Skip to content

ci: Cursor warm-boot env + fast Nx PR checks for next - #241

Open
seanspeaks wants to merge 2 commits into
nextfrom
cursor/warm-boot-and-pr-ci-4a9a
Open

seanspeaks wants to merge 2 commits into
nextfrom
cursor/warm-boot-and-pr-ci-4a9a

Conversation

@seanspeaks

@seanspeaks seanspeaks commented Nov 6, 2026 •

Copy link
Copy Markdown
Contributor

Why

Frigg Module Builder Cloud Agents currently boot cold on this repo, and PRs into next have no automated build/typecheck/unit-test gate (only codeql, codesee, and release). Broken module changes can merge without offline verification.

This adds:

  1. .cursor/environment.json + .cursor/install.sh — warm-boot install (npm ci, plus verified OpenSSL 1.1 for mongodb-memory-server on Ubuntu 24+) so Cloud Agents start ready to build/test modules.
  2. .github/workflows/pr-ci.yml — fast PR checks on pull_request → next/main using Nx affected build,test, scoped to packages/** so lockfile-wide fan-out does not re-run every credentialed suite. Uses the same .cursor/install.sh as Cloud Agents.

release.yml is intentionally untouched (open PR #238 modifies it).

Adversarial-review fixes (follow-up commit)

  1. No silent-green shallow fetch: git fetch --no-tags origin <base> (full history into origin/<base>); git diff has no || true so merge-base failures fail the job.
  2. libssl1.1 parity: PR CI runs bash .cursor/install.sh on ubuntu-24.04.
  3. Integrity: libssl1.1 .deb fetched over https:// and checked with pinned SHA-256 before dpkg -i.

Design notes (from inspecting next)

  • Workspaces: npm + Lerna independent + Nx 20; scripts are mostly test / lint:fix. Only a few packages have build (tsc) or lint.
  • lint is omitted from CI: almost everything only has mutating lint:fix, and the few lint scripts fail without unpublished eslint configs.
  • Node 18 matches release.yml / engines (>=18); .node-version is still stale at 16.15.0.
  • Affected is filtered to packages/** files so Module Builder PRs that also touch package-lock.json only test the changed module(s).

Verification

On this VM (Node 18.20.8):

  • bash .cursor/install.sh — exit 0 (idempotent)
  • HTTPS download + sha256sum -c OK; tampered .deb rejected
  • npx nx affected -t build,test --files=packages/v1-ready/crossbeam/api.js — exit 0 (MMS-backed via @friggframework/test globalSetup; 14 tests)
  • npx nx affected -t build,test --files=packages/v1-ready/freshbooks/api.js — exit 0
  • npx nx affected -t build,test --files=packages/v1-ready/clio/package.json — exit 0
  • Missing merge-base git diff exits 128 (fails loudly)

Does not conflict with #238 (only adds/updates new workflow + .cursor/ files).

Open in Web Open in Cursor 

d-klotz and others added 2 commits November 6, 2026 01:34
Add a verified .cursor/environment.json (npm ci + OpenSSL 1.1 for
mongodb-memory-server) so Frigg Module Builder Cloud Agents boot warm.
Add pr-ci.yml that runs nx affected build/test only for packages/**
changes on PRs to next/main, without touching release.yml (#238).

Co-authored-by: Sean Matthews <sean.matthews@lefthook.co>
- Fetch full origin/<base> history (no --depth=1) and fail loudly on
  git diff merge-base errors instead of silent-green skip
- Run bash .cursor/install.sh in PR CI for Cloud Agent parity on
  ubuntu-24.04 (mongodb-memory-server needs libcrypto.so.1.1)
- Download libssl1.1 over https and verify pinned SHA-256 before dpkg

Co-authored-by: Sean Matthews <sean.matthews@lefthook.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants