Skip to content

chore(deps): bump hono from 4.12.10 to 4.13.0 #1917

chore(deps): bump hono from 4.12.10 to 4.13.0

chore(deps): bump hono from 4.12.10 to 4.13.0 #1917

name: Pull Request Checks
on:
pull_request: {}
permissions:
contents: read
actions: read
packages: read
jobs:
detect-affected:
name: Detect Affected Projects
runs-on: ubuntu-latest
outputs:
has_affected: ${{ steps.detect-affected.outputs.has_affected }}
projects: ${{ steps.detect-affected.outputs.projects }}
has_test: ${{ steps.detect-affected.outputs.has_test }}
has_e2e: ${{ steps.detect-affected.outputs.has_e2e }}
has_lint: ${{ steps.detect-affected.outputs.has_lint }}
has_build: ${{ steps.detect-affected.outputs.has_build }}
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set Nx SHA
uses: nrwl/nx-set-shas@v5
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Detect affected projects
id: detect-affected
uses: ./.github/actions/detect-affected
lint_pull_request:
name: Pull Request Lint
runs-on: ubuntu-latest
permissions:
pull-requests: read
steps:
- uses: amannn/action-semantic-pull-request@v6
with:
types: |
feat
fix
docs
refactor
cleanup
chore
ci
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
lint_commit:
name: Commit Lint
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set Nx SHA
uses: nrwl/nx-set-shas@v5
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Commitlint - Lint Commits
if: github.event_name == 'pull_request'
shell: bash
run: |
npx commitlint --from=origin/${{ github.base_ref }} --to=HEAD --config ./.commitlintrc.json
knowledge-graph-impact:
name: Knowledge Graph Blast Radius
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build knowledge graph tooling
run: npx nx run graph:build
- name: Compute blast radius vs PR base
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: |
set -euo pipefail
# Call the CLI directly so Nx banners do not pollute the comment body.
node dist/tools/graph/src/query-cli.js impact \
--base "$BASE_SHA" \
--no-uncommitted \
--format markdown \
> knowledge-graph-blast-radius.md
- name: Upsert PR blast radius comment
uses: ./.github/actions/upsert-pr-comment
with:
marker: '<!-- knowledge-graph-blast-radius -->'
body-path: knowledge-graph-blast-radius.md
check:
name: Format Check
runs-on: ubuntu-latest
needs: detect-affected
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set Nx SHA
uses: nrwl/nx-set-shas@v5
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Nx Format - Check
run: npx nx format:check
- name: Nx Lint - Check
if: needs.detect-affected.outputs.has_lint == 'true'
run: npx nx affected --target=lint --parallel=3
- name: Skip lint (no affected projects)
if: needs.detect-affected.outputs.has_lint != 'true'
run: echo "No affected projects with lint target; skipping nx affected lint."
test:
name: Test
runs-on: ubuntu-latest
needs: detect-affected
if: needs.detect-affected.outputs.has_affected == 'true'
permissions:
contents: read
actions: read
packages: read
issues: write
pull-requests: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set Nx SHA
uses: nrwl/nx-set-shas@v5
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Collect base-branch coverage (for PR diff)
if: github.event_name == 'pull_request' && needs.detect-affected.outputs.has_test == 'true'
continue-on-error: true
shell: bash
run: |
set -uo pipefail
PR_SHA=$(git rev-parse HEAD)
git fetch origin "${{ github.base_ref }}" --depth=1
git checkout "${{ github.event.pull_request.base.sha }}"
rm -rf coverage coverage-base
npx nx affected --target=test --parallel=3 --configuration=ci --skip-nx-cache
if [ -d coverage ]; then
mv coverage coverage-base
else
mkdir -p coverage-base
fi
git checkout "$PR_SHA"
- name: Ensure coverage-base exists for diff comment
if: github.event_name == 'pull_request' && needs.detect-affected.outputs.has_test != 'true'
run: mkdir -p coverage-base
- name: Run unit tests
if: needs.detect-affected.outputs.has_test == 'true'
run: |
rm -rf test-results
mkdir -p test-results
npx nx affected --target=test --parallel=3 --configuration=ci --skip-nx-cache
- name: Skip unit tests (no affected projects with test target)
if: needs.detect-affected.outputs.has_test != 'true'
run: echo "No affected projects with test target; skipping unit tests."
