chore(deps): Bump pnpm/action-setup from 5.0.0 to 6.0.9 - #3
Closed
dependabot[bot] wants to merge 17 commits into
Closed
chore(deps): Bump pnpm/action-setup from 5.0.0 to 6.0.9#3dependabot[bot] wants to merge 17 commits into
dependabot[bot] wants to merge 17 commits into
Conversation
Apache-2.0 licensing (REUSE-compliant), OSPO community files, Conventional Commits enforcement via commitlint/husky, CI workflow covering frontend/backend/e2e jobs, and the local dev docker-compose stack (oCIS + Traefik + ai-llm-proxy + this backend), all based on owncloud/web-app-skeleton's conventions. Signed-off-by: Lukas Hirt <info@hirt.cz>
Extension entry point registers AI Workflows as a full app (nav item + own routes), scaffolded from web-app-skeleton's defineWebApplication pattern. Adds a workflow list view backed by the Graph-shaped backend CRUD API, and a Vue Flow canvas for building trigger/LLM/action node graphs. No execution yet — that lands with the backend graph interpreter. Signed-off-by: Lukas Hirt <info@hirt.cz>
Standalone HTTP service (chi router, stdlib log/slog, no ocis-pkg or reva dependency) that validates bearer tokens itself against oCIS's IdP userinfo endpoint, exactly like a well-behaved external sidecar. Workflow definitions are persisted as JSON via WebDAV in the caller's own oCIS space (no NATS, no system-user credential, no internal gRPC), with a /me/workflows CRUD surface shaped after oCIS's Graph API conventions (value-wrapped collections, PATCH updates, Graph-style error envelopes). Signed-off-by: Lukas Hirt <info@hirt.cz>
Two issues found while getting the builder canvas working against a real oCIS Web instance: (1) vue-router isn't among extension-sdk's externalized deps, so importing useRouter/useRoute from 'vue-router' directly bundles a second, disconnected router instance whose injection silently resolves to undefined — switched to @ownclouders/web-pkg's useRouter/useRoute, which share the host app's actual router; (2) client-side navigation into this app's :id sub-route throws inside Web's persistent-layout sidebar code (a resource-injection assumption unrelated to this app), so list<->builder navigation uses a hard navigation instead, which is proven reliable. Also excludes tests/e2e from vitest's default include pattern, since extension-sdk's own exclude list only accounts for a top-level e2e/ directory. Signed-off-by: Lukas Hirt <info@hirt.cz>
LLM calls are now made directly by the backend against a configured LLM_ENDPOINT/LLM_API_KEY — no external ai-llm-proxy service, no web-extensions sibling checkout needed for local dev. Extends the dev docker-compose stack with the workflows backend as a Traefik-routed sidecar (path-prefixed + stripped, same pattern ai-llm-proxy used to occupy) and enables PROXY_ENABLE_APP_AUTH/auth-app on the oCIS container, since background/automated workflow runs will authenticate via oCIS app-passwords now that LLM calls no longer require a real IdP-issued token to reach an external validator. Signed-off-by: Lukas Hirt <info@hirt.cz>
Backend suite (build-tagged e2e) makes real HTTP calls through Traefik against the live compose stack and asserts on Graph-shaped responses — no mocks. Frontend suite drives a real browser through login, building a trigger->LLM->action graph on the Vue Flow canvas, and saving it. Both share get-token.ts, a small headless-Playwright script that logs in through oCIS's real sign-in page: the IdP hashes credentials client-side, so there is no plain HTTP request to replay to obtain a token, and a real browser session is the only practical way to get one. All actual assertions in the backend suite are still plain Go net/http against the real API. Signed-off-by: Lukas Hirt <info@hirt.cz>
Per explicit direction: n8n's UX, not its branding/colors. Replaces the fixed "Add LLM step"/"Add action" toolbar with a searchable, categorized node-type picker triggered by "+" (on an empty canvas or on a node's output handle, auto-connecting when opened from a node). Node cards on the canvas are now compact and display-only; clicking one opens a Node Details View modal for configuration instead of inline form fields. Top bar gains an inline-editable workflow name and an Active/Inactive toggle. Adds a minimap and re-fits the viewport after each node is added, since newly added nodes otherwise render further right each time without ever re-centering. Also fixes two bugs the rework's e2e coverage caught: a v-model directive ordering lint warning, and a template attribute with literal double quotes inside a double-quoted HTML attribute that vue-tsc rejected as a syntax error. Signed-off-by: Lukas Hirt <info@hirt.cz>
The single interpreter every workflow run (manual/scheduled/event)
goes through: walks a workflow's trigger->llm->action graph, calling
this backend's own directly-configured LLM_ENDPOINT for llm nodes
(pkg/llm, no external proxy) and oCIS's WebDAV/Graph APIs for action
nodes with the run's own token. {{file.name}}/{{file.content}}/
{{llm.output}} template variables are substituted into prompts and
action params; node/edge "condition" fields are stored but not yet
evaluated (every reachable node runs unconditionally for now).
