@openhands/extensions 0.20.0 → 0.22.0

package/.github/workflows/check-extensions.yml

@@ -58,6 +58,8 @@ jobs:
         run: python scripts/sync_extensions.py --check
 
   sync-sdk-skill:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -69,4 +71,6 @@ jobs:
           python-version: "3.12"
 
       - name: Check SDK skill is up to date
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: python scripts/sync_openhands_sdk_skill.py --check

package/.github/workflows/npm-publish.yml

@@ -56,14 +56,19 @@ jobs:
           fi
           echo "✓ npm $NPM_VERSION meets trusted publishing requirements"
 
-      # No install/test/build steps: @openhands/extensions ships source directly
-      # (plain ESM + hand-written .d.ts + JSON catalogs) with only peerDependencies,
-      # and has no build script, test suite, or lockfile.
+      # npm omits symlinks. Materialize shared resources in a release-only copy;
+      # retain the canonical linked source layout in the checkout.
+      - name: Stage package with linked resources
+        run: |
+          mkdir -p "$RUNNER_TEMP/extensions-package"
+          cp -RL . "$RUNNER_TEMP/extensions-package/"
 
       - name: Verify package contents
+        working-directory: ${{ runner.temp }}/extensions-package
         run: npm pack --dry-run
 
       - name: Validate package version matches release tag
+        working-directory: ${{ runner.temp }}/extensions-package
         env:
           # Pass inputs.tag via env var to prevent script injection from
           # GitHub Actions expression interpolation inside run blocks.
@@ -86,4 +91,5 @@ jobs:
           echo "✓ Version $PACKAGE_VERSION matches release tag"
 
       - name: Publish to npm with provenance
+        working-directory: ${{ runner.temp }}/extensions-package
         run: npm publish --access public --provenance

