Conversation
uv installs tool shims into ~/.local/bin (radian, arxiv_latex_cleaner), but nothing in the zsh config put that directory on PATH, so the tools were installed yet unreachable by name. Placed in .zshenv rather than .zshrc so non-interactive shells (scripts, Claude Code) resolve them too — matching the file's stated purpose of holding essential PATH modifications. Guarded with a substring test because .zshenv is sourced for every zsh invocation; an unconditional prepend would grow PATH once per nested shell. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…ted main (#499) Data-Wise/homebrew-tap enabled branch protection on main (PR-only + 2 required status checks), so the release workflow's direct push now fails with GH006. Push a bot/flow-cli-<version> branch, open a PR via gh, and enable auto-merge so it lands when the tap's required checks pass. Co-authored-by: Test User <test@example.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 17.0.8 to 17.4.1. - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.4.1) --- updated-dependencies: - dependency-name: lint-staged dependency-version: 17.4.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Davood Tofighi <dtofighi@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
create-github-app-token was called with no permission-* inputs, so the minted token inherited EVERY permission the data-wise-homebrew-automation installation holds on homebrew-tap, for the duration of the job — a job that runs sed, git and gh against a live credential. The step needs exactly two things: commit and push the formula edit (contents: write), and open then auto-merge the bump PR (pull-requests: write) — the latter added by #499. Both are known-granted, not guessed: the App has authored 7 PRs on the tap (#215, #214, #213, #212, #210, #209, #207) and merged its own (#212, #210 show mergedBy = app/data-wise-homebrew-automation), which requires pull-requests: write; the formula pushes require contents: write. Least privilege on an existing credential — no behaviour change intended. create-github-app-token fails at mint time if a requested permission is not granted, so a mismatch surfaces immediately rather than silently. Verified: actionlint reports the same 2 pre-existing SC2086 infos before and after (different step, not introduced here); YAML parses and both keys land in the app-token step's with: block. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- Add target-branch: dev to github-actions block. Without it, dependabot derives the base from the repo default (main) and resets it on every rebase, so a manual PR retarget can never stick (observed on #503, #512). - Drop the npm package-ecosystem block entirely. package.json has no runtime dependencies -- only 3 devDependencies (husky, lint-staged, prettier) that never reach a user, since flow-cli ships as zsh through Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and only 6 merged, each costing a full CI run (ZSH Plugin Tests ~7min). github-actions updates merged 3/3 and cover real security surface (e.g. #444 bumped actions/create-github-app-token, later hardened by #514). - Bump prettier 3.9.4 -> 3.9.6 by hand (same version #503 proposed), superseding #503 -- closed as no longer needed. Verified: prettier --check against this branch and against origin/dev produce identical pre-existing warnings/errors (archive docs, test fixtures) -- nothing newly introduced by this change.
Version bump for the 5 commits merged to dev since 7.17.1: 2 fixes (#513 PATH, #499 tap-push GH006), 3 CI/deps changes (#512, #514, #515). No feat commits -- patch bump. - package.json, package-lock.json, flow.plugin.zsh (FLOW_VERSION), CLAUDE.md, man/man1/*.1 (.TH version line) via scripts/release.sh - CHANGELOG.md + docs/CHANGELOG.md: new 7.17.2 entry (mirrored, per the project's dual-changelog convention) - docs/index.md: footer version stamp only. The "What's New in v7.17.1" banner is left as-is -- it describes actual 7.17.1 user-facing features, and 7.17.2 has none to add (pure CI/infra). Test-run side effects (.STATUS wins/streak counters, a test fixture's timestamp) surfaced as unrelated dirty files from running ./tests/run-all.sh and were excluded from this commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v7.17.2
Patch release — 2 fixes, 3 CI/deps hardening changes, no new features.
Fixed
~/.local/binadded to.zshenvPATH. (fix(zsh): add ~/.local/bin to PATH in .zshenv for uv tool shims #513)main. (fix(ci): tap formula update via PR + auto-merge (branch protection on tap main) #499)Changed
contents: write+pull-requests: writeonly (was: full installation permissions). (chore(ci): scope the tap App token to contents + pull-requests #514)github-actionsupdates now targetdevexplicitly — fixes a base-reset bug that made manual PR retargets unable to stick. (chore(ci): pin dependabot to dev, drop npm updates, bump prettier #515)prettier3.9.4→3.9.6,lint-staged17.0.8→17.4.1 (devDependencies only). (chore(deps)(deps-dev): Bump lint-staged from 17.0.8 to 17.4.1 #512, chore(ci): pin dependabot to dev, drop npm updates, bump prettier #515)Test plan
./tests/run-all.sh: 78 passed / 6 failed / 1 skipped. All 6 failures reproduce identicallyon
origin/mainpre-release (test-pick-smart-defaults, the teach-deploy-v2 cluster x4,test-atlas-contract) — confirmed via a throwaway worktree, local-environment-sensitive,
pre-existing, unrelated to this release's diff.
prettier --checkparity verified between old (3.9.4) and new (3.9.6) across the full repoin chore(ci): pin dependabot to dev, drop npm updates, bump prettier #515 — identical pre-existing warnings, nothing newly introduced.
7.17.1hits, all intentional (two CHANGELOGsection headers + one docs/index.md banner describing 7.17.1-specific features that
7.17.2 has no replacement content for).
This is the first live exercise of #499's auto-merge tap-release flow and #514's scoped token.