bfc9bf83e6cf8fbcf8bd4e4c7206ffb133c505203f8", size = 20440838, upload-time = "2026-08-28T14:23:46.17Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a9/9b/54d64f124c0789c4e8f82a54a298e4e33681c4f02e056c49931939ae384f/openadapt_flow-1.35.1.tar.gz", hash = "sha256:c5c6c437472b23999223b0d2473dbf21de2ca05274c270ae3854adeda6b07dca", size = 21135866, upload-time = "2026-09-09T17:16:21.203Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/23/4b/22e115d8fde6f562c7debf896351d7a8a3bc14483ca246abc3ca180d9077/openadapt_flow-1.34.0-py3-none-any.whl", hash = "sha256:56d32818989cb3a92830080ead39e10b08718c55e00988117f22cbfeaac98854", size = 1928194, upload-time = "2026-08-28T14:23:44.184Z" }, + { url = "https://files.pythonhosted.org/packages/84/4d/2bfa44495c907e691fe9bcc256230b919b97430bd430d72c8291b9365fc1/openadapt_flow-1.35.1-py3-none-any.whl", hash = "sha256:cfbc89acc6a2e3bcb5502a4d1fb29e985a03149a7f14c32c259254676bb3f11d", size = 2129416, upload-time = "2026-09-09T17:16:19.067Z" }, ] [package.optional-dependencies] @@ -1446,14 +1447,14 @@ wheels = [ [[package]] name = "openadapt-types" -version = "0.10.0" +version = "0.17.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "pydantic" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/0c/54/4cc84122fe9405fa3dbcd1521d252f92ba5d5c9d1eb367187aef06d0d4a3/openadapt_types-0.10.0.tar.gz", hash = "sha256:ea4d784da2d6dae15508d44a1e207a63539448312b3490d8c38110b4013710e8", size = 151235, upload-time = "2026-08-08T19:07:11.487Z" } +sdist = { url = "https://files.pythonhosted.org/packages/17/d5/549afc2b6bdde8a0a80d4eec67644275df251ee1654f3189f0cc66235730/openadapt_types-0.17.0.tar.gz", hash = "sha256:43dc00d82d6d8feb2cfaa16960224a85933440d7dee3b5f3c60618873535287b", size = 212574, upload-time = "2026-09-01T23:50:50.837Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/28/6e/1efc97ed73c84205149b7e2a7474638afa0a1c29374b867c5a357bdff59e/openadapt_types-0.10.0-py3-none-any.whl", hash = "sha256:37317cc56968a88869cff8181179211365c3f772302e87ce76f95181565125b9", size = 105149, upload-time = "2026-08-08T19:07:10.104Z" }, + { url = "https://files.pythonhosted.org/packages/55/9a/bec1d51cba5749732ceeba6e4abf7abe6aeaa22c849a1edb26b97c7ab479/openadapt_types-0.17.0-py3-none-any.whl", hash = "sha256:79738ab529f71241963725c6a40603deae032ff60c61d66baf33d7a248b1afa9", size = 155033, upload-time = "2026-09-01T23:50:49.083Z" }, ] [[package]] From 900b8b6f3dbac56116a0e0217418a0d723c9be28 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:37:59 -0400 Subject: [PATCH 07/10] chore: keep native plugin updates with their Rust peers --- package-lock.json | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index fa602f1..7a1689a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -782,21 +782,21 @@ } }, "node_modules/@tauri-apps/plugin-notification": { - "version": "2.4.0", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-notification/-/plugin-notification-2.4.0.tgz", - "integrity": "sha512-xlJXMcUoKOjNupzDue5wrEsa1wytf+l/2gCAPhafHyP683Y3N7J/8clUWLZ3vpnwkpT2C1zcLMMQFjjecIG2xg==", + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-notification/-/plugin-notification-2.3.3.tgz", + "integrity": "sha512-Zw+ZH18RJb41G4NrfHgIuofJiymusqN+q8fGUIIV7vyCH+5sSn5coqRv/MWB9qETsUs97vmU045q7OyseCV3Qg==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.11.0" + "@tauri-apps/api": "^2.8.0" } }, "node_modules/@tauri-apps/plugin-updater": { - "version": "2.11.0", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.11.0.tgz", - "integrity": "sha512-AE36XkOoSna24G40jZMY15nzAnkXEPL/73tGoseGrtGOHuI/cZwWzHpZFLjKXDPgzYZ435z1gHu28LgrsBwIxQ==", + "version": "2.10.1", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.10.1.tgz", + "integrity": "sha512-NFYMg+tWOZPJdzE/PpFj2qfqwAWwNS3kXrb1tm1gnBJ9mYzZ4WDRrwy8udzWoAnfGCHLuePNLY1WVCNHnh3eRA==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.11.0" + "@tauri-apps/api": "^2.10.1" } }, "node_modules/@testing-library/dom": { From c0081a41a06067384fbb3402f3a6a6becee8e3cd Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:38:57 -0400 Subject: [PATCH 08/10] chore: pair JavaScript plugins with the native update --- package-lock.json | 16 ++++++++-------- tests/test_native_release.py | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 78be0d6..640b0e1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -782,21 +782,21 @@ } }, "node_modules/@tauri-apps/plugin-notification": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-notification/-/plugin-notification-2.3.3.tgz", - "integrity": "sha512-Zw+ZH18RJb41G4NrfHgIuofJiymusqN+q8fGUIIV7vyCH+5sSn5coqRv/MWB9qETsUs97vmU045q7OyseCV3Qg==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-notification/-/plugin-notification-2.4.0.tgz", + "integrity": "sha512-xlJXMcUoKOjNupzDue5wrEsa1wytf+l/2gCAPhafHyP683Y3N7J/8clUWLZ3vpnwkpT2C1zcLMMQFjjecIG2xg==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.8.0" + "@tauri-apps/api": "^2.11.0" } }, "node_modules/@tauri-apps/plugin-updater": { - "version": "2.10.1", - "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.10.1.tgz", - "integrity": "sha512-NFYMg+tWOZPJdzE/PpFj2qfqwAWwNS3kXrb1tm1gnBJ9mYzZ4WDRrwy8udzWoAnfGCHLuePNLY1WVCNHnh3eRA==", + "version": "2.11.0", + "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.11.0.tgz", + "integrity": "sha512-AE36XkOoSna24G40jZMY15nzAnkXEPL/73tGoseGrtGOHuI/cZwWzHpZFLjKXDPgzYZ435z1gHu28LgrsBwIxQ==", "license": "MIT OR Apache-2.0", "dependencies": { - "@tauri-apps/api": "^2.10.1" + "@tauri-apps/api": "^2.11.0" } }, "node_modules/@testing-library/dom": { diff --git a/tests/test_native_release.py b/tests/test_native_release.py index ebda44b..74f1f86 100644 --- a/tests/test_native_release.py +++ b/tests/test_native_release.py @@ -5,6 +5,7 @@ import os import re import subprocess +import tomllib from pathlib import Path import pytest @@ -2836,3 +2837,16 @@ def test_production_workflow_keeps_normal_publication_unadmitted() -> None: assert "write-channel" not in text assert "unadmitted release candidate" in normal_release_text assert "unadmitted release candidate" in native_release_text + + +def test_frontend_and_native_plugins_share_the_same_protocol_version() -> None: + """A JS plugin update must ship with its matching native IPC implementation.""" + root = Path(__file__).resolve().parents[1] + npm = json.loads((root / "package-lock.json").read_text(encoding="utf-8")) + cargo = tomllib.loads((root / "src-tauri/Cargo.lock").read_text(encoding="utf-8")) + native_versions = {package["name"]: package["version"] for package in cargo["package"]} + for name, package in npm["packages"].items(): + prefix = "node_modules/@tauri-apps/plugin-" + if name.startswith(prefix): + native_name = "tauri-plugin-" + name.removeprefix(prefix) + assert package["version"] == native_versions[native_name], native_name From f92264c2be0656de777fd39e3d13ef624c6ac731 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:43:11 -0400 Subject: [PATCH 09/10] test: run native dispatch contracts with installer builds --- .github/workflows/build.yml | 8 ++++++++ src-tauri/src/pairing.rs | 2 -- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e22f89f..566eba4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -279,6 +279,14 @@ jobs: --target ${{ matrix.target }} --config src-tauri/tauri.adhoc.conf.json + # Reuse the installer build's compiled dependencies. These tests protect + # the native URL and deep-link dispatch boundaries before artifact upload. + - name: Test native command and deep-link contracts + run: >- + cargo test --locked --release + --manifest-path src-tauri/Cargo.toml + --target ${{ matrix.target }} + - name: Smoke-test macOS DMG install, launch, and uninstall if: runner.os == 'macOS' shell: bash diff --git a/src-tauri/src/pairing.rs b/src-tauri/src/pairing.rs index c83557c..febbea2 100644 --- a/src-tauri/src/pairing.rs +++ b/src-tauri/src/pairing.rs @@ -357,7 +357,6 @@ mod tests { format!("https://connect?pairing={SECRET}&host=https://app.openadapt.ai"), format!("openadapt://connect/run?pairing={SECRET}&host=https://app.openadapt.ai"), format!("openadapt://connect?pairing={SECRET}&host=https://app.openadapt.ai#x"), - runner_uri(), format!("openadapt://connect?pack={PACK}&bind={BIND}&origin=https://openadapt.ai"), ] { assert!(action_for_url(&parse(&raw)).is_err(), "{raw}"); @@ -377,7 +376,6 @@ mod tests { "openadapt://connect/runner?pack={PACK}&bind={BIND}&origin=https://openadapt.ai" ), format!("{}#x", runner_uri()), - format!("openadapt://connect?pairing={SECRET}&host=https://app.openadapt.ai"), format!("openadapt://runner?pairing={SECRET}&host=https://app.openadapt.ai"), ] { assert!(action_for_url(&parse(&raw)).is_err(), "{raw}"); From 388bf682fdaa462e00615fe63e1704acaac3f38c Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:49:48 -0400 Subject: [PATCH 10/10] test: isolate frozen capture smoke from local credentials --- scripts/smoke_test_frozen_flow.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/smoke_test_frozen_flow.py b/scripts/smoke_test_frozen_flow.py index be108f1..8ee8996 100644 --- a/scripts/smoke_test_frozen_flow.py +++ b/scripts/smoke_test_frozen_flow.py @@ -328,6 +328,11 @@ def _verify_bundled_capture(executable: Path, root: Path, env: dict[str, str]) - probe_env = dict(env) probe_env["OPENADAPT_DATA_DIR"] = str(root / "capture-contract-data") + # This probe verifies the frozen capture producer, not a user's hosted + # login. A local Keychain prompt must not block the unattended smoke test. + probe_env["PYTHON_KEYRING_BACKEND"] = "keyring.backends.null.Keyring" + probe_env["OPENADAPT_CONFIG_TOML"] = str(root / "doctor-config.toml") + probe_env.pop("OPENADAPT_INGEST_TOKEN", None) output, _ = _run([str(executable), "doctor"], env=probe_env, timeout=300) line = next(