- name: Generate coverage PR comment
if: always() && github.event_name == 'pull_request'
run: |
set -euo pipefail
if [ "${{ needs.detect-affected.outputs.has_test }}" != "true" ]; then
node tools/ci/pr-reports.mjs coverage \
--coverage-dir coverage \
--coverage-base-dir coverage-base \
--out pr-coverage.md \
--no-coverage-ran
else
node tools/ci/pr-reports.mjs coverage \
--coverage-dir coverage \
--coverage-base-dir coverage-base \
--out pr-coverage.md
fi
- name: Upsert PR coverage comment
if: always() && github.event_name == 'pull_request'
uses: ./.github/actions/upsert-pr-comment
with:
marker: '<!-- nx-coverage-report -->'
body-path: pr-coverage.md
- name: Generate test PR comment
if: always() && github.event_name == 'pull_request'
run: |
set -euo pipefail
if [ "${{ needs.detect-affected.outputs.has_test }}" != "true" ]; then
node tools/ci/pr-reports.mjs tests \
--results-dir test-results \
--out pr-tests.md \
--no-tests-ran
else
node tools/ci/pr-reports.mjs tests \
--results-dir test-results \
--out pr-tests.md
fi
- name: Upsert PR test comment
if: always() && github.event_name == 'pull_request'
uses: ./.github/actions/upsert-pr-comment
with:
marker: '<!-- nx-test-report -->'
body-path: pr-tests.md
- name: Run end-to-end tests
if: needs.detect-affected.outputs.has_e2e == 'true'
run: npx nx affected --target=e2e --parallel=3
- name: Skip e2e tests (no affected projects with e2e target)
if: needs.detect-affected.outputs.has_e2e != 'true'
run: echo "No affected projects with e2e target; skipping e2e tests."
trivy-filesystem:
name: Trivy Filesystem Scan
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
- name: Run Trivy filesystem scan
uses: ./.github/actions/trivy-scan
with:
scan-type: fs
scan-ref: .
sarif-category: trivy-fs
trivy-config:
name: Trivy Config Scan
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
- name: Run Trivy config scan
uses: ./.github/actions/trivy-scan
with:
scan-type: config
scan-ref: .
sarif-category: trivy-config
build:
name: Build
runs-on: ubuntu-latest
needs: detect-affected
if: needs.detect-affected.outputs.has_affected == 'true'
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Run build
run: |
set -euo pipefail
for attempt in 1 2 3; do
if npx nx affected --target=build --parallel=3; then
exit 0
fi
echo "Build attempt ${attempt} failed."
if [ "${attempt}" -eq 3 ]; then
exit 1
fi
sleep 10
done
- name: Run SBOM generation
env:
VERSION: 0.0.0-SNAPSHOT
run: npx nx affected --target=sbom --parallel=1
- name: Upload build artifacts
uses: actions/upload-artifact@v7
if: always()
with:
name: build-artifacts
path: |
dist/
node_modules/
retention-days: 1
compression-level: 6
build-api-container-images:
name: Build API Container Images
runs-on: ubuntu-latest
needs: build
permissions:
contents: read
actions: read
packages: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build API container images
run: |
npx nx affected --target=api-container-image --configuration=test --parallel=3
- name: Scan API container images with Trivy
uses: ./.github/actions/trivy-scan-local-images
with:
sarif-category: trivy-images-api
- name: Generate container image SBOMs
uses: ./.github/actions/generate-container-image-sboms
with:
project-version: 0.0.0-SNAPSHOT
artifact-name: sbom-container-images-api
build-worker-container-images:
name: Build Worker Container Images
runs-on: ubuntu-latest
needs: build
permissions:
contents: read
actions: read
packages: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build Worker container images
run: |
npx nx affected --target=worker-container-image --configuration=test --parallel=3
- name: Scan Worker container images with Trivy
uses: ./.github/actions/trivy-scan-local-images
with:
sarif-category: trivy-images-worker
- name: Generate container image SBOMs
uses: ./.github/actions/generate-container-image-sboms
with:
project-version: 0.0.0-SNAPSHOT
artifact-name: sbom-container-images-worker
build-vnc-container-images:
name: Build VNC Container Images
runs-on: ubuntu-latest
needs: build
permissions:
contents: read
actions: read
packages: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build VNC container images
run: |
npx nx affected --target=vnc-container-image --configuration=test --parallel=3
- name: Scan VNC container images with Trivy
uses: ./.github/actions/trivy-scan-local-images
with:
sarif-category: trivy-images-vnc
- name: Generate container image SBOMs
uses: ./.github/actions/generate-container-image-sboms
with:
project-version: 0.0.0-SNAPSHOT
artifact-name: sbom-container-images-vnc
build-ssh-container-images:
name: Build SSH Container Images
runs-on: ubuntu-latest
needs: build
permissions:
contents: read
actions: read
packages: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build SSH container images
run: |
npx nx affected --target=ssh-container-image --configuration=test --parallel=3
