Hermetic web builds and one Node version (attn-6q7b) - #20
Draft
angusbezzina wants to merge 1 commit into
Draft
Conversation
The web staging deploy was blocked on 2026-09-03 by two build-infrastructure failures unrelated to product code, and the fix that unblocked it (pinning npm 11 in the deploy job, PR #18) is a workaround. This epic resolves the causes so they stop recurring, before the next release is cut. attn-6q7b Hermetic web builds and one Node version across CI and deploy attn-6q7b.1 Vendor the icon packs and drop the three git dependencies attn-6q7b.2 Run one Node version: align ci.yml with the deploy job attn-6q7b.3 Retire the npm@11 pin from the deploy job (after .1) attn-6q7b.4 Run the native-hosted parity suite in CI (after .2) attn-6q7b.5 Prove it on a fresh clone and write it down (after all) Not one git dependency but three: eyecons, catppuccin-vsc-icons and vscode-icons are all git+ssh:// in the lockfile, and none has a usable registry package (eyecons on npm is a 0.0.1 placeholder; the other two are unpublished), so vendoring is the only hermetic option. Node 22 is a hard floor, not a preference — wrangler 4 in web/ refuses anything older — yet ci.yml still runs 20 and the root engines field still says >=18. This commit carries only the beads export. .beads/issues.jsonl had not been exported since 2026-07-23 (448 issues); the DB now holds 767. The diff is that resync — 199 issues added, 27 updated, none removed — plus the six records above. Implementation lands on this branch behind it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015TnncCnVNhggoZ9QLQiqeW
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft — planning only. This PR carries the epic and its beads export; implementation lands on this branch behind it.
Why
The web staging deploy was blocked on 2026-09-03 by two build-infrastructure failures with no product-code cause. PR #18 unblocked it by pinning npm 11 in the deploy job — a workaround, not a fix. Each cause will recur until resolved.
Epic
attn-6q7battn-6q7b.1attn-6q7b.2attn-6q7b.3attn-6q7b.4attn-6q7b.5.1and.2are independent and can run in parallel.Findings that shaped the plan
eyecons,catppuccin-vsc-icons, andvscode-iconsare allgit+ssh://inweb/package-lock.json. The lockfile pins each commit, but npm still clones each repo and resolves that project's floatingpackage.jsonagainst the live registry on every install — which is how an upstream eslint 10 publish crashed npm 10's arborist with no change here.eyeconson npm is a0.0.1placeholder; the other two are unpublished. Vendoring is the only hermetic path. The generator's output is ~13 MB / 2,777 SVGs and is gitignored today;.1records the design choice (vendor sources vs commit generated output) and recommends committing the output.web/depends on wrangler ^4.110, which refuses Node <22 — yetci.ymlruns all four jobs on 20, the rootenginesfield says>=18, and there is no.nvmrc. That split is why CI never saw the failure the deploy hit.scripts/test-hosted-review-e2e.shis referenced by exactly one workflow, the dispatch-only deploy. That is how the owner-rail regression fixed in Fix the owner's review rail going blank on an uncurated share #19 sat through two merges and a version bump.About the diff
.beads/issues.jsonlhad not been exported since 2026-07-23 (448 issues); the DB now holds 767. The diff is that resync — 199 issues added, 27 updated, none removed — plus the six records above. Verified no tracked id is missing from the export.Out of scope
attn.sh/reviewstill 404s (apex served by a stale Vercel deploy; onlystaging.attn.shruns the worker). Native mints share links there, so links from a released binary are broken today. Separate issue; noted so it isn't forgotten before the tag.🤖 Generated with Claude Code
https://claude.ai/code/session_015TnncCnVNhggoZ9QLQiqeW