The review agent was denied all 7 attempts to access PR code because:
- Read/Glob/Grep tools were missing from allowedTools
- Shell pipes/redirects caused Bash(gh pr diff:*) to not match
- gh pr checkout and git diff were not in the allowed list
- Only the base branch was checked out (fetch-depth: 1)
SignPath renames files (spaces become dots), causing duplicate assets on
GitHub releases. Normalize filenames by stripping spaces, dots, and
hyphens to match signed files back to their originals, then overwrite
in-place to preserve the correct asset names for website download links.
The stalesweeper action needs write access to close discussions and add
comments. Without explicit permissions, the GITHUB_TOKEN only has read
access, causing FORBIDDEN errors.
Lint and unit tests are already covered by the main CI workflow.
Removing them from the Windows Store build avoids failures from
Windows-specific test issues and speeds up artifact creation.
* ci(community): initial discussion pruning workflow
This is the original workflow from steffen-karlsson/stalesweeper@v1.1.1
https://github.com/marketplace/actions/stalesweeper
The debug mode does not work which makes testing with dry-run impossible.
There is a re-worked action that probably won't get merged: https://github.com/thenick775/stalesweeper
I'm preserving the original workflow for posterity and potential troubleshooting. See next commit for details.
* ci(community): revised workflow for revised action
This is a new workflow that uses the modified thenick775/stalesweeper action.
https://github.com/LizardByte/community/blob/master/.github/workflows/discussions-stale.yml
Verbose mode appears to built-in now: b7f8c5e1c3
This workflow requires additional modifications as it uses environment variables and other settings that are not applicable to the SP repo.
* ci(community): add first valid workflow
Remove unnecessary permissions.
Remove unnecessary token placeholders.
Reduce frequency of workflow to reduce API calls.
Change defaults for manual runs to use safer options.
Use 180 days for the standard "expiry date" for regular discussions.
Create separate job and expiry for answered questions in "Q&A".
Make an exception for any discussions marked as "documentation gap".
* ci(community): switch action to controlled fork
There is really only a single action in GH Marketplace that does what is
needed and relying on a fork of *that* is a bit risky. I've separated
this commit out for easier `git revert` later on if needed.
Add a create-release job that pre-creates a single draft release
before mac-bin and windows-bin start. This eliminates the race
condition where parallel jobs each created their own draft release.
The actions/first-interaction@v3 action has a bug where isFirstPullRequest()
fetches all PRs without a creator filter, causing returning contributors to
receive "first PR" greetings on every PR. Replace with inline script using
GitHub Search API with proper author filtering.
Closes#6500
* fix(build): fix Play Store always showing version 16.7.3
Two issues caused production releases to always show as 16.7.3:
1. APKs were uploaded to the internal track with status: draft.
The promote action only sees active (non-draft) releases, so it
kept promoting the last non-draft version (16.7.3).
2. The promote workflow triggered on release:published, which fires
before the Android build finishes uploading. This race condition
meant the promotion always ran against stale internal track state.
Fix: change upload status to completed and move the promotion step
into the build workflow (after the upload), eliminating the race
condition. Remove the now-redundant auto-publish workflow.
https://claude.ai/code/session_01N8ddANh4ejMn3kYLajkL5V
* Revert "fix(build): fix Play Store always showing version 16.7.3"
This reverts commit a99f43ec1a.
* fix(build): fix Play Store always showing version 16.7.3
APKs were uploaded to the internal track with status: draft. When the
promote action later ran (on manual release publish), the Google Play
API could not promote a draft release to production, so it kept the
last non-draft version (16.7.3) on the production track.
Change upload status from draft to completed so the release is
promotable when the separate auto-publish workflow runs.
https://claude.ai/code/session_01N8ddANh4ejMn3kYLajkL5V
---------
Co-authored-by: Claude <noreply@anthropic.com>
The Windows job was publishing the release immediately (draft: false),
causing Linux and Mac electron-builder uploads to skip because they
found an already-published release instead of the expected draft.
Publish unsigned artifacts to the release first so Windows binaries are
always available. Signing steps run as best-effort with continue-on-error
and overwrite the unsigned assets on success.
Integrate SignPath signing directly into the windows-bin job so build
and signing happen in the same workflow (required for origin verification).
- Add signing steps: upload artifact, sign with SignPath, verify signatures
- Regenerate blockmaps and update latest.yml sha512 after signing
- Scope id-token:write permission to windows-bin job only
- Pin SignPath action to SHA, update action-gh-release to v2.5.0
- Delete standalone signpath-code-signing.yml workflow
Change both Apple store release workflows to trigger on v* tag push
instead of GitHub release publication, matching the Microsoft Store
workflow pattern. This also removes prerelease checks so builds run
for all tags including prereleases.
macos-26 runner defaults to Xcode 26.2 (Swift 6.2.3) which is
incompatible with Capacitor 7. Capacitor 8 is required for Xcode 26
support. Switch to macos-15 as an interim fix until Capacitor 8
migration is completed.
https://claude.ai/code/session_01A9RKZFkpVxqWXTdoyH5sZA
Co-authored-by: Claude <noreply@anthropic.com>
The code-review plugin couldn't post reviews because Claude Code's
internal permission system blocked all Bash commands. Add claude_args
with --allowedTools to explicitly permit the gh and git commands the
plugin needs at runtime.
The npm script chain already includes --grep-invert in the e2e script.