package/.github/workflows/pr-artifacts.yml

@@ -0,0 +1,294 @@
+---
+name: PR Artifacts
+
+on:
+    workflow_dispatch: # Manual trigger for testing
+    pull_request_target:
+        types: [opened, synchronize, reopened, closed]
+        branches: [main]
+    pull_request_review:
+        types: [submitted]
+
+jobs:
+  # Auto-remove .pr/ directory from same-repository PRs when approved.
+    cleanup-on-approval:
+        concurrency:
+            group: cleanup-pr-artifacts-${{ github.event.pull_request.number }}
+            cancel-in-progress: false
+        if: >-
+            github.event_name == 'pull_request_review' &&
+            github.event.review.state == 'approved' &&
+            github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        steps:
+            # Use PAT so the push triggers CI workflows that will complete and
+            # satisfy branch protection. We can't use [skip ci] because GitHub Apps
+            # can create stuck checks that block merging.
+            - uses: actions/checkout@v7
+              with:
+                  ref: ${{ github.event.pull_request.head.ref }}
+                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
+
+            - name: Remove .pr/ directory
+              id: remove
+              run: |
+                  if [ -d ".pr" ]; then
+                    git config user.name "allhands-bot"
+                    git config user.email "allhands-bot@users.noreply.github.com"
+                    git rm -rf .pr/
+                    git commit -m "chore: Remove PR-only artifacts [automated]"
+                    git push || {
+                      echo "::error::Failed to push cleanup commit. Check branch protection rules."
+                      exit 1
+                    }
+                    echo "removed=true" >> "$GITHUB_OUTPUT"
+                    echo "::notice::Removed .pr/ directory"
+                  else
+                    echo "removed=false" >> "$GITHUB_OUTPUT"
+                    echo "::notice::No .pr/ directory to remove"
+                  fi
+
+            - name: Update PR comment after cleanup
+              if: steps.remove.outputs.removed == 'true'
+              uses: actions/github-script@v9
+              with:
+                  script: |
+                      const marker = '<!-- pr-artifacts-notice -->';
+                      const body = `${marker}
+                      ✅ **PR Artifacts Cleaned Up**
+
+                      The \`.pr/\` directory has been automatically removed.
+                      `;
+
+                      const comments = await github.paginate(
+                        github.rest.issues.listComments,
+                        {
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          per_page: 100,
+                        },
+                      );
+
+                      const existing = comments.find(c => c.body.includes(marker));
+                      if (existing) {
+                        await github.rest.issues.updateComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          comment_id: existing.id,
+                          body: body,
+                        });
+                      }
+
+  # Inspect the fork through the API; never check out untrusted code with a write token.
+    check-pr-artifacts:
+        if: >-
+            github.event_name == 'pull_request_target' &&
+            github.event.action != 'closed'
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            pull-requests: write
+        steps:
+            - name: Post or update PR comment
+              uses: actions/github-script@v9
+              with:
+                  script: |
+                      const marker = '<!-- pr-artifacts-notice -->';
+                      const pullRequest = context.payload.pull_request;
+                      const headRepository = pullRequest.head.repo;
+                      let exists = true;
+
+                      try {
+                        await github.rest.repos.getContent({
+                          owner: headRepository.owner.login,
+                          repo: headRepository.name,
+                          path: '.pr',
+                          ref: pullRequest.head.sha,
+                        });
+                      } catch (error) {
+                        if (error.status === 404) {
+                          exists = false;
+                        } else {
+                          throw error;
+                        }
+                      }
+
+                      const comments = await github.paginate(
+                        github.rest.issues.listComments,
+                        {
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          per_page: 100,
+                        },
+                      );
+                      const existing = comments.find(c => c.body.includes(marker));
+
+                      if (!exists) {
+                        if (existing) {
+                          await github.rest.issues.updateComment({
+                            owner: context.repo.owner,
+                            repo: context.repo.repo,
+                            comment_id: existing.id,
+                            body: `${marker}
+                            ✅ **PR Artifacts Cleaned Up**
+
+                            The \`.pr/\` directory is no longer present.
+                            `,
+                          });
+                        }
+                        return;
+                      }
+
+                      const isFork = headRepository.full_name !== context.payload.repository.full_name;
+                      const cleanup = isFork
+                        ? 'Because this is a fork PR, the workflow will **open or update a cleanup PR against `main` after merge**.'
+                        : 'The directory will be **automatically removed when the PR is approved**.';
+                      const body = `${marker}
+                      📁 **PR Artifacts Notice**
+
+                      This PR contains a \`.pr/\` directory with temporary PR-specific documents. ${cleanup}
+                      `;
+
+                      core.warning('.pr/ directory contains temporary PR-only artifacts');
+                      if (existing) {
