Cascade stage → main (real typecheck + image pins + turbo 2.11.7 (#1085), 2026-10-05 advisories (#1087)) by evereq · Pull Request #1089 · ever-works/directory-web-template

evereq · 2026-10-08T17:06:10Z

Cascade stage → main. Session 07a5b68a (lane template-c4).

Content (git diff --stat main stage): ci.yml, k8s-build.yml, both Dockerfiles, apps/web/package.json, package.json, pnpm-lock.yaml, turbo.json. These are #1085 (real typecheck, effective pnpm/turbo pins, turbo 2.11.7, dispatch no longer cancels queued builds) and #1087 (2026-10-05 advisories, prod audit 3 critical / 4 high → 0 / 1). #1003 is already on main.

Evidence on stage `8af47b3f`

E2E run 37798985237: 4/4 green (attempt 3; attempts 1-2 lost shards to the 15-min webServer timeout on loaded runners; the same build passed on the other shards).
k8s-build green. The RUN line now expands to corepack prepare pnpm@10.31.0 … npm install -g turbo@2.11.7; on main it printed turbo@${TURBO_VERSION} unexpanded.
demo-stage pod: Node v26.10.0, 0 restarts, /usr/local/bin/docker-entrypoint.sh present; 35/35 sampled paths identical to the pre-change snapshot.

🤖 Generated with Claude Code

…ges, stop hand dispatches cancelling queued builds - apps/web had no `typecheck` script, so CI's "Type check" step printed "skipping" and passed on every run. Add `tsc --noEmit` (0 errors today) and drop the `|| echo` that hid a missing script. - Dockerfile + apps/docs/Dockerfile declared PNPM_VERSION / TURBO_VERSION only before the first FROM, so the base stage read them as empty and `npm install -g turbo@` took whatever turbo was newest. Re-declare both in the stage. - turbo 2.9.14 -> 2.11.7 (latest) in package.json, the lockfile and the image ARG, so `turbo prune` and `pnpm exec turbo build` use the same version. - k8s-build: `cancel-in-progress` only for push events. On 2026-10-05 two Work sites' push builds, still queued for a runner, were cancelled by a hand workflow_dispatch for the same commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… (running builds; pending ones are replaced by a build of the same head) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Back-merge main → develop (#1003 runtime V8 heap entrypoint, main-only since 2026-08-01)

…args fix(ci): real web typecheck, effective pnpm/turbo pins in the images, turbo 2.11.7, dispatch no longer cancels queued builds

…l 2.2.0, compression 1.8.2, source-map-js 1.2.2, prosemirror-view 1.42.6) pnpm audit --prod: 3 critical / 4 high -> 0 / 1 (braces, no patched release). - prosemirror-view 1.41.6 -> 1.42.6 (GHSA-c8x8-7fp4-3x9w, XSS): the only one that reaches a browser, through apps/web > @tiptap/pm. Same ^1 range, lockfile-only. - proxy-addr 2.0.7 -> 2.0.8 (GHSA-jqcg-44mw-7w3h), compression 1.8.1 -> 1.8.2 (GHSA-vc2v-76pw-4v95), source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q): all docs build tooling (@docusaurus/core > webpack-dev-server / bundler), lockfile-only. - tinypool 1.1.1 -> 2.2.0 via a scoped override (GHSA-85c8-ppgw-ccpr, GHSA-5gmw-xhrv-c9v3): no 1.x fix exists and @docusaurus/core 3.10.2 asks for ^1. Docusaurus only imports it when future.faster.ssgWorkerThreads is on, which this site does not set, so it is never loaded; it loads via dynamic import(), which 2.x (ESM-only) supports. Local docs build --locale en: 686 pages, exit 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

prosemirror-view 1.42.6 needs prosemirror-model ^1.25.12, which left a second copy next to @tiptap/pm's 1.25.4; ProseMirror's instanceof checks break across copies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(deps): clear the 2026-10-05 advisories (3 critical / 4 high → 0 / 1)

Cascade develop → stage (#1003 back-merge, real typecheck + image pins + turbo 2.11.7 (#1085), 2026-10-05 advisories (#1087))

coderabbitai · 2026-10-08T17:06:22Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: d694e0cf-a3f6-45b8-a2fa-82ec1c616112

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

greptile-apps · 2026-10-08T17:09:58Z

Confidence Score: 5/5

[High risk] Upgrades build tooling and fixes CI type checking.

This PR appears safe to merge; no actionable issue was found.

What we checked:

Tool versions stay pinned: The lockfile resolves turbo to 2.11.7, and Docker installs with --frozen-lockfile. The global install also reads the newly redeclared TURBO_VERSION.

Summary

This PR makes CI run a real web type check and makes the Docker tool versions match their declared pins.

Web CI now checks the app's TypeScript.
Manual image builds wait instead of canceling an active push build.
Workspace and Docker builds use Turbo 2.11.7.
Dependency installs use the updated package versions from the lockfile.

_{Reviews (1) · Last reviewed commit: "Merge pull request #1088 from ever-works..." · Reviewed by Greptile}

evereq and others added 8 commits October 8, 2026 13:04

docs(ci): state exactly what the k8s-build dispatch change guarantees…

ad506cd

… (running builds; pending ones are replaced by a build of the same head) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #1086 from ever-works/main

9db2567

Back-merge main → develop (#1003 runtime V8 heap entrypoint, main-only since 2026-08-01)

Merge pull request #1085 from ever-works/fix/c4-typecheck-dockerfile-…

252ad6e

…args fix(ci): real web typecheck, effective pnpm/turbo pins in the images, turbo 2.11.7, dispatch no longer cancels queued builds

fix(deps): one prosemirror-model (1.25.12) for the whole editor

8b5ef9e

prosemirror-view 1.42.6 needs prosemirror-model ^1.25.12, which left a second copy next to @tiptap/pm's 1.25.4; ProseMirror's instanceof checks break across copies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #1087 from ever-works/fix/advisories-2026-10-08

d19699d

fix(deps): clear the 2026-10-05 advisories (3 critical / 4 high → 0 / 1)

Merge pull request #1088 from ever-works/develop

8af47b3

Cascade develop → stage (#1003 back-merge, real typecheck + image pins + turbo 2.11.7 (#1085), 2026-10-05 advisories (#1087))

evereq merged commit 79baf2e into main Oct 8, 2026
21 of 26 checks passed

Navigation Menu

Repository navigation

Cascade stage → main (real typecheck + image pins + turbo 2.11.7 (#1085), 2026-10-05 advisories (#1087)) - #1089

Cascade stage → main (real typecheck + image pins + turbo 2.11.7 (#1085), 2026-10-05 advisories (#1087))#1089
evereq merged 8 commits into
mainfrom
stage

evereq commented Oct 8, 2026

Uh oh!

coderabbitai Bot commented Oct 8, 2026

Review skipped

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

evereq commented Oct 8, 2026

Evidence on stage 8af47b3f

Uh oh!

coderabbitai Bot commented Oct 8, 2026

Review skipped

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Evidence on stage `8af47b3f`

greptile-apps Bot commented Oct 8, 2026 •

edited

Loading