Migrate 15 workflows to Depot CI (parallel-safe)

Merged
YA
1mo ago
+2034-0

User description

Generated by depot ci migrate + verified green: smoke-install run gcr0cx4xrs via depot ci run (tarball packed, zero errors).

Parallel-safe: .github/ untouched, keeps running until cutover. Secrets already imported (9 verified). Excludes deploy cutover — merge activates Depot triggers; hold deploy-workflow cutover for separate review.

[!NOTE]
Cursor Bugbot is generating a summary for commit e4ed4b8fe22af69506dc394f293f2771994adf72. Configure here.

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

Summary by Sourcery

Migrate the repository’s CI workflows to Depot with parallel-safe validation and hardened release, security, governance, and artifact-integrity gates.

New Features:

  • Add Depot CI equivalents for 15 existing workflows while leaving the GitHub workflow directory unchanged for parallel validation and gradual cutover.
  • Introduce a gated, idempotent release pipeline covering npm publishing, live-registry verification, GitHub release assets, provenance, and SPDX SBOM generation.
  • Add automated GA evidence, license consistency and registry-drift checks, foundation validation, governance enforcement, and public-repository content protection.

Bug Fixes:

  • Prevent release artifacts with version mismatches, missing provenance, unscanned build output, incomplete SBOM dependency data, or incorrect default endpoints from being published.
  • Fix CI coverage gaps for type checking, packaged-artifact smoke tests, secret scanning, body-content scanning, URL conventions, license truth, and governance diff handling.
  • Remove unsupported issue-related triggers from workflows migrated to Depot.

Enhancements:

  • Strengthen release and security gates with fail-closed behavior, pinned and checksum-verified tooling, safer permissions, deterministic concurrency, and cache-poisoning protections.
  • Split reusable release and repository-guard workflows into focused jobs to improve validation coverage and avoid required-check masking or cancellation issues.

CI:

  • Migrate workflow runner configuration from GitHub-hosted labels to Depot runners without modifying the existing GitHub workflows.

Tests:

  • Expand CI validation to cover source and published CLI version parity, ESM resolution, executable binaries, live registry installation, and license-policy fixtures.

CodeAnt-AI Description

Move CI and release workflows to Depot while closing release and security gaps

What Changed

  • Migrated 15 workflows to Depot runners without changing existing GitHub workflow files or interrupting current runs
  • Release checks now validate the packed and published CLI, including type-checking, version output, startup banner, executable wave command, default API endpoint, provenance, and live registry availability
  • Releases now create or update the matching GitHub Release, attach the package tarball, and generate a dependency-complete SPDX SBOM
  • Security and governance checks fail closed for missing diff bases, secrets, unsafe content, invalid routes, malformed skills, oversized files, and license drift
  • Added PR checks for type correctness, packed-install behavior, dependency resolution, and CLI startup failures

Impact

✅ Depot-backed CI runs
✅ Fewer broken published CLI releases
✅ SBOM and provenance attached to releases

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.