Conversation
Build & push (docs.yml, prod-release.yml) now run on self-hosted [self-hosted, codeformers] (cfnode1) with GHCR auth via GITHUB_TOKEN instead of a long-lived PAT mounted on the host - no more ~/.env.ksefnik dependency, no more macmini-specific paths. Deploy step moved from `ssh codeformers "..."` to a separate job pinned to [self-hosted, vps-codeformers] which runs the deploy.sh on the docs VPS directly. That removes the SSH key on the build host and lets us add more VPSes later by just registering more org runners with the codeformers-vps / vps-shared / vps-<name> label triple. VPS-side .env (REPO_TOKEN_GITHUB_PAT) is untouched - kept for `docker pull` after the job ends (consistent with OxStudio's vps-prod convention).
Previous pipeline crammed everything (install, build, test, bump, npm publish,
git tag, GH release, docker build, GHCR push, VPS deploy) into one job. If any
step past 'npm publish' failed, the release was left in an inconsistent state
(packages on npm, no tag in git, no docker image, no VPS deploy) with no clean
way to retry just the failed stage.
New shape:
verify - install/build/typecheck/test on the current SHA, uploads dist.
Pure validation, mutates nothing, safe to rerun.
publish-npm - downloads dist, bumps versions, publishes to npm, commits +
tags + GH release. After this job the new vX.Y.Z tag exists
on origin/prod.
build-docs - checks out the v${VERSION} tag, builds the docs image, pushes
to GHCR. Re-running this job is idempotent (same tag → same
image content), so a flaky GHCR push can be retried alone.
deploy - pulls the new image on the VPS, recreates the container,
smoke-tests. Re-running just pulls latest again.
sync-back - opens a PR prod → main so the bump lands back in main.
Added workflow_dispatch with dry_run=true (default). Lets us validate the whole
verify path without publishing or tagging - useful for testing pipeline changes
without burning a real release version.
Adds an opt-in `saveDir` parameter to the sync_invoices MCP tool. When set,
the tool fetches the full FA(2)/FA(3) XML for each invoice (via the existing
fetchInvoiceXml HTTP path) and writes one file per invoice to
${saveDir}/${ksefReferenceNumber}.xml. mkdir -p semantics, absolute or
relative paths accepted (relative resolved against cwd of the MCP host).
Plumbing for the new option:
shared FetchInvoicesOpts.includeXml: documents the flag + that rawXml
lands on Invoice.rawXml when set (was already handled by adapter).
core KsefClient.fetchInvoices gains optional includeXml. KsefAdapter
forwards it to the underlying client.
http KsefHttpClient.fetchInvoices forwards includeXml. Adds
fetchInvoiceXml(token, ksefNumber) public method backed by the
existing http/invoices.ts helper so non-MCP consumers can also
grab single XMLs.
Default behavior unchanged — fetchInvoices without includeXml still returns
metadata only.
feat(mcp): saveDir option for sync_invoices tool
Previous implementation called gh api orgs/<org>/members/<user> with the workflow's GITHUB_TOKEN. The token authenticates as github-actions[bot] which is NOT an org member, so the API returns 404 for members whose membership is private - the script read that as "external contributor" and closed the PR. Symptom: PR main → prod opened by an admin/maintainer was auto-closed with the "PRs to prod are restricted to org members" comment. push:prod events were unaffected because guard-prod only runs on pull_request_target. Fix: use github.event.pull_request.author_association which GitHub already computes server-side per event. Values OWNER, MEMBER, COLLABORATOR allow the PR; anything else (CONTRIBUTOR / FIRST_TIME_CONTRIBUTOR / NONE) closes it. No extra API call, no token scope dependency, no private-membership false negatives.
…ciation fix(ci): guard-prod uses author_association instead of org members API
Contributor
|
PRs to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-open of #9 (closed by buggy guard-prod, fixed in #10). Merging this triggers the new 4-job release pipeline to publish @ksefnik/* v0.5.0 and deploy docs.
What ships
Pipeline (5 jobs)