Merge branch 'main' into feat/snapshot-store-wiring-tri-13451

Author: d-cs

.changeset/code-layer-exclude-copy.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Fixes an issue introduced in 4.5.11 that made deploy image builds of projects with large dependency trees noticeably slower.

.changeset/eighty-donkeys-shake.md

@@ -0,0 +1,7 @@
+---
+"trigger.dev": patch
+"@trigger.dev/build": patch
+"@trigger.dev/core": patch
+---
+
+The `trigger.dev deploy` and `trigger.dev dev` commands now warn (with the suggested fix) when your code loads a package through `createRequire()` that won't be available in the deployed image. Previously it would fail at runtime in production to load the package. Deploys also now show bundler warnings for your code instead of discarding them.

.changeset/realtime-streams-from-latest.md

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+  merge_group:
 
 permissions: {}
 

.changeset/spotty-pillows-visit.md

@@ -0,0 +1,41 @@
+name: Dispatch RepoOps sync
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dispatch-repo-ops-sync
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    if: vars.REPO_OPS_SYNC_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create Dispatcher App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.REPO_OPS_DISPATCHER_APP_ID }}
+          private-key: ${{ secrets.REPO_OPS_DISPATCHER_APP_PRIVATE_KEY }}
+          repositories: ${{ secrets.REPO_OPS_MONO_REPOSITORY }}
+          permission-contents: write
+
+      - name: Dispatch the private sync worker
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PUBLIC_SHA: ${{ github.sha }}
+          MONO_REPOSITORY: ${{ secrets.REPO_OPS_MONO_REPOSITORY }}
+        run: |
+          set -euo pipefail
+          [[ "$MONO_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
+          [[ "$PUBLIC_SHA" =~ ^[0-9a-f]{40}$ ]]
+          gh api "repos/${MONO_REPOSITORY}/dispatches" \
+            --method POST \
+            --field event_type=repo-ops-public-push \
+            --field "client_payload[public_sha]=$PUBLIC_SHA"

.changeset/warn-createrequire-deploy.md

@@ -3,6 +3,7 @@ name: 🤖 PR Checks
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -26,6 +27,15 @@ jobs:
       cli: ${{ steps.filter.outputs.cli }}
       sdk: ${{ steps.filter.outputs.sdk }}
     steps:
+      # Merge queue events use Git to compare the synthetic merge commit with
+      # its captured base, while pull request events use the GitHub API.
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: github.event_name == 'merge_group'
+        with:
+          fetch-depth: 20
+          filter: blob:none
+          persist-credentials: false
+
       # `code` uses `every` semantics so the negation patterns actually subtract.
       # With the default `some` quantifier, `**` matches every file and the
       # subsequent `!...` patterns are no-ops (each pattern is OR'd, not AND'd).

.github/workflows/codeql.yml

@@ -33,7 +33,18 @@ on:
       - "packages/**"
       - "!packages/**/*.md"
       - "!packages/**/*.eslintrc"
+      # CLI + libraries published to npm; none are built into the webapp/supervisor images.
+      - "!packages/cli-v3/**"
+      - "!packages/build/**"
+      - "!packages/python/**"
+      - "!packages/react-hooks/**"
+      - "!packages/rsc/**"
+      - "!packages/schema-to-json/**"
       - "internal-packages/**"
+      # Test/tooling-only internal packages, never in an image.
+      - "!internal-packages/testcontainers/**"
+      - "!internal-packages/sdk-compat-tests/**"
+      - "!internal-packages/observability-map/**"
       - "apps/**"
       - "!apps/**/*.md"
       - "!apps/**/*.eslintrc"

.github/workflows/dispatch-repo-ops-sync.yml

@@ -0,0 +1,88 @@
+name: repo-ops-sync-gate
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    if: github.event_name == 'pull_request' || vars.REPO_OPS_SYNC_ENABLED == 'true'
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject reserved RepoOps trailers
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          python3 - <<'PY'
+          import os
+          import re
+          import sys
+
+          text = f"{os.environ.get('PR_TITLE', '')}\n{os.environ.get('PR_BODY', '')}"
+          match = re.search(r"(?m)^(?:OSS-RevId|Mono-RevId):", text)
+          if match:
+              print(f"BLOCKED: PR title/body contains reserved RepoOps trailer {match.group(0)!r}", file=sys.stderr)
+              raise SystemExit(1)
+          print("ok: no reserved RepoOps trailers")
+          PY
+
+      - name: Pull request check context
+        if: github.event_name == 'pull_request'
+        run: echo 'State is checked again against the live tips by merge queue.'
+
+      - name: Create read-only Dispatcher App token
+        if: github.event_name == 'merge_group'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.REPO_OPS_DISPATCHER_APP_ID }}
+          private-key: ${{ secrets.REPO_OPS_DISPATCHER_APP_PRIVATE_KEY }}
+          repositories: ${{ secrets.REPO_OPS_MONO_REPOSITORY }}
+          permission-contents: read
+
+      - name: Wait for pending mono changes
+        if: github.event_name == 'merge_group'
+        env:
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          PUBLIC_TOKEN: ${{ github.token }}
+          MONO_BASELINE: ${{ vars.REPO_OPS_MONO_BASELINE }}
+          PUBLIC_BASELINE: ${{ vars.REPO_OPS_PUBLIC_BASELINE }}
+          MONO_REPOSITORY: ${{ secrets.REPO_OPS_MONO_REPOSITORY }}
+          PUBLIC_REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          [[ "$MONO_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
+          [[ "$PUBLIC_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
+          git clone --filter=blob:none --no-tags \
+            "https://x-access-token:${PUBLIC_TOKEN}@github.com/${PUBLIC_REPOSITORY}.git" public
+          git clone --filter=blob:none --no-tags \
+            "https://x-access-token:${APP_TOKEN}@github.com/${MONO_REPOSITORY}.git" mono
+
+          for _ in $(seq 1 60); do
+            git -C public fetch --no-tags origin \
+              +refs/heads/main:refs/remotes/origin/main
+            git -C mono fetch --no-tags origin \
+              +refs/heads/main:refs/remotes/origin/main
+            output="$(mktemp)"
+            mono/tooling/plan-repo-ops-outbound.sh \
+              mono public "$(git -C mono rev-parse origin/main)" \
+              "$MONO_BASELINE" "$PUBLIC_BASELINE" "$output"
+            native_count="$(grep -E '^native_count=' "$output" | cut -d= -f2)"
+            rm -f "$output"
+
+            if (( native_count == 0 )); then
+              echo 'No unsynced native mono oss/ commits.'
+              exit 0
+            fi
+            echo "Waiting for $native_count native mono oss/ commit(s)."
+            sleep 10
+          done
+          echo 'Timed out waiting for mono-to-public sync.' >&2
+          exit 1