Repository navigation
chore(deps): update @passiveintent/core to latest version in demo pac… - #102
Conversation
📝 WalkthroughWalkthroughDemo package.json files were changed to use the Changes
Sequence Diagram(s)sequenceDiagram
participant Release as "Release Tag (push)"
participant GH_Actions as "GitHub Actions (post-publish)"
participant Repo as "Repository (main branch)"
participant npm as "npm (install / package-lock)"
participant Git as "Git (commit & push)"
Release->>GH_Actions: Trigger workflow (tag v*)
GH_Actions->>Repo: Checkout main
GH_Actions->>npm: Run `npm install --package-lock-only`
npm-->>GH_Actions: Updated package-lock.json (maybe)
GH_Actions->>Git: Check `git diff package-lock.json`
alt lockfile changed
GH_Actions->>Git: Commit updated package-lock.json
Git->>Repo: Push commit to main (using GITHUB_TOKEN)
else no changes
GH_Actions-->>Repo: No commit needed
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates the demo workspace dependencies for @passiveintent/core and @passiveintent/react to track the npm "latest" dist-tag rather than a fixed semver range, presumably to keep the demos aligned with the most recent published packages.
Changes:
- Updated
demo/package.jsonto use@passiveintent/core: "latest". - Updated
demo-react/package.jsonto use@passiveintent/core: "latest"and@passiveintent/react: "latest".
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| demo/package.json | Switches @passiveintent/core dependency spec to "latest". |
| demo-react/package.json | Switches @passiveintent/core and @passiveintent/react dependency specs to "latest". |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
demo/package.json (1)
13-13: Prefer explicit versions overlatestfor workspace demo dependenciesLines 13 uses
"latest", which can reduce clarity when these are workspace packages. While the lockfile currently pins the version, using an explicit semver range (e.g.,"^1.0.0") is clearer and more maintainable.Suggested change
- "@passiveintent/core": "latest" + "@passiveintent/core": "^1.0.0"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@demo/package.json` at line 13, The dependency for "@passiveintent/core" is set to "latest"; update the demo's package.json to use an explicit semver range (e.g., "^1.0.0" or the correct current release) instead of "latest" so the workspace dependency is clear and reproducible—locate the "@passiveintent/core" entry in package.json and replace "latest" with the chosen explicit version string.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@demo/package.json`:
- Line 13: The dependency for "@passiveintent/core" is set to "latest"; update
the demo's package.json to use an explicit semver range (e.g., "^1.0.0" or the
correct current release) instead of "latest" so the workspace dependency is
clear and reproducible—locate the "@passiveintent/core" entry in package.json
and replace "latest" with the chosen explicit version string.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 50a5ff0d-dc8a-4384-a906-3a6646f2b270
📒 Files selected for processing (2)
demo-react/package.jsondemo/package.json
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
🧹 Nitpick comments (2)
PUBLISHING.md (1)
71-77: Consider noting that this step is automated.The post-publish lockfile refresh is automated by
.github/workflows/post-publish-lockfile.yml(triggered onv*tag pushes). Consider adding a brief note here so maintainers know they don't need to run these commands manually after pushing the tag.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@PUBLISHING.md` around lines 71 - 77, Add a brief sentence after the "After every publish" instructions noting that the lockfile refresh is automated: reference the GitHub Actions workflow `.github/workflows/post-publish-lