Conversation
feat: implement phase 01 and 02 backend foundations
- Introduced `README_zh-CN.md` for Chinese localization of project documentation. - Created `MARKDOWN-POLICY.md` to define the content policy for Markdown representation, transport, and pagination. - Established `ADR 0003` to document the decision on storing raw Markdown only and deriving representations at request time. - Updated progress documentation to reflect the current state of module 07 and its associated tasks. - Enhanced module plans to include new implementation items related to Markdown handling and representation. - Ensured all changes align with existing security and performance guidelines.
Add a "Commit messages" section to the repository guidance so commit format is stated in one place: type(scope): description, English, imperative lower-case subject without a trailing period, one coherent change per commit, and `!` plus a BREAKING CHANGE footer for incompatible changes. The allowed types match the change kinds this repository already uses and document, and no commit-msg hook enforces the convention yet.
Raise actions/checkout and actions/setup-node from v4 to v7 across all three jobs, and set node-version to 24 instead of the exact 24.21.0 so the runner takes the latest Node 24 patch. The major stays pinned to 24, which package.json still constrains with engines.node ">=24.21.0 <25". These edits were already present in the working tree from an earlier session and are committed here unchanged.
Scan the repository with CodeQL on pushes to main, pull requests, and a weekly schedule. The file comes from the GitHub advanced-setup template so the configuration stays reviewable and version-controlled rather than living only in repository settings. Populate the language matrix with javascript-typescript and build-mode: none. The template references matrix.build-mode but ships no such key, so the value has to be set explicitly; `none` builds a database without compiling, which suits an interpreted language. Keep the default query suite for now. The commented `queries: security-extended` line is the documented opt-in for broader but less precise coverage. Verified: YAML parses, all matrix references resolve, cron has five valid fields, and the checkout/setup-node/codeql-action tags resolve on GitHub. main has no branch protection, so findings are advisory and do not block merges.
List opened, synchronize, and reopened under the pull_request trigger. These are already the default activity types, so scanning behavior does not change; stating them makes PR submission and later head-branch updates checkable in the file itself instead of relying on an implicit default. Also document that a pull request with a merge conflict does not trigger the workflow until the conflict is resolved. Verified: YAML parses and the trigger, matrix, and schedule assertions hold. Fork pull request behavior for security-events: write remains unverified.
Add 01.3f and 01.V4 for static application security testing, append the required session entry, and update master status. 01.3b already covers SECURITY §127 with dependency, secret, and license scanning, and §127 does not request static analysis, so this is recorded as an extension rather than a corrected omission. Both items stay unchecked because no hosted CodeQL run exists yet. The module previously claimed every checklist item was complete. Adding two open items makes that false, so the module is now In progress in both its own record and master progress; the original foundation acceptance is unchanged and still met. Verified: the session entry carries all nine required fields, relative links across the three documents resolve, and the only unchecked items are 01.3f and 01.V4.
Drop the weekly cron trigger so analysis runs on a push to main or on pull-request activity and nowhere else. This accepts a real gap, recorded in the workflow itself so it reads as a deliberate choice rather than an oversight: CodeQL ships new and updated queries over time, so while the branch is dormant a newly disclosed vulnerability class will not surface until the next commit or pull request. Re-adding a cron restores periodic scanning. Verified: YAML parses, the only remaining triggers are push and pull_request, no cron remains in the file, and the matrix and steps are unchanged.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Bundle both runtime entry points and the workerd test fixtures with tsdown 0.23.0 on rolldown 1.2.9 instead of esbuild. tooling/build.mjs becomes tooling/build.ts, which owns dist/, builds each target through tsdown's programmatic API, and exposes --target=all|node|cloudflare|fixtures so a test lane builds only what it needs. Workerd resolution conditions, externals and target configuration move into tooling/bundler-options.ts and tooling/build-targets.ts, which tsdown.config.ts re-exports. Test files no longer bundle their own fixtures, so a fixture cannot drift from the deployed Worker profile. Code splitting stays enabled for apps/api-cloudflare, so its artifact is an entry plus content-hashed chunks. tests/fixtures/worker-modules.ts declares every emitted module because declaring only the entry fails at startup, and tests/workerd/entry.test.ts now starts that chunked production artifact. Fixtures are pinned to codeSplitting: false: a chunked fixture answered /health/ready with 500 in Miniflare while the chunked production Worker answered 200 from an identical module layout, and that interaction is unexplained. tests/node/entry.test.ts asserts the Node entry remains a single file so a future dynamic import cannot break the start command. Also make tooling/secrets.mjs skip paths that git reports as tracked but that are deleted in the working tree, which previously crashed the scan with ENOENT. Verified with the full local matrix; see docs/development/TOOLCHAIN.md.
Adopt the Oxc tooling direction recorded in ARCHITECTURE §45. oxlint 1.83.0 lints with no TypeScript compiler peer dependency, and oxfmt 0.68.0 formats TypeScript, JavaScript, JSON, Markdown and YAML, which Biome could not cover at all. tsc remains the only type checker; oxlint's type-aware mode is not adopted. .oxlintrc.json mirrors tooling/check-boundaries.mjs for the syntax-level half of the import policy: per-package eslint/no-restricted-imports with negated-group allow-lists, import/extensions for the .ts specifier convention, and the correctness/suspicious/perf categories. pnpm lint now runs with --deny-warnings, so a new warning fails the gate. The boundary script stays because only path resolution can enforce package manifests and relative cross-package ownership. tests/unit/oxlint-config.test.ts keeps negative fixtures that must fail, because oxlint does not validate rule options at runtime and a misspelled key would otherwise fail open. .oxfmtrc.json reproduces the previous style and keeps sortPackageJson and sortImports disabled. docs/** stays excluded, so historical planning documents are not reformatted; AGENTS.md, the READMEs and .github/** are now covered, closing the gap recorded in module 01. biome.json, .prettierrc.json and .prettierignore are removed.
Format the workspace with oxfmt under the previous Prettier style. The source change is packages/domain/src/index.ts, where oxfmt breaks the leading-operator union onto separate lines; the rest is Markdown, YAML and JSON touch-ups in AGENTS.md, the READMEs and .github/workflows/codeql.yml. docs/** and .agents/** are excluded: historical planning documents keep their layout and the guidance skills stay under hand maintenance. packages/server/src/bounds.ts gains one scoped no-await-in-loop disable: reading a ReadableStreamDefaultReader is inherently sequential and the body bound is enforced per chunk as it arrives. Record the migration in ADR 0004, mark the superseded tooling paragraph in ADR 0001, refresh the TOOLCHAIN component table, install policy, formatter scope and development commands, and note in the module 01 evidence that the hosted runs recorded there were produced with esbuild, Biome and Prettier and must be re-confirmed. Verified locally: frozen install, typecheck, lint, format:check (idempotent on a second run), db:check, build, unit/contract 11, Node 10, workerd 36, PostgreSQL 24 = 81 ordinary tests, scan:secrets, scan:licenses and the high-severity audit gate. Hosted CI has not run against the new toolchain.
…ument website with VitePress
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.