mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
6c21f63c96
Address review findings on the ARC migration: - docker.yml: WIF auth (and therefore Artifact Registry cache WRITES) now only runs on non-PR events. The build job runs PR-controlled code and the publish job reads the same buildcache ref, so a PR-writable cache was a layer-poisoning vector. PRs of any origin keep cache READS via the runner pod's GKE Workload Identity — that's where the 15min -> 2-3min win comes from; main pushes repopulate writes. - docker.yml: profile label is now docker-tests-<arch>. Both matrix legs uploaded resource-profile-docker-tests; upload-artifact v4+ rejects the duplicate and continue-on-error swallowed it, silently dropping one arch's profile. - actions/profile: run the wrapped command with bash -eo pipefail to match normal `run:` step semantics (a failing `source .venv/...` must fail the step, not fall through). - js/e2e/site workflows: bake node22 into the node_modules cache keys so a future node-version bump can't restore stale native builds (node-pty, electron postinstall) against an unchanged lockfile. - test_container_restart_stale_pid: forward deadline_s/interval_s to wait_for_log instead of silently dropping them. - doctor.py: refresh a stale comment on the in-container docker branch. |
||
|---|---|---|
| .. | ||
| ci.yml | ||
| contributor-check.yml | ||
| deploy-site.yml | ||
| docker-lint.yml | ||
| docker.yml | ||
| docs-site-checks.yml | ||
| e2e-desktop.yml | ||
| history-check.yml | ||
| infographic-check.yml | ||
| js-autofix.yml | ||
| js-tests.yml | ||
| label-rerun.yml | ||
| lint.yml | ||
| lockfile-diff.yml | ||
| osv-scanner.yml | ||
| publish-e2e-evidence.yml | ||
| review-labels.yml | ||
| skills-index-freshness.yml | ||
| skills-index.yml | ||
| supply-chain-audit.yml | ||
| tests.yml | ||
| uv-lockfile-check.yml | ||