Skip to content

chore: fix CI on main and land both Dependabot groups - #413

Merged
eseidel merged 5 commits into
mainfrom
claude/elegant-planck-uai0s4
Sep 16, 2026
Merged

chore: fix CI on main and land both Dependabot groups#413
eseidel merged 5 commits into
mainfrom
claude/elegant-planck-uai0s4

Conversation

@eseidel

@eseidel eseidel commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Status

READY

Description

Gets CI green on main again and supersedes both open Dependabot PRs, which were red for two unrelated reasons.

1. main is red — fixes #410's failure

The archival-notice commit (21dd331) added a README line that isn't Prettier-formatted and contains an unknown word ("Webflow"), so format:check and cspell fail on main and on every open PR. The first commit here runs Prettier on README.md and adds webflow to .cspell.yaml. That alone unblocks #410.

2. GitHub Actions bumps (supersedes #410)

actions/checkout and actions/setup-node v6 → v7, identical to what Dependabot proposed.

3. npm bumps (supersedes #412)

#412 failed at npm ci: the lockfile Dependabot produced was missing every esbuild@0.28.2 entry, so it no longer matched package.json. package-lock.json is regenerated from scratch here, keeping all 25 updates — nothing needed to be dropped. Re-resolving also dedupes vite, taking npm audit from 24 vulnerabilities (3 critical) to 0.

Three majors in the group needed code changes:

  • astro 5 → 7 removed legacy content collections, so src/content/config.ts moves to src/content.config.ts. The collections already used loaders and the loader base paths are project-relative, so nothing else changed.
  • The astro 7 compiler rejects a self-closing <div>, which jobs.astro used for the Gem job board embed. That div is now closed explicitly, along with its wrapper div, which was never closed at all.
  • @lavamoat/allow-scripts 3 → 5: sharp 0.35 no longer runs install scripts, so it drops out of the allowScripts config.

Verification

npm ci, npx --no allow-scripts, format:check, lint, cspell and build all pass from a clean node_modules.

The built site was diffed against a main build: all 69 pages render identical text, with one cosmetic exception — -- in markdown now renders as an en dash rather than an em dash (the newer smartypants behavior), affecting 11 blog and legal pages.

Once this lands, #410 and #412 can be closed.

Type of Change

  • ✨ New feature (non-breaking change which adds functionality)
  • 🛠️ Bug fix (non-breaking change which fixes an issue)
  • ❌ Breaking change (fix or feature that would cause existing functionality
    to change)
  • 🧹 Code refactor
  • ✅ Build configuration change
  • 📝 Documentation
  • 🗑️ Chore

🤖 Generated with Claude Code

https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee

Generated by Claude Code

@claude
chore: fix formatting and spelling for the archival notice
837cdf5 
The README archival notice landed unformatted and with an unknown word,
which turns CI red on main and on every open PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee
@claude
chore(deps): bump the gha-deps group with 2 updates
ab3b870 
Bumps actions/checkout from 6 to 7 and actions/setup-node from 6 to 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee
@claude
chore(deps): bump the npm-deps group with 25 updates
0f45ea2 
Regenerates package-lock.json from scratch: the lockfile Dependabot
produced was missing every esbuild@0.28.2 entry, so `npm ci` refused to
install. Re-resolving also dedupes vite, taking the audit from 24
vulnerabilities (3 critical) to 0.

Adjustments needed for the majors in the group:

- astro 5 -> 7 removed legacy content collections, so
  src/content/config.ts moves to src/content.config.ts. The collections
  already used loaders, and the loader `base` paths are project-relative,
  so no other change was needed.
- The astro 7 compiler rejects a self-closing <div>, which jobs.astro
  used for the Gem job board embed. That div is now closed explicitly,
  along with its wrapper div, which was never closed at all.
- @lavamoat/allow-scripts 3 -> 5: sharp 0.35 no longer runs install
  scripts, so it drops out of the allowScripts config.

Verified: npm ci, allow-scripts, format:check, cspell and build all pass,
and the built site is byte-identical across all 69 pages except that `--`
in markdown now renders as an en dash rather than an em dash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee
@claude
ci: bump Node to 22.18.x for cspell 10
5810a2e 
cspell 10 requires Node >=22.18.0 and refuses to run otherwise, which
fails the 🔤 Check Spelling step on the pinned 22.12.x. cspell is the
only dependency in the tree that needs more than 22.12, and 22.18.x
satisfies every other engines constraint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee
@eseidel
eseidel enabled auto-merge (squash) September 15, 2026 23:39
@eseidel
eseidel requested a review from easymac September 15, 2026 23:39
@claude
ci: run on Node 24.x, the current active LTS
bcb1744 
Replaces the 22.18.x pin that was chosen only to satisfy cspell 10.
24.x is the newest major every dependency supports, and tracking the
minor means CI picks up patch releases on its own.

Node 26 also builds the site cleanly, but the three lavamoat packages
declare `^20.19.0 || ^22.5.1 || ^24.0.0`, so npm warns EBADENGINE for
the supply-chain guard itself. Worth revisiting once 26 goes LTS and
lavamoat widens its engines.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee
This was referenced Sep 15, 2026
Closed
Closed
@eseidel
eseidel merged commit cc18104 into main Sep 16, 2026
2 checks passed
@eseidel
eseidel deleted the claude/elegant-planck-uai0s4 branch September 16, 2026 00:00
eseidel pushed a commit that referenced this pull request Sep 16, 2026
@claude
Merge branch 'main' into webflow-port
ccfb908 
Brings in the dependency bumps and CI fixes from #413. Conflict
resolutions:

- package.json: the port's dependency set (without @base-ui-components,
  @radix-ui/react-accordion, lucide-react and react-markdown, which it
  removed) at main's versions, including astro 7. package-lock.json
  regenerated from scratch; 0 audit vulnerabilities.
- .github/workflows/main.yaml: keeps the Firebase build/preview/deploy
  jobs, takes main's actions@v7 and Node 24.x, and moves the deploy job's
  checkout to v7 with the rest.
- README.md / .cspell.yaml: the port's versions, which already drop the
  archival notice and list `webflow`. README now says Astro 7.
- src/pages/jobs.astro: the port's iframe embed replaces the markup main
  fixed for the astro 7 compiler, so that fix is moot here.
- src/content/config.ts moves to src/content.config.ts (astro 7 dropped
  legacy content collections); the port's added schema fields carry over.
- One blog post reformatted by prettier 3.9.6, which wraps `$1,000-2,000`
  style text differently.

Verified: npm ci, allow-scripts, format:check, cspell, build, check:links
and the firebase.json drift check all pass. Built output compared against
the pre-merge branch: all 107 pages identical except smartypants
punctuation on 7 blog pages (`--` now an en dash, one `'ol` apostrophe
now curling the other way).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLGw8ogSPAXVnhTv2fbdee
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@easymac easymac easymac approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eseidel @easymac @claude