- name: Scan SSH container images with Trivy
uses: ./.github/actions/trivy-scan-local-images
with:
sarif-category: trivy-images-ssh
- name: Generate container image SBOMs
uses: ./.github/actions/generate-container-image-sboms
with:
project-version: 0.0.0-SNAPSHOT
artifact-name: sbom-container-images-ssh
build-agi-container-images:
name: Build AGI Container Images
runs-on: ubuntu-latest
needs: build
permissions:
contents: read
actions: read
packages: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build AGI container images
run: |
npx nx affected --target=agi-container-image --configuration=test --parallel=3
- name: Scan AGI container images with Trivy
uses: ./.github/actions/trivy-scan-local-images
with:
sarif-category: trivy-images-agi
- name: Generate container image SBOMs
uses: ./.github/actions/generate-container-image-sboms
with:
project-version: 0.0.0-SNAPSHOT
artifact-name: sbom-container-images-agi
build-server-container-images:
name: Build Server Container Images
runs-on: ubuntu-latest
needs: build
permissions:
contents: read
actions: read
packages: read
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build Server container images
run: |
npx nx affected --target=server-container-image --configuration=test --parallel=3
- name: Scan Server container images with Trivy
uses: ./.github/actions/trivy-scan-local-images
with:
sarif-category: trivy-images-server
- name: Generate container image SBOMs
uses: ./.github/actions/generate-container-image-sboms
with:
project-version: 0.0.0-SNAPSHOT
artifact-name: sbom-container-images-server
collect-sbom-artifacts:
name: Collect SBOM artifacts
runs-on: ubuntu-latest
needs:
- detect-affected
- build
- build-api-container-images
- build-worker-container-images
- build-vnc-container-images
- build-ssh-container-images
- build-agi-container-images
- build-server-container-images
if: always() && needs.detect-affected.outputs.has_affected == 'true'
steps:
- name: Download service SBOMs from build
uses: actions/download-artifact@v8
continue-on-error: true
with:
name: build-artifacts
path: .
- name: Download container image SBOM artifacts
uses: actions/download-artifact@v8
continue-on-error: true
with:
pattern: sbom-container-images-*
merge-multiple: true
path: container-sbom-download
- name: Merge SBOM artifacts
run: |
mkdir -p dist/sboms
if [ -d container-sbom-download ]; then
find container-sbom-download -type f -name 'container-*.cdx.json' -exec cp -n {} dist/sboms/ \;
fi
ls -la dist/sboms/ 2>/dev/null || true
- name: Upload SBOM artifacts
uses: actions/upload-artifact@v7
with:
name: sbom-artifacts
path: dist/sboms/
retention-days: 7
compression-level: 6
if-no-files-found: ignore
- name: Fail if required upstream jobs failed
if: always()
env:
BUILD: ${{ needs.build.result }}
API: ${{ needs.build-api-container-images.result }}
WORKER: ${{ needs.build-worker-container-images.result }}
VNC: ${{ needs.build-vnc-container-images.result }}
SSH: ${{ needs.build-ssh-container-images.result }}
AGI: ${{ needs.build-agi-container-images.result }}
SERVER: ${{ needs.build-server-container-images.result }}
run: |
for result in "$BUILD" "$API" "$WORKER" "$VNC" "$SSH" "$AGI" "$SERVER"; do
if [ "$result" = "failure" ]; then
echo "::error::An upstream SBOM build job failed"
exit 1
fi
done
build-scripts-binary:
name: Build Scripts Binaries
runs-on: ubuntu-latest
needs: build
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build binaries
run: npx nx affected --target=scripts-binary --parallel=3
build-openapi-clients-js:
name: Build OpenAPI JavaScript/TypeScript Clients
runs-on: ubuntu-latest
needs: build
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Install OpenAPI Generator CLI
run: |
npm install --ignore-scripts=false @openapitools/openapi-generator-cli
npx @openapitools/openapi-generator-cli version
- name: Build JavaScript/TypeScript clients
run: |
npx nx affected --target=openapi-client-js --configuration=test --parallel=3
build-native-applications-linux:
name: Build Linux Applications
runs-on: ubuntu-latest
needs: build
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Build binaries
env:
ELECTRON_FORGE_PLATFORM: linux
run: |
xvfb-run -a npx nx affected --target=package --configuration=development-linux --parallel=3
- name: Upload build artifacts
uses: actions/upload-artifact@v7
with:
name: binary-artifacts-linux
path: |
dist/**/out/make/**/*.zip
dist/**/out/make/**/*.deb
dist/**/out/make/**/*.rpm
retention-days: 1
compression-level: 6
build-native-applications-windows:
name: Build Windows Applications
runs-on: ubuntu-latest
needs: build
outputs:
has_windows_bundle: ${{ steps.detect-windows-bundle.outputs.exists }}
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Download build artifacts
uses: actions/download-artifact@v8
with:
name: build-artifacts
path: .
