A public repository cannot call a reusable workflow in the internal
KSAI repository, so the setup workflow fails before any job starts
with "workflow was not found". Call the published snapshot instead,
pinned to the current release and following its consumer template,
with every command enabled and a review on each opened pull request.
The snapshot names no model gateway of its own, so the call passes the
organization's gateway variable. It runs on GitHub-hosted runners,
because the Kong runner pool serves no public repository, and with no
GitHub App at all: push_as_app is false and no key is passed, so every
read and write goes through GITHUB_TOKEN.
Signed-off-by: Bart Smykla <bartek@smykla.com>
Two independent papercuts in the circular reference check, both hit while
investigating a failure on another PR.
`npm run check-cycle-references` could not run on Windows at all. It spawned
the extensionless `node_modules/.bin/depcruise` shim through `execFileSync`,
which Windows cannot launch; the `.cmd` sibling does not help either, since
Node >=18 refuses to spawn `.cmd` without a shell (CVE-2024-27980). Resolve
dependency-cruiser's own entry point and run it with `process.execPath`
instead — no shell, works everywhere.
The check also fails on baseline drift (cycles recorded in the baseline that
no longer exist), which is correct: the baseline is a ratchet, and leaving a
fixed cycle in it would silently keep permitting its reintroduction. But CI
labelled every non-success outcome "New circular references detected", so a PR
that *removed* two cycles was reported as having added some. That cost real
debugging time.
Give the script distinct exit codes — 1 for a new cycle, 2 for drift alone —
and have the workflow capture and map them to separate messages. The failure
behaviour is unchanged; only the wording is now accurate. Renamed the final
step to match what it actually gates on.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Summary
- Replaces the madge-based `check-cycle-references` with a `dependency-cruiser`-based check, cruised once per npm workspace package.
- Keeps the checker, dependency-cruiser config, and known-cycle baseline together under `scripts/circular-references/`.
- Uses a committed baseline to grandfather existing cycles while failing on new cycles and stale baseline entries.
- Cleans the existing `insomnia-inso` type cycle by using `insomnia-data`'s `AllTypes` instead of importing the database container type.
- CI explicitly uses Bash for correct `tee`/pipeline failure propagation, safely handles skipped checks, and posts a PR report.
- Dropped `madge`/`.madgerc`, added `dependency-cruiser`.
actions/checkout steps across CI workflows leaves GITHUB_TOKEN persisted in git config after checkout. None of these steps perform a git push using that persisted credential, disable credential persistence on the actions.
* fix(release): resolve previous tag by semver precedence, not publish order
GitHub's auto-detected previous tag for release notes ignores per-line
release branches, so out-of-order alpha/beta/hotfix tags can pull PRs
from an unrelated release into the notes. Compute the previous core@ tag
via real semver precedence instead, excluding a stable release's own
prereleases so it diffs against the prior stable release.
* fix(release): let ncipollo/release-action generate notes directly
Pass generateReleaseNotesPreviousTag to the release action instead of
calling GitHub's generate-notes API manually via curl - the action
already wraps the same endpoint with identical previous_tag_name
semantics, so this drops the redundant step.
* fix(ci): skip circular refs PR comment when count is unchanged
Avoids noisy comment creation/updates on the circular references check
when the PR introduces no change vs the base branch.
* fix(ci): delete stale circular refs comment when count returns to no-change
Prevents a stale "warning" comment lingering on a PR after circular
references introduced earlier are fixed and the count matches base again.
* chore: emit junit reports per e2e tests shard
* chore: include retries in junit reporter
* chore: test some stuff
* chore: test again
* chore: revert test
* chore: bump easily bumpable actions off of Node 20 runtime
* chore: bump remaining actions or replace with inline logic where Node 24 versions are unavailable
* refactor: remove variable interpolation in run blocks as flagged by Semgrep
* Add vault-crypto/mime utilities and remove heavyweight third-party imports
- Add AES-GCM vault-crypto utility with tests (replaces node-forge usage)
- Add common/mime.ts to replace mime-types package dependency
- Replace tough-cookie import in response-cookies-viewer with inline parser
- Replace @grpc/grpc-js status import in grpc-status-tag with inline constant
- Replace electron.ipcRenderer in auth.clear-vault-key with showToast()
- Remove unused analytics call from window-utils
* Fix impure Date.now() key on CodeEditor; use setValue via ref instead
Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet)
whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.
