Certify pm-github on PM CLI 2026.10.4 and consolidate pending dependency updates

Merged
UN
18d ago
+208-265

What changed

Certifies pm-github on PM CLI/SDK 2026.10.4 and consolidates every pending Dependabot update into one PR:

  • Exact pins raised: @unbrained/pm-cli 2026.9.26 → 2026.10.4 (#101 proposed 2026.10.1 — this carries a newer version), pm-ops 2026.9.28 → 2026.10.4 (#103 proposed 2026.9.29 — newer here). pm-changelog stays at the latest 2026.10.4.
  • #102: @types/node → 26.6.4 (proposed 26.6.3 — newer here) with every devDependency exact.
  • #104: codeql-action pinned SHA group → 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 (v4) for both init and analyze.
  • Canonical merge-driver launcher: scripts/prepare-merge-driver.ts recopied byte-for-byte from the installed pm-ops 2026.10.4 template.
  • pm-github registered as a managed project extension from npm at latest 2026.10.4 for read-only preview only (per-clone, not tracked).
  • Security: no open Dependabot alerts; npm audit and npm audit --omit=dev both 0 vulnerabilities.

Gate commands + results

  • npm run release:check — PASS: typecheck, build, docstring gate, privacy gate, coverage at the configured thresholds, npm audit --omit=dev 0 vulnerabilities, npm pack --dry-run, changelog check, publish-attestation gate.
  • npx pm health (repo-pinned 2026.10.4 binary) — exit 0; one pre-existing advisory (stale in-progress items).

Dogfood evidence (real data, packed tarball, read-only on GitHub)

Packed pm-github-2026.10.4.tgz, installed into a scratch copy of this repo's own real .agents/pm, registered via pm package install:

  • npm (npx -y @unbrained/pm-cli@2026.10.4): github validate --repo unbraind/pm-github → ok (token via gh CLI, HTTP 200); github import unbraind/pm-github → truthfully 0 (the repo has no open issues); github import unbraind/pm-cli → Imported 26 new (real open issue data, read-only fetch); re-import → 0 new / 26 updated, proving gh:owner/repo#N provenance idempotency; github export --dry-run → create/update plan only, writes nothing; github sync --dry-run --repo unbraind/pm-csv → planned 0.
  • bun (bunx @unbrained/pm-cli@2026.10.4): github validate ok; github import unbraind/pm-cli → 0 new / 26 updated; export --dry-run and sync --dry-run identical.
  • Zero GitHub mutation (reads + local scratch writes only); scratch copy deleted afterwards.

pm-github preview (read-only)

pm github validate --repo unbraind/pm-github → ok (HTTP 200); pm github export --repo unbraind/pm-github --dry-run → plan only; pm github sync --dry-run --repo unbraind/pm-github → planned 1 / skipped 1, no mutation. No issues created/modified, no scheduled sync enabled.

Superseded Dependabot PRs

#101, #102, #103, #104 — every update (same or newer version) is carried here.

pm item

https://github.com/unbraind/pm-github/blob/main/.agents/pm/chores/pm-github-julo.toon

The canonical launcher is unchanged. Added the requested lookup-error regression, portable junction fixtures and isolation from inherited NODE_PATH; the hostile-environment launcher suite passes with no new skips. Clean npm ci verifies the pinned graph. Current certification repeats the packed npm/bun read-only own-repository validation, import preview, export preview and sync preview.

Fresh gate: 309/309 tests, zero skips, unchanged coverage thresholds, both audit scopes clean, privacy gate clean. Packed own-tracker export previews render 108 creates + 1 update on npm and bun; sync plans 1, wouldSync 0, skips 1. No GitHub writes.

Final full health receipt: exit 0 with stale_in_progress_items:2 advisory. This corrects the earlier zero-warning summary; package code and validated source are unchanged.

Summary by Sourcery

Certify pm-github on PM CLI 2026.10.4 while consolidating dependency, launcher reliability, and workflow security updates.

Bug Fixes:

  • Preserve the merge-driver install error when module lookup paths are unreadable or malformed instead of incorrectly skipping installation.
  • Add regression coverage for looping module lookup paths and isolate launcher tests from inherited NODE_PATH.

Enhancements:

  • Certify pm-github against PM CLI, SDK, and tooling releases 2026.10.4 with consolidated exact dependency updates.
  • Refresh the canonical merge-driver launcher and lockfile for the updated dependency graph.
  • Add project tracking metadata for the pm-github maintenance item and history.

CI:

  • Update CodeQL workflow actions to the pinned v4 commit.

Tests:

  • Maintain and validate the full test suite with portable junction fixtures and hostile-environment launcher coverage.

Chores:

  • Consolidate the pending Dependabot updates into the certified dependency refresh.