+                        await github.rest.issues.updateComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          comment_id: existing.id,
+                          body: body,
+                        });
+                      } else {
+                        await github.rest.issues.createComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          body: body,
+                        });
+                      }
+
+  # Fork branches cannot be modified reliably. If artifacts reach the trusted base,
+  # remove them through a pull request so branch protections remain enforced.
+    cleanup-after-merge:
+        concurrency:
+            group: cleanup-pr-artifacts-${{ github.event.pull_request.base.ref }}
+            cancel-in-progress: false
+        if: >-
+            github.event_name == 'pull_request_target' &&
+            github.event.action == 'closed' &&
+            github.event.pull_request.merged == true
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        steps:
+            - uses: actions/checkout@v7
+              with:
+                  ref: ${{ github.event.pull_request.base.ref }}
+                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
+
+            - name: Create or update cleanup PR
+              id: cleanup
+              env:
+                  BASE_REF: ${{ github.event.pull_request.base.ref }}
+                  CLEANUP_BRANCH: automation/remove-pr-artifacts
+                  GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
+              run: |
+                  if [ ! -d ".pr" ]; then
+                    echo "created=false" >> "$GITHUB_OUTPUT"
+                    echo "::notice::No .pr/ directory to remove from $BASE_REF"
+                    exit 0
+                  fi
+
+                  git config user.name "allhands-bot"
+                  git config user.email "allhands-bot@users.noreply.github.com"
+                  git fetch origin \
+                    "+refs/heads/$CLEANUP_BRANCH:refs/remotes/origin/$CLEANUP_BRANCH" || true
+                  git checkout -B "$CLEANUP_BRANCH"
+                  git rm -rf .pr/
+                  git commit \
+                    -m "chore: remove merged PR artifacts" \
+                    -m "Co-authored-by: openhands <openhands@all-hands.dev>"
+                  git push --force-with-lease origin "HEAD:$CLEANUP_BRANCH"
+
+                  cleanup_pr_url=$(gh pr list \
+                    --base "$BASE_REF" \
+                    --head "$CLEANUP_BRANCH" \
+                    --state open \
+                    --json url \
+                    --jq '.[0].url')
+
+                  if [ -z "$cleanup_pr_url" ]; then
+                    cleanup_pr_url=$(gh pr create \
+                      --base "$BASE_REF" \
+                      --head "$CLEANUP_BRANCH" \
+                      --title "chore: remove merged PR artifacts" \
+                      --body-file - <<EOF
+                  ## Why
+
+                  Temporary \`.pr/\` artifacts reached \`$BASE_REF\` through one or more merged PRs.
+
+                  ## Summary
+
+                  - Remove the temporary \`.pr/\` directory from \`$BASE_REF\`.
+
+                  ## How to Test
+
+                  - Confirm this PR only deletes files under \`.pr/\`.
+                  - Let the required checks validate the cleanup commit.
+
+                  ---
+
+                  _This PR was automatically created by the PR Artifacts workflow._
+                  EOF
+                    )
+                  fi
+
+                  echo "created=true" >> "$GITHUB_OUTPUT"
+                  echo "pr_url=$cleanup_pr_url" >> "$GITHUB_OUTPUT"
+                  echo "::notice::Cleanup PR ready: $cleanup_pr_url"
+
+            - name: Update source PR comment
+              if: steps.cleanup.outputs.created == 'true'
+              uses: actions/github-script@v9
+              env:
+                  CLEANUP_PR_URL: ${{ steps.cleanup.outputs.pr_url }}
+              with:
+                  script: |
+                      const marker = '<!-- pr-artifacts-notice -->';
+                      const body = `${marker}
+                      🧹 **PR Artifact Cleanup Queued**
+
+                      The \`.pr/\` directory reached \`${context.payload.pull_request.base.ref}\` after merge. A cleanup PR has been opened or updated: ${process.env.CLEANUP_PR_URL}
+                      `;
+
+                      const comments = await github.paginate(
+                        github.rest.issues.listComments,
+                        {
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          per_page: 100,
+                        },
+                      );
+                      const existing = comments.find(c => c.body.includes(marker));
+
+                      if (existing) {
+                        await github.rest.issues.updateComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          comment_id: existing.id,
+                          body: body,
+                        });
+                      } else {
+                        await github.rest.issues.createComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          body: body,
+                        });
+                      }

package/.github/workflows/pr-description-check.yml

@@ -17,13 +17,15 @@ jobs:
     validate-pr-description:
         name: Validate PR description
         # Draft PRs may still have incomplete descriptions; validate when review starts.
-        # Release PRs are generated by the trusted prepare-release workflow without
+        # Release and artifact-cleanup PRs are generated by trusted workflows without
         # the standard human-authored PR template.
         if: >-
             github.event.pull_request.draft == false &&
             github.event.pull_request.user.login != 'dependabot[bot]' &&
             !(github.event.pull_request.head.repo.full_name == github.repository &&
-            startsWith(github.event.pull_request.head.ref, 'release-please-'))
+            (startsWith(github.event.pull_request.head.ref, 'release-please-') ||
+            (github.event.pull_request.base.ref == 'main' &&
+            github.event.pull_request.head.ref == 'automation/remove-pr-artifacts')))
         runs-on: ubuntu-latest
         steps:
             - name: Checkout trusted workflow scripts