From 6704b87451b38b4df466d266b63f765abc0b3f26 Mon Sep 17 00:00:00 2001 From: Daniel Klotz Date: Fri, 6 Nov 2026 01:34:50 +0000 Subject: [PATCH 1/2] ci: add Cursor warm-boot env and fast Nx PR checks for next Add a verified .cursor/environment.json (npm ci + OpenSSL 1.1 for mongodb-memory-server) so Frigg Module Builder Cloud Agents boot warm. Add pr-ci.yml that runs nx affected build/test only for packages/** changes on PRs to next/main, without touching release.yml (#238). Co-authored-by: Sean Matthews --- .cursor/environment.json | 4 +++ .cursor/install.sh | 23 +++++++++++++ .github/workflows/pr-ci.yml | 68 +++++++++++++++++++++++++++++++++++++ 3 files changed, 95 insertions(+) create mode 100644 .cursor/environment.json create mode 100755 .cursor/install.sh create mode 100644 .github/workflows/pr-ci.yml diff --git a/.cursor/environment.json b/.cursor/environment.json new file mode 100644 index 00000000..40d667f2 --- /dev/null +++ b/.cursor/environment.json @@ -0,0 +1,4 @@ +{ + "name": "frigg-api-module-library", + "install": "bash .cursor/install.sh" +} diff --git a/.cursor/install.sh b/.cursor/install.sh new file mode 100755 index 00000000..a34b7b40 --- /dev/null +++ b/.cursor/install.sh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash +# Warm-boot bootstrap for Cursor Cloud Agents (and local parity). +# Idempotent: safe to re-run. Must exit when finished. +set -euo pipefail + +cd "$(dirname "$0")/.." + +# Many module jest setups use mongodb-memory-server with a Mongo 5.x binary that +# links against OpenSSL 1.1. Ubuntu 24.04+ only ships OpenSSL 3 by default. +if ! ldconfig -p 2>/dev/null | grep -q 'libcrypto\.so\.1\.1 '; then + echo "[.cursor/install] Installing libssl1.1 for mongodb-memory-server" + sudo apt-get update -qq + TMP_DEB="$(mktemp /tmp/libssl1.1.XXXXXX.deb)" + wget -qO "$TMP_DEB" \ + http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb + sudo dpkg -i "$TMP_DEB" + rm -f "$TMP_DEB" +fi + +echo "[.cursor/install] node=$(node -v) npm=$(npm -v)" +npm ci --no-audit --no-fund + +echo "[.cursor/install] Bootstrap complete" diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml new file mode 100644 index 00000000..b4ee1c1e --- /dev/null +++ b/.github/workflows/pr-ci.yml @@ -0,0 +1,68 @@ +# Fast PR checks for module changes targeting next/main. +# Uses Nx affected scoped to packages/** so lockfile-only fan-out does not +# re-run every workspace's credentialed integration suites. +# +# Targets that actually exist & pass offline on next: +# - test (most packages; Module Builder modules use nock/mocks) +# - build (TypeScript packages: clio, pipedrive, zoho-crm, frigg-scale-test) +# lint is omitted: almost every package only has mutating `lint:fix`, and the +# few `lint` scripts fail without unpublished eslint config packages. +name: PR CI + +on: + pull_request: + branches: + - next + - main + +concurrency: + group: pr-ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + affected: + name: Affected build & test + runs-on: ubuntu-22.04 + timeout-minutes: 25 + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Setup Node + uses: actions/setup-node@v4 + with: + # Match release.yml / package.json engines (>=18). .node-version is stale (16). + node-version: '18' + cache: npm + + - name: Install dependencies + run: npm ci --no-audit --no-fund + + - name: Run Nx affected build & test (packages only) + shell: bash + run: | + set -euo pipefail + + BASE_REF="origin/${{ github.base_ref }}" + git fetch --no-tags --depth=1 origin "${{ github.base_ref }}:${{ github.base_ref }}" || true + + mapfile -t CHANGED < <( + git diff --name-only "${BASE_REF}...HEAD" -- 'packages/**' || true + ) + + if [[ ${#CHANGED[@]} -eq 0 || -z "${CHANGED[0]:-}" ]]; then + echo "No packages/** changes vs ${BASE_REF}; skipping Nx build/test." + exit 0 + fi + + echo "Package files changed (${#CHANGED[@]}):" + printf ' %s\n' "${CHANGED[@]}" + + # Comma-separated list for nx --files (avoids lockfile marking every project affected) + FILES_CSV=$(printf '%s,' "${CHANGED[@]}") + FILES_CSV="${FILES_CSV%,}" + + # Nx skips projects that lack a given target, so build only runs on TS packages. + npx nx affected -t build,test --files="$FILES_CSV" --parallel=3 From 83059a8fab6dbf453ae66096897e380504bf1d6f Mon Sep 17 00:00:00 2001 From: Daniel Klotz Date: Fri, 6 Nov 2026 01:42:18 +0000 Subject: [PATCH 2/2] fix(ci): harden PR CI fetch/diff and share verified libssl1.1 install - Fetch full origin/ history (no --depth=1) and fail loudly on git diff merge-base errors instead of silent-green skip - Run bash .cursor/install.sh in PR CI for Cloud Agent parity on ubuntu-24.04 (mongodb-memory-server needs libcrypto.so.1.1) - Download libssl1.1 over https and verify pinned SHA-256 before dpkg Co-authored-by: Sean Matthews --- .cursor/install.sh | 12 ++++++++---- .github/workflows/pr-ci.yml | 15 ++++++++++----- 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.cursor/install.sh b/.cursor/install.sh index a34b7b40..4be5742c 100755 --- a/.cursor/install.sh +++ b/.cursor/install.sh @@ -1,18 +1,22 @@ #!/usr/bin/env bash -# Warm-boot bootstrap for Cursor Cloud Agents (and local parity). +# Warm-boot bootstrap for Cursor Cloud Agents (and local/CI parity). # Idempotent: safe to re-run. Must exit when finished. set -euo pipefail cd "$(dirname "$0")/.." # Many module jest setups use mongodb-memory-server with a Mongo 5.x binary that -# links against OpenSSL 1.1. Ubuntu 24.04+ only ships OpenSSL 3 by default. +# links against OpenSSL 1.1. Ubuntu 22.04+/24.04+ ship OpenSSL 3 by default. +LIBSSL11_DEB_URL='https://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb' +# SHA-256 of libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb (Ubuntu jammy / Launchpad). +LIBSSL11_DEB_SHA256='7cf39d70a639017d1dd7c8d36daa2258063608688e449fddf40ffdd46f992a78' + if ! ldconfig -p 2>/dev/null | grep -q 'libcrypto\.so\.1\.1 '; then echo "[.cursor/install] Installing libssl1.1 for mongodb-memory-server" sudo apt-get update -qq TMP_DEB="$(mktemp /tmp/libssl1.1.XXXXXX.deb)" - wget -qO "$TMP_DEB" \ - http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb + curl -fsSL -o "$TMP_DEB" "$LIBSSL11_DEB_URL" + printf '%s %s\n' "$LIBSSL11_DEB_SHA256" "$TMP_DEB" | sha256sum -c - sudo dpkg -i "$TMP_DEB" rm -f "$TMP_DEB" fi diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index b4ee1c1e..14ea11a4 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -22,7 +22,7 @@ concurrency: jobs: affected: name: Affected build & test - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 timeout-minutes: 25 steps: - name: Checkout @@ -37,8 +37,10 @@ jobs: node-version: '18' cache: npm - - name: Install dependencies - run: npm ci --no-audit --no-fund + - name: Install (libssl1.1 + npm ci) + # Same bootstrap as Cloud Agents (.cursor/environment.json) so + # mongodb-memory-server modules work on Ubuntu 24.04 runners. + run: bash .cursor/install.sh - name: Run Nx affected build & test (packages only) shell: bash @@ -46,10 +48,13 @@ jobs: set -euo pipefail BASE_REF="origin/${{ github.base_ref }}" - git fetch --no-tags --depth=1 origin "${{ github.base_ref }}:${{ github.base_ref }}" || true + # Full history fetch into refs/remotes/origin/ — do not use + # --depth=1 (writes .git/shallow and breaks three-dot merge-base). + git fetch --no-tags origin "${{ github.base_ref }}" + # Fail the job if git cannot resolve the merge-base (no || true). mapfile -t CHANGED < <( - git diff --name-only "${BASE_REF}...HEAD" -- 'packages/**' || true + git diff --name-only "${BASE_REF}...HEAD" -- 'packages/**' ) if [[ ${#CHANGED[@]} -eq 0 || -z "${CHANGED[0]:-}" ]]; then