mirror of
https://github.com/LearningCircuit/local-deep-research.git
synced 2026-06-15 11:34:50 +03:00
da0d18ed25
The release job uses a sparse checkout that omits src/ and runs a standalone `pip install towncrier`. Towncrier 24.8 still calls `get_project_name()` even when --version is passed on the CLI, and the existing [tool.towncrier] config pointed at the `local_deep_research` package, so the build crashed with ModuleNotFoundError before rendering any fragments. Set `name = "local-deep-research"` so towncrier short-circuits the import path (build.py:195-197). Drop the now-misleading `package`/`package_dir` fields — `--version` is always passed, `directory = "changelog.d"` is explicit, and nothing else inside towncrier still needs them. Fix the workflow comment that misattributed the bypass to --version. Verified by rendering changelog.d/*.md fragments against this pyproject.toml in a fresh directory with no src/ present.
GitHub Actions Workflows
This directory contains GitHub Actions workflows for automated development tasks.
Update NPM Dependencies Workflow
File: update-npm-dependencies.yml
Purpose
Automatically updates NPM dependencies across all package.json files in the project and fixes security vulnerabilities.
Triggers
- Scheduled: Every Thursday at 08:00 UTC (day after PDM updates)
- Manual: Can be triggered manually via GitHub Actions UI
- Workflow Call: Can be called by other workflows
What it does
- Security Audit: Runs
npm auditto identify security vulnerabilities - Security Fixes: Automatically fixes moderate+ severity vulnerabilities with
npm audit fix - Dependency Updates: Updates all dependencies to latest compatible versions with
npm update - Testing: Runs relevant tests to ensure updates don't break functionality
- Pull Request: Creates automated PR with all changes
Directories Managed
/- Main web dependencies (Vite, Bootstrap, etc.)/tests/ui_tests- UI test dependencies (Puppeteer)
Branch Strategy
- Creates branch:
update-npm-dependencies-{run_number} - Targets:
devbranch - Labels:
maintenance - Reviewers:
djpetti,HashedViking,LearningCircuit
Security Focus
- Only auto-fixes moderate+ severity vulnerabilities
- Preserves compatible version updates (no major version bumps)
- Runs security audit before and after updates
- Requires tests to pass before creating PR
Manual Usage
You can manually trigger this workflow:
- Go to Actions tab in GitHub
- Select "Update NPM dependencies"
- Click "Run workflow"
- Optionally specify custom npm arguments
Troubleshooting
- If tests fail, the PR won't be created
- Check the workflow logs for specific error messages
- Security issues that can't be auto-fixed will need manual intervention