Passing it again from CI caused argument duplication, making playwright
interpret the extra args as a file pattern and find no tests.
The workflow fails during the "sync" job on a pull request because of
repo-specific settings that are not set. These can be a security problem
to enable and are not needed for this workflow. Since accepting a PR
will cause a merge (and therefore a push by the author) this push will
then trigger the sync job with the correct authorization and will
therefore succeed as observed during my initial testing.
The only actions needed for the PR itself is linting.
- Create composite action for shared E2E setup (Node, npm, Playwright)
- Add build job that builds frontend once and uploads artifact
- Test jobs now download artifact instead of rebuilding
- Cache Playwright browsers to avoid fresh install each run
- Reduces frontend builds from 3x to 1x per workflow run
Split e2e-scheduled.yml into 3 parallel jobs (regular, webdav, supersync)
for ~3x faster nightly runs. Each job only starts the Docker services it
needs. Also reduced fixed wait times in sync-helpers.ts and waits.ts to
improve test execution speed while maintaining reliability.
The dependency-review-action requires base_ref and head_ref which are
only available in pull_request/pull_request_target/merge_group events.
When triggered by release events, this action fails.
Also update test job to run when vulnerability job is skipped (not just
when it succeeds) using !cancelled() && !failure() condition.
Co-authored-by: Claude <noreply@anthropic.com>
This should minimize false warnings and allow for merges without
concern. Slight renaming of jobs should also help with review. Exclusion
of new GH Action for docs/wiki/** added too.
Aligns PR checks with release build configuration by excluding
tests that require external services (WebDAV server on port 2345
and SuperSync server on port 1901). These tests still run in the
nightly e2e-scheduled.yml workflow with Docker services.
This prevents connection refused errors in CI and reduces test
runtime by ~45 tests while maintaining full coverage via scheduled
runs.
* feat(sync): add confirmation dialog when disabling SuperSync encryption
When users toggle off encryption for SuperSync, show a confirmation dialog
that explains the consequences:
- All encrypted sync data on the server will be deleted
- Current data will be re-uploaded without encryption
- Other devices will sync the unencrypted data
This ensures users understand that turning off encryption requires a fresh
snapshot to prevent mixing encrypted and unencrypted operations.
Changes:
- Add EncryptionDisableService to handle the disable encryption flow
- Add DialogDisableEncryptionComponent for user confirmation
- Add hook to encryption toggle in sync form to intercept disable action
- Add openDisableEncryptionDialog to dialog opener service
- Add translation keys for the new dialog
* fix(sync): initialize dialog opener and fix memory leak in encryption toggle
- Add EncryptionPasswordDialogOpenerInitService to initialize the module-level
dialog opener instance during app bootstrap
- Register the init service in main.ts using APP_INITIALIZER
- Fix memory leak by properly cleaning up subscription in onDestroy hook
- Add guard to prevent multiple dialogs opening simultaneously
- Fix race condition with async dialog handling
* feat(sync): handle encryption state change during backup import
When importing a backup file that has different encryption settings than
the current SuperSync configuration, the system now properly handles the
transition:
1. Detects encryption state change (enabled -> disabled or vice versa)
2. Deletes all server data (encrypted ops can't mix with unencrypted)
3. Uploads a fresh snapshot with the correct encryption settings
4. Updates the sync provider config to match the imported settings
This ensures a "tabula rasa" for the sync state when encryption changes,
preventing corrupt state where encrypted and unencrypted operations coexist.
Changes:
- Add ImportEncryptionHandlerService to detect and handle encryption changes
- Integrate the handler into FileImexComponent import flow
- Add E2E test for import with encryption state change scenario
* feat(sync): add confirmation dialog for import with encryption state change
Show a warning dialog to users when importing a backup that has different
encryption settings than their current SuperSync configuration. The dialog
explains the consequences:
- All server data will be deleted
- Sync history will be lost
- All devices will need to resync
This ensures users are informed before any encryption state change action.
* refactor(sync): improve UX of encryption state change dialogs
- Add context-specific messaging (enabling vs disabling encryption)
- Use visual state comparison with arrow indicator for import dialog
- Improve button label: "Import and Change Encryption" (clearer action)
- Add disableClose: true to prevent accidental dialog dismissal
- Improve terminology: "Your current configuration" → "After import"
- Clarify "resync" instructions for other devices
- Add aria-labels for screen reader accessibility
- Remove redundant warning icon from dialog title
* fix(sync): correct translation key path in import encryption warning dialog
Fix path from T.F.SYNC.IMPORT_ENCRYPTION_WARNING to
T.F.SYNC.FORM.IMPORT_ENCRYPTION_WARNING to match t.const.ts structure.
* fix(sync): use DI for OperationEncryptionService and fix tests
- Inject OperationEncryptionService properly instead of using `new`
which fails because the service uses Angular's inject() internally
- Add mock for ImportEncryptionHandlerService in FileImexComponent tests
* fix(ci): handle existing swap file in Lighthouse job
The Lighthouse job was failing with "fallocate: Text file busy" because
GitHub Actions runners may already have /swapfile in use. This fix:
- Disables existing swap file if present (swapoff)
- Removes the file before creating a new one
- Gracefully handles errors using || true
This resolves workflow failures while ensuring Lighthouse/Chrome still
get the required memory allocation.
---------
Co-authored-by: Claude <noreply@anthropic.com>