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Setup Windows build environment
uses: ./.github/actions/setup-windows-build-env
- name: Build binaries
env:
ELECTRON_FORGE_PLATFORM: win32
run: |
xvfb-run -a npx nx affected --target=package --configuration=development-windows --parallel=3
- name: Upload Windows Electron bundle
uses: actions/upload-artifact@v7
with:
name: windows-electron-bundle
path: dist/apps/agenstra/native-agent-console/out/native-agent-console-win32-x64
if-no-files-found: ignore
retention-days: 1
- name: Upload Windows zip artifacts
uses: actions/upload-artifact@v7
with:
name: binary-artifacts-windows
path: dist/**/out/make/**/win32/**/*.zip
if-no-files-found: ignore
retention-days: 1
compression-level: 6
- name: Detect Windows Electron bundle
id: detect-windows-bundle
if: ${{ !cancelled() }}
run: |
bundle_path="dist/apps/agenstra/native-agent-console/out/native-agent-console-win32-x64"
if [ -d "$bundle_path" ]; then
echo "exists=true" >> "$GITHUB_OUTPUT"
else
echo "exists=false" >> "$GITHUB_OUTPUT"
fi
build-native-applications-windows-installer:
name: Build Windows Installer
runs-on: windows-latest
needs: build-native-applications-windows
if: >-
needs.build-native-applications-windows.result == 'success' &&
needs.build-native-applications-windows.outputs.has_windows_bundle == 'true'
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Download Windows Electron bundle
uses: actions/download-artifact@v8
with:
name: windows-electron-bundle
path: windows-electron-bundle
- name: Build NSIS installer from prepackaged bundle
shell: pwsh
run: ./tools/ci/build-windows-installer.ps1
- name: Upload Windows installer artifacts
uses: actions/upload-artifact@v7
with:
name: binary-artifacts-windows-installer
path: apps/agenstra/native-agent-console/installer-out/*.exe
if-no-files-found: ignore
retention-days: 1
compression-level: 6
publish-native-applications:
name: Publish Native Applications
runs-on: ubuntu-latest
needs:
- detect-affected
- build-native-applications-linux
- build-native-applications-windows
- build-native-applications-windows-installer
if: needs.detect-affected.outputs.has_affected == 'true'
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0
- name: Set nx shas
uses: nrwl/nx-set-shas@v5
- name: Setup environment
uses: ./.github/actions/setup-env
- name: Download binaries
uses: actions/download-artifact@v8
continue-on-error: true
with:
path: artifacts
pattern: binary-artifacts-*
merge-multiple: true
- name: Consolidate binaries
run: |
mkdir -p release
mkdir -p artifacts
find artifacts -type f -name '*.zip' -exec cp {} release/ \;
find artifacts -type f -name '*.deb' -exec cp {} release/ \;
find artifacts -type f -name '*.rpm' -exec cp {} release/ \;
find artifacts -type f -name '*.exe' -exec cp {} release/ \;
find artifacts -type f -name '*.msi' -exec cp {} release/ \;
find artifacts -type f -name '*.msix' -exec cp {} release/ \;
- name: Generate desktop integrity manifests (SHA256SUMS + integrity-manifest.json)
run: |
shopt -s nullglob
files=(release/*)
if [ ${#files[@]} -eq 0 ]; then
echo "No desktop binaries in release/; skipping integrity manifests."
exit 0
fi
npx nx run release-integrity:build
node tools/release-integrity/dist/src/cli.js --input release
node tools/release-integrity/dist/src/cli.js verify --input release
- name: Upload binaries to GitHub Actions artifact
uses: actions/upload-artifact@v7
with:
name: binary-bundle
path: |
release/*.zip
release/*.deb
release/*.rpm
release/*.exe
release/*.msi
release/*.msix
release/SHA256SUMS
release/integrity-manifest.json
retention-days: 1
compression-level: 6