@stacksjs/defaults 0.74.33 → 0.74.35

package/routes/dashboard-api.ts

@@ -247,9 +247,34 @@ route.group({ prefix: '/api/dashboard', apiResponse: true }, () => {
   guard(route.post('/files/uploads', 'Actions/Dashboard/Content/FileUploadAction'))
   guard(route.patch('/files', 'Actions/Dashboard/Content/FileRenameAction'))
   guard(route.put('/files/visibility', 'Actions/Dashboard/Content/FileVisibilityAction'))
+  // Favourites and tags are the metadata layer, not a storage operation: a disk
+  // has nowhere to record either, so both write `storage_items` and the listing
+  // above joins them back on (stacksjs/stacks#2577).
+  guard(route.put('/files/favorite', 'Actions/Dashboard/Content/FileFavoriteAction'))
+  guard(route.put('/files/tags', 'Actions/Dashboard/Content/FileTagsAction'))
+  // Re-running the background processing (stacksjs/stacks#2578). Not optional:
+  // the first version of any of these produces output somebody wants
+  // regenerated - a better ladder, a model that has improved, an optimization
+  // that ran before a preset changed.
+  guard(route.post('/files/reprocess', 'Actions/Dashboard/Content/FileReprocessAction'))
   guard(route.post('/files/duplicates', 'Actions/Dashboard/Content/FileDuplicateAction'))
   guard(route.delete('/files', 'Actions/Dashboard/Content/FileDestroyAction'))
 
+  /*
+   * Remote commands (stacksjs/stacks#960).
+   *
+   * Deliberately NOT behind `guard()`. That helper drops auth entirely when
+   * `APP_ENV` is local, development or test - which is a reasonable trade for
+   * operational telemetry on a developer machine, and an unauthenticated
+   * command runner for this. `authenticatedGuard` keeps `auth` in every
+   * environment, the same treatment billing gets and for the same reason.
+   *
+   * Authorization proper is the `run-remote-command` gate, checked per host and
+   * per command inside the action. Being authenticated is not being allowed.
+   */
+  authenticatedGuard(route.get('/remote/commands', 'Actions/Dashboard/Remote/RemoteCommandIndexAction'))
+  authenticatedGuard(route.post('/remote/run', 'Actions/Dashboard/Remote/RemoteCommandRunAction'))
+
   guard(route.get('/ci/status', 'Actions/Dashboard/Ci/StatusAction'))
   // CI drilldown (stacksjs/stacks#1848): per-repo run history + per-run
   // job detail. On-demand reads so the polled snapshot stays cheap.

package/vcs/github/workflows/buddy-bot.yml

@@ -0,0 +1,109 @@
+# The one dependency bot a generated app gets.
+#
+# The template used to ship a `renovate.json` instead, which opted every new app
+# into a bot the framework's own policy does not use (AGENTS.md: "buddy-bot
+# handles dependency updates, not renovatebot"). Running both is what
+# stacksjs/stacks#2574 is about: the same bump arrives twice, two dashboards
+# disagree, and a human picks a winner with nothing recording why.
+#
+# This is the app-shaped version of the framework's own buddy-bot workflow -
+# the three scheduled jobs and the manual trigger, without the framework's
+# release plumbing. Configure it in `config/buddy-bot.ts`.
+name: Buddy Bot
+
+on:
+  schedule:
+    # Look for updates every two hours, then refresh the dashboard 15 minutes
+    # later so it reflects the pull requests that run just opened.
+    - cron: '0 */2 * * *'
+    - cron: '15 */2 * * *'
+    # Daily: close pull requests whose update already landed, and clean up the
+    # branches left behind.
+    - cron: '0 4 * * *'
+
+  workflow_dispatch:
+    inputs:
+      job:
+        description: Which job to run
+        required: false
+        default: all
+        type: choice
+        options:
+          - all
+          - check
+          - update
+          - dashboard
+      strategy:
+        description: Update strategy
+        required: false
+        default: patch
+        type: choice
+        options:
+          - all
+          - major
+          - minor
+          - patch
+      dry_run:
+        description: Dry run (preview only)
+        required: false
+        default: false
+        type: boolean
+
+env:
+  # The built-in token is enough for commits, pull requests and issues.
+  # BUDDY_BOT_TOKEN (a PAT with `repo` and `workflow` scope) is only needed if
+  # you want buddy-bot to update workflow files themselves.
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  BUDDY_BOT_TOKEN: ${{ secrets.BUDDY_BOT_TOKEN }}
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+# Serialize runs so a scheduled tick and a manual one cannot race on the same
+# branches. `cancel-in-progress: false` lets the running job finish rather than
+# being killed part-way through a commit.
+concurrency:
+  group: buddy-bot-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  buddy-bot:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # Rebasing an open branch needs the history it was cut from.
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Setup Pantry
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
+        with:
+          version: '0.11.60'
+          install: 'false'
+
+      - name: Install Dependencies
+        run: bun install
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Open and refresh update pull requests
+        if: ${{ github.event.schedule == '0 */2 * * *' || (github.event_name == 'workflow_dispatch' && contains(fromJSON('["all", "update"]'), inputs.job)) }}
+        run: bunx buddy-bot update --strategy "${{ inputs.strategy || 'patch' }}" ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: Update the dependency dashboard
+        if: ${{ github.event.schedule == '15 */2 * * *' || (github.event_name == 'workflow_dispatch' && contains(fromJSON('["all", "dashboard"]'), inputs.job)) }}
+        run: bunx buddy-bot dashboard ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: Close landed pull requests and clean up branches
+        if: ${{ github.event.schedule == '0 4 * * *' || (github.event_name == 'workflow_dispatch' && contains(fromJSON('["all", "check"]'), inputs.job)) }}
+        run: bunx buddy-bot update-check ${{ inputs.dry_run && '--dry-run' || '' }}

package/vcs/github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 
@@ -61,7 +61,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 
@@ -95,7 +95,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 

package/vcs/github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
+        uses: pantry-pm/pantry/packages/action@fa35547da630b14beda5b26a2625490864d5c963 # v0.11.60
         with:
           install: 'false'
 

package/vcs/github/renovate.json

@@ -1,5 +0,0 @@
-{
-  "extends": [
-    "github>ow3org/renovate-config"
-  ]
-}