* fix: address Copilot review comments on PR #9992
- vault-crypto: replace forge-in-renderer with IPC bridge (main process
retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue)
- mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx,
fonts, audio/video, etc.) and fix remaining mime-types import in send route
- response-viewer: move charset alias map to module level; normalise iconv-lite
alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder
- auth.clear-vault-key: fix typo "all you local" → "all your local"
* fix: sort imports in send route
* feat: disable nodeIntegration in renderer mainWindow, remove import check tooling
- Set nodeIntegration:false and contextIsolation:true on mainWindow webPreferences
(hidden window keeps nodeIntegration:true for user script execution)
- Split script-security-rules.ts out of script-security-policy.ts so the renderer
can import display-only constants without pulling in require-interceptor
- Add templating/renderer-safe.ts with Node-free render/reload/getTagDefinitions;
update all renderer callers to import from it instead of templating/index
- Split insomnia-testing generate.ts: move generateToFile to generate-to-file.ts
so generate() has no Node imports; expose generateToFile from new entry point
- Move runTests execution to main process via IPC (run-tests channel) so the
renderer routes no longer import the Mocha-backed test runner directly
- Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts,
renderer-node-import-baseline.json and all related scripts/plugins now that the
renderer bundle is free of Node built-in imports
* fix: sort imports, use static TestResults type, remove unused analytics import
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* remove mime stuff
* remove ci step
* update plan
* insomnia testing adapter
* use export method
* trick react router ssr
* add renderer errors
* globalThis
* improve error
* move plugin types
* ipc validate proto
* fix import
* plugin types
* polyfill events for jshint
* restore node require plugin
* vault adapter
* add crypto bridges
* tough-cookie ipc
* util stub
* split cookie into network adapter
* assert
* fix plugin index import
* serialise cookie
* decouple renderer from scripting
* Fix rebase conflicts and import path issues
- Fix incorrect ~/insomnia-data imports (should be insomnia-data package)
- Remove non-existent mime utility imports and provide simple fallback
- Remove incorrect analytics call from main process
- Remove unused imports (Settings, Cookie)
- Fix Response type annotation for getResponseBodyBuffer
* lint
* fix tests
* fix: use dynamic import for crypt in session.ts for main process compatibility
The session.ts module is used in both renderer and main process contexts (via sync.invoke IPC handlers). When running in the main process, window.main is undefined, causing TypeError when trying to access window.main.crypt.decryptAES().
Changes:
- Use dynamic import of crypt module (only loaded in main process context)
- In renderer: window.main.crypt is always available so dynamic import never executes
- In main process: dynamic import loads crypt with node:crypto support
- Protect loginStateChange() calls with window existence checks
This avoids bundling node:crypto in the Vite renderer build while still supporting both execution contexts.
Fixes E2E test failures in sync operations (remoteBackendProjects, _assertSession, etc.) caused by disabled nodeIntegration.
* fix: add aria-label to template tag preview and browser-safe encoding fallback
- Add aria-label="Live Preview" to textarea in TagEditor for better Playwright accessibility
- Add atob() fallback for decodeEncoding in browser contexts where Buffer isn't available
- Fixes smoke test element discovery for template tag preview modal
* fix: add explicit waits for element stability in environment test
Add toBeEnabled() and toBeVisible() waits before clicking elements in the
'kv pair environment can be updated' test. This prevents timeout errors from
unstable/flickering elements during modal interactions, especially in
high-concurrency shard execution.
* remove unused
* add autocomplete generate test step
* fix lint
* put analytics back in
* combine vault and crypto adapter
* remove unused export split
* remove insomnia-testing cruft, addressing feedback
* fix: use direct imports in insomnia-inso after insomnia-testing index.ts removal
* fix circular reference
* fix: move createElectronNotifier to main process to fix SSR error
Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts
to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context.
* export har ipc bridge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: integrate AI plugin and configure LLMs in preferences (#9192)
* poc: LLM configuration
* fix formatting + tidy script
* fix openpath type send method
* exempt node_modules from vitest
* reset package-lock for inso build
* switch from send/on to invoke/handle
* switch to pluginData
* remove unnecessary animation
* remove extraneous external defs in frontend bundle config
* rebase fix
* feat: mock server gen (#9201)
* add ipc handler methods in front of llm config service (#9202)
* feat: gemini first class config support (#9209)
* feat: add gemini as a backend
* fix: save api key the first time
* chore: call plugin from utility process (#9210)
* feat: additional mock server event tracking (#9215)
* feat(Git Commit): Automatically generate commits (#9164)
* feat: add AI-generated commit message functionality in staging modal
* feat: enhance AI commit message generation with error handling and improved UI
* fix: update button icon and text for commit generation state in staging modal
* feat: add diff functionality to Git service and integrate with AI commit message generation
* feat: update isomorphic-git to version 1.33.1 and add stash functionality to Git VCS
* feat: implement multiple commit functionality for Git VCS and integrate with staging modal
* feat: add validation for staged changes before generating commit messages
* feat: implement generateCommitsFromDiff functionality for AI commit message generation
* Cleanup staging modal and use tree data for reordering and submitting multiple commits
* Revert "feat: update isomorphic-git to version 1.33.1 and add stash functionality to Git VCS"
This reverts commit b731372debdfb07ac118d84900c2cecb635a34b4.
* feat: update type definitions for diff changes in Git VCS
* refactor: remove console logs and commented code from staging modal and AI commit generation
* feat: implement git commit generation process using a separate utility process for improved error handling and performance
* fix: improve error handling messages in AI commit generation
* chore: update optional dependency for AI plugin to alpha version 1.0.3
* fix: ensure data dir exists prior to reading (#9220)
* fix: ensure data dir exists prior to reading
* rename handler
* feat: mock server gen ux improvements (#9221)
* fix: include mockgen script in build (#9222)
* feat: add git commit generation process to build script (#9226)
* fix: set min height for git folder selector (#9242)
* chore: ai plugin 1.0.4 (#9243)
* feat: toggle ai features (#9232)
* feat: track commit generation and saving events for analytics (#9293)
* feat: add analytics tracking for commit message generation events
* fix: update segment event names to camelCase for consistency
* Update package-lock with the plugin modules
* fix(build): add x64ArchFiles option back (#9297)
* fix: autoselect self hosted mock when cloud mock disabled (#9299)
* fix: hide ai settings from scratch pad user (#9300)
---------
Co-authored-by: Shelby Moore <13246465+shelby-moore@users.noreply.github.com>
Co-authored-by: James Gatz <jamesgatzos@gmail.com>
Bart Smykla