Action handlers (pkg/webdavfile, pkg/ocisclient/tags.go):
- tag: real Graph tags API. Resolving a WebDAV path to the Graph
resourceId turned out to need a PROPFIND for the oc:fileid WebDAV
property, not a Graph path-lookup endpoint — Graph has none.
- move/copy/rename: real WebDAV MOVE/COPY.
- comment: oCIS has no native file-comments API, unlike tags — this
writes a JSON sidecar list under the user's own .workflows/
folder instead. Real and retrievable, documented as not visible in
oCIS Web's own UI, not a stub.
- notify: github.com/unraid/apprise-go (BSD-2-Clause, see NOTICE.md),
100+ integrations behind one target-URL scheme, with an SSRF guard
on the generic webhook schemes.
Execution history is stored the same way workflow definitions are —
JSON via WebDAV in the caller's own space — and the run endpoint
responds the way a real Graph async action would (202 + Location),
even though execution is currently synchronous.
Adds a fake-llm fixture (cmd/fakellm, a ~30-line OpenAI-compatible
stub) to the dev stack so it — and its e2e suite — never depend on a
real LLM provider being reachable.
Signed-off-by: Lukas Hirt <info@hirt.cz>
New "Executions" panel: a resourcePath input + Run now button, and the run history below it (status pill, per-node results). runWorkflow parses the execution id out of the 202 response's Location header rather than assuming a body, matching the backend's Graph-style async action shape. Signed-off-by: Lukas Hirt <info@hirt.cz>
Backend: uploads a real file, runs a trigger->llm->tag graph through the real API, and asserts the tag actually landed by reading it back over WebDAV — no mocks. Frontend: builds and saves a workflow through the UI, runs it via the Executions panel, and asserts success and the LLM output render. Also fixes both existing specs to clean up the workflows/files they create (build-workflow.spec.ts now does it via the UI's own delete button, exercising that flow too) — a prior run left test data behind that only surfaced when checking the store by hand. Signed-off-by: Lukas Hirt <info@hirt.cz>
…oken webdavstore, webdavfile, and ocisclient all hard-coded "Bearer "+token when setting the Authorization header. Scheduled/event-triggered runs (next up) authenticate to oCIS with an app-password over HTTP Basic, not a bearer token, so these packages now take the full header value as-is and every call site formats it. Manual runs are unaffected — callers just now write "Bearer "+token explicitly instead of it being implicit three packages down. Signed-off-by: Lukas Hirt <info@hirt.cz>
Enabling automation (POST /me/automation) mints an oCIS app-password via auth-app using the caller's own live token in the same request — no separate consent redirect needed, since the user is already authenticated to our API at that moment. The credential is encrypted (AES-256-GCM, pkg/secretbox) and stored in a new local SQLite database (pkg/localdb, pure-Go driver) — this is the sidecar's own operational state, not user content, so it never goes through any oCIS API. A background scheduler (pkg/scheduler) polls a denormalized trigger index for due schedule-triggered workflows and runs them through the same executor as manual runs, authenticating via the owner's stored app-password over HTTP Basic — no live session involved. The trigger index is kept in sync automatically whenever a workflow with a schedule/event trigger is created, updated, or deleted. Verified end-to-end against the real stack: connect mints a real app-password, a workflow scheduled for "every second" actually fires on its own using that stored credential, and disconnect revokes it. Cron expressions accept an optional leading seconds field (still backwards compatible with classic 5-field syntax) — mainly so tests (and anyone who wants sub-minute schedules) aren't stuck waiting on minute boundaries. Signed-off-by: Lukas Hirt <info@hirt.cz>
