Skip to content

Release: 1 feature, 2 fixes, 2 chores → Main#7988

Merged
h0lybyte merged 5 commits intomainfrom
dev
Mar 15, 2026
Merged

Release: 1 feature, 2 fixes, 2 chores → Main#7988
h0lybyte merged 5 commits intomainfrom
dev

Conversation

@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Mar 15, 2026

Release: Dev → Main

5 atomic commits ready for main

Features

Bug Fixes

Chores


This PR is automatically maintained by CI — KBVE Studio

* fix(ci): disable Nx Cloud to unblock e2e and build pipelines

Remove the expired nxCloudAccessToken from nx.json — the free plan is
exceeded, causing all nx commands without --no-cloud to hard-fail with
"organization has been disabled". Also add --no-cloud to the Docker
publish workflow, the only CI workflow that was missing it.

* fix(ci): add NX_NO_CLOUD=true env var to all workflow jobs

The --no-cloud flag on outer nx commands does not propagate to nested
nx invocations (e.g. cryptothrone:e2e spawning nx test axum-cryptothrone).
Setting NX_NO_CLOUD=true at job level ensures all nx processes in the
workflow tree skip cloud auth regardless of nesting depth.
* feat(astro-kbve): add weekly NX report and graph workflow

Add ci-weekly-nx-report.yml that runs every Tuesday on arc-runner-set to
generate an NX workspace report (parsed into MDX) and a dependency graph
(mermaid diagram + project index). Both pages live under dashboard/ in
Starlight. The workflow auto-creates a PR to dev.

* feat(nx-graph-to-mdx): add visual styling with Starlight components

Use CardGrid, Cards, Tabs, and color-coded mermaid nodes (blue=app,
green=lib, amber=e2e). Add top-hub cards, sanitize mermaid node IDs
for names with special characters like @kbve/source.

* chore(nx): disable NX Cloud connection

Set neverConnectToCloud to true in nx.json to prevent unintentional
cloud connections during local and CI runs.

* chore(ci): add safety guards to weekly NX report workflow

- Fork guard job (mirrors utils-self-hosted-job pattern)
- Validate NX report output is non-empty and contains expected fields
- Validate NX graph JSON is non-empty and has >0 nodes
- Validate generated MDX files have frontmatter and expected components
- Guard against pushing to an already-existing remote branch
- Add set -euo pipefail to all run steps
- Clean up temp files in always() cleanup step
@github-actions
Copy link
Contributor Author

github-actions bot commented Mar 15, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 5 package(s) with unknown licenses.
See the Details below.

License Issues

.github/workflows/ci-weekly-nx-report.yml

PackageVersionLicenseIssue Type
actions/cache5.*.*NullUnknown License
actions/checkout6.*.*NullUnknown License
actions/github-script8.*.*NullUnknown License
actions/setup-node6.*.*NullUnknown License
pnpm/action-setup4.*.*NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/cache 5.*.* 🟢 6.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 10SAST tool is run on all commits
actions/actions/checkout 6.*.* 🟢 5.9
Details
CheckScoreReason
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/github-script 8.*.* 🟢 7.7
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1013 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
actions/actions/setup-node 6.*.* 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 9binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/pnpm/action-setup 4.*.* 🟢 5
Details
CheckScoreReason
Maintained🟢 33 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 3
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 7Found 23/30 approved changesets -- score normalized to 7
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • .github/workflows/ci-weekly-nx-report.yml

@github-actions github-actions bot changed the title Release: 1 fix → Main Release: 1 feature, 1 fix → Main Mar 15, 2026
h0lybyte and others added 2 commits March 14, 2026 23:11
)

* fix(isometric): use correct WebSocket URL in production and protect shader assets

Production was connecting to ws://127.0.0.1:5000 instead of the real
game server. Refactor networking to use full WebSocket URLs — JS now
detects localhost vs production and passes wss://hostname/ws accordingly.
Switch from lightyear from_addr() to from_url() to support URL paths.

Also add exclude for .wgsl files in vite compression config to prevent
shader files from being deleted during the build.

* fix(isometric): preserve raw shader files in build and deploy WASM assets

The vite-plugin-compression2 gzip pass was deleting all original assets
including .wgsl shader files that Bevy needs at runtime. Changed
deleteOriginalAssets from true to a /\.wasm$/i regex so only WASM
originals are removed. Added a post-build cp step as a safety net.
Includes rebuilt WASM + JS/CSS deploy to astro-kbve.
Atlas was migrated into pydesk. The workflow was already fully disabled
(if: false stub). Removing dead file.

Co-authored-by: Al @h0lybyte <5599058+h0lybyte@users.noreply.github.com>
@github-actions github-actions bot changed the title Release: 1 feature, 1 fix → Main Release: 1 feature, 2 fixes, 1 chore → Main Mar 15, 2026
@github-actions github-actions bot changed the title Release: 1 feature, 2 fixes, 1 chore → Main Release: 1 feature, 2 fixes, 2 chores → Main Mar 15, 2026
@h0lybyte h0lybyte merged commit 87addf4 into main Mar 15, 2026
15 of 16 checks passed
@github-project-automation github-project-automation bot moved this from Review to Done in KBVE Mar 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant