The code-review plugin couldn't post reviews because Claude Code's
internal permission system blocked all Bash commands. Add claude_args
with --allowedTools to explicitly permit the gh and git commands the
plugin needs at runtime.
The npm script chain already includes --grep-invert in the e2e script.
Passing it again from CI caused argument duplication, making playwright
interpret the extra args as a file pattern and find no tests.
The workflow fails during the "sync" job on a pull request because of
repo-specific settings that are not set. These can be a security problem
to enable and are not needed for this workflow. Since accepting a PR
will cause a merge (and therefore a push by the author) this push will
then trigger the sync job with the correct authorization and will
therefore succeed as observed during my initial testing.
The only actions needed for the PR itself is linting.
- Create composite action for shared E2E setup (Node, npm, Playwright)
- Add build job that builds frontend once and uploads artifact
- Test jobs now download artifact instead of rebuilding
- Cache Playwright browsers to avoid fresh install each run
- Reduces frontend builds from 3x to 1x per workflow run
Split e2e-scheduled.yml into 3 parallel jobs (regular, webdav, supersync)
for ~3x faster nightly runs. Each job only starts the Docker services it
needs. Also reduced fixed wait times in sync-helpers.ts and waits.ts to
improve test execution speed while maintaining reliability.
The dependency-review-action requires base_ref and head_ref which are
only available in pull_request/pull_request_target/merge_group events.
When triggered by release events, this action fails.
Also update test job to run when vulnerability job is skipped (not just
when it succeeds) using !cancelled() && !failure() condition.
Co-authored-by: Claude <noreply@anthropic.com>
This should minimize false warnings and allow for merges without
concern. Slight renaming of jobs should also help with review. Exclusion
of new GH Action for docs/wiki/** added too.
Aligns PR checks with release build configuration by excluding
tests that require external services (WebDAV server on port 2345
and SuperSync server on port 1901). These tests still run in the
nightly e2e-scheduled.yml workflow with Docker services.
This prevents connection refused errors in CI and reduces test
runtime by ~45 tests while maintaining full coverage via scheduled
runs.
* feat(sync): add confirmation dialog when disabling SuperSync encryption
When users toggle off encryption for SuperSync, show a confirmation dialog
that explains the consequences:
- All encrypted sync data on the server will be deleted
- Current data will be re-uploaded without encryption
- Other devices will sync the unencrypted data
This ensures users understand that turning off encryption requires a fresh
snapshot to prevent mixing encrypted and unencrypted operations.
Changes:
- Add EncryptionDisableService to handle the disable encryption flow
- Add DialogDisableEncryptionComponent for user confirmation
- Add hook to encryption toggle in sync form to intercept disable action
- Add openDisableEncryptionDialog to dialog opener service
- Add translation keys for the new dialog
* fix(sync): initialize dialog opener and fix memory leak in encryption toggle
- Add EncryptionPasswordDialogOpenerInitService to initialize the module-level
dialog opener instance during app bootstrap
- Register the init service in main.ts using APP_INITIALIZER
- Fix memory leak by properly cleaning up subscription in onDestroy hook
- Add guard to prevent multiple dialogs opening simultaneously
- Fix race condition with async dialog handling
* feat(sync): handle encryption state change during backup import
When importing a backup file that has different encryption settings than
the current SuperSync configuration, the system now properly handles the
transition:
1. Detects encryption state change (enabled -> disabled or vice versa)
2. Deletes all server data (encrypted ops can't mix with unencrypted)
3. Uploads a fresh snapshot with the correct encryption settings
4. Updates the sync provider config to match the imported settings
This ensures a "tabula rasa" for the sync state when encryption changes,
preventing corrupt state where encrypted and unencrypted operations coexist.
Changes:
- Add ImportEncryptionHandlerService to detect and handle encryption changes
- Integrate the handler into FileImexComponent import flow
- Add E2E test for import with encryption state change scenario
* feat(sync): add confirmation dialog for import with encryption state change
Show a warning dialog to users when importing a backup that has different
encryption settings than their current SuperSync configuration. The dialog
explains the consequences:
- All server data will be deleted
- Sync history will be lost
- All devices will need to resync
This ensures users are informed before any encryption state change action.
* refactor(sync): improve UX of encryption state change dialogs
- Add context-specific messaging (enabling vs disabling encryption)
- Use visual state comparison with arrow indicator for import dialog
- Improve button label: "Import and Change Encryption" (clearer action)
- Add disableClose: true to prevent accidental dialog dismissal
- Improve terminology: "Your current configuration" → "After import"
- Clarify "resync" instructions for other devices
- Add aria-labels for screen reader accessibility
- Remove redundant warning icon from dialog title
* fix(sync): correct translation key path in import encryption warning dialog
Fix path from T.F.SYNC.IMPORT_ENCRYPTION_WARNING to
T.F.SYNC.FORM.IMPORT_ENCRYPTION_WARNING to match t.const.ts structure.
* fix(sync): use DI for OperationEncryptionService and fix tests
- Inject OperationEncryptionService properly instead of using `new`
which fails because the service uses Angular's inject() internally
- Add mock for ImportEncryptionHandlerService in FileImexComponent tests
* fix(ci): handle existing swap file in Lighthouse job
The Lighthouse job was failing with "fallocate: Text file busy" because
GitHub Actions runners may already have /swapfile in use. This fix:
- Disables existing swap file if present (swapoff)
- Removes the file before creating a new one
- Gracefully handles errors using || true
This resolves workflow failures while ensuring Lighthouse/Chrome still
get the required memory allocation.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- ci: complete SHA pinning for GitHub Actions in pr-preview-deploy.yml
- actions/checkout@v4.1.7
- actions/setup-node@v4.0.3
- cloudflare/wrangler-action@v3.12.0
- style: add High Contrast Mode fallback for sync state icon
- style: fix comment inaccuracy (18px -> 15px)
- refactor(schedule): complete magic number extraction to constants
- Add MONTH_VIEW config to SCHEDULE_CONSTANTS
- Use $schedule-time-column-width SCSS variable
- fix(issue-templates): add error message field to internal error report
- a11y: add aria-label to panels menu button in mobile bottom nav
The previous fix only updated ci.yml and e2e-scheduled.yml, but
missed the build.yml workflow which also runs E2E tests.
Without the build step, http-server times out trying to serve
non-existent files, causing the 90s timeout error.
This adds the same build and verification steps to build.yml.
- Add automated Docker build/push workflow for SuperSync server
- Update docker-compose.yml to use super-productivity org GHCR image
- Add --no-cache flag support to build-and-push.sh script
- Workflow triggers on SuperSync changes or manual dispatch
- Uses GitHub's built-in token (no personal token needed)
- Change trigger from pull_request to pull_request_target
- Add environment protection requirement (preview-deployments)
- Explicitly checkout PR head SHA to build fork PR code
- Requires manual approval before deployment to prevent secret exposure
This fixes the issue where fork PRs couldn't deploy previews because
secrets aren't available to pull_request triggers from forks.
- Add SignPath signing step to windows-bin job in build workflow
- Configure signing for all Windows executables (NSIS installers and portable .exe)
- Disable auto-release in electron-builder to allow signing before release
- Add manual GitHub Release upload after signing completes
- Add comprehensive documentation for SignPath setup and configuration
- Document required GitHub secrets and workflow configuration
- Include verification steps and troubleshooting guide
The integration is ready but signing steps will be commented out initially
until the SignPath certificate is fully issued (currently CSR PENDING).
Prevents race condition where upload attempts happen before sync config
is loaded from IndexedDB, eliminating 404 errors to default baseUrl
during app startup and E2E tests.
- Update peter-evans/find-comment to v4.0.0 (pinned SHA)
- Update peter-evans/create-or-update-comment to v5.0.0 (pinned SHA)
Fixes GitHub Actions failure where v4 tag pointed to unavailable commit.
Uses commit SHAs instead of version tags for supply chain security.
There is no reason to run certain checks on simple documentation
updates. These Actions showed up during the initial v0.1 PR and added
noise to the PR process.
Add automated preview deployments for pull requests using Cloudflare Pages.
Each PR gets a unique preview URL that updates on every push.
Requires configuring these repository secrets:
- CLOUDFLARE_API_TOKEN
- CLOUDFLARE_ACCOUNT_ID
WebDAV and SuperSync E2E tests require dedicated server infrastructure
and should only run in the scheduled E2E workflow or manually. This
prevents build failures when the required servers are not available.
- Added @webdav tag to all WebDAV test files for consistent filtering
- Updated build.yml to exclude @webdav and @supersync tagged tests
Add allowed_non_write_users parameter to bypass actor permission check for PRs from external contributors. This enables automated code reviews for all PRs, including those from forks, while maintaining security through pull_request_target context.