Automation is per-user, not per-workflow, so it's a status pill and toggle button in the workflow list header rather than anything per-row: shows whether background execution is enabled and lets the user connect (mint an app-password) or disconnect (revoke it) it. test(e2e): cover automation and scheduled execution end-to-end Backend: connects automation (mints a real auth-app token), verifies status, disconnects (revokes it) — then separately, creates a schedule-triggered workflow and polls until it actually fires on its own via the background scheduler, authenticated with the stored app-password, no live session involved. Frontend: exercises the connect/disconnect UI, including that the connected state survives a page reload. Signed-off-by: Lukas Hirt <info@hirt.cz>
Add a per-user SSE consumer manager that reconciles against the trigger index and runs event-triggered workflows through the same executor manual/scheduled runs use, resolving SSE spaceId/itemId payloads to WebDAV paths via Graph's drive-item-by-id endpoint. No NATS client is involved anywhere in the process. Guard event matching against this backend's own .workflows bookkeeping writes (workflow definitions, execution records) - without it, an event trigger with no path filter is indistinguishable from a real upload and re-triggers itself on every execution it records. Also fixes a schema migration gap: trigger_index rows created before this milestone lacked the new path_prefix/extension columns, and CREATE TABLE IF NOT EXISTS is a no-op against an existing table. Signed-off-by: Lukas Hirt <info@hirt.cz>
Backend: connect automation, create an upload-triggered workflow scoped to a path/extension filter, upload a matching file over WebDAV, and assert the workflow fires on its own via the SSE consumer - no manual/scheduled trigger involved. Frontend: build a workflow with a File Event Trigger node, configure its event type and path filter through the Node Details panel, and confirm both persist across a reload. Widen the scheduled-trigger test's polling window: with the SSE manager now running continuously alongside the scheduler, first-fire latency under load comfortably exceeds the original 25s budget. Signed-off-by: Lukas Hirt <info@hirt.cz>
Add a reuse job running fsfe/reuse-action so REUSE/SPDX compliance is enforced on every push and PR, not just checked manually. Fixes the one pre-existing gap it surfaces: LICENSES/BSD-2-Clause.txt (bundled for apprise-go's redistribution requirement, since it's statically linked into the backend binary) wasn't referenced by any SPDX tag, since apprise-go itself isn't vendored into this repo - tag NOTICE.md, the file that documents it, with the combined license identifier. Add a dependency license check to the frontend CI job (scripts/check-licenses.mjs, via `pnpm licenses list --json`) that fails on any GPL/AGPL/LGPL/MPL-family dependency other than @ownclouders/* - ownCloud Web's own AGPL-3.0 SDK, unavoidable for any Web extension and already an accepted, load-bearing dependency here. Drop the stable-* branch trigger: there's no such branch in this repo. Signed-off-by: Lukas Hirt <info@hirt.cz>
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.9. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...0ebf471) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/pnpm/action-setup-6.0.9
branch
July 20, 2026 11:52
4 tasks
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps pnpm/action-setup from 5.0.0 to 6.0.9.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
0ebf471fix: update pnpm to v11.7.0 (#267)0e279bbfix: update pnpm to 11.1.1 (#248)3e83581fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)551b42edocs(README): fixcache_dependency_pathtype (#257)739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)f61705dchore: add CODEOWNERS7a5507bfix: restore inputs from state in post (#255)1155470fix: honor devEngines.packageManager.onFail=error (#252) (#254)91ab88efix: bin_dest output points to self-updated pnpm, not bootstrap (#249)e578e19fix: update pnpm to 11.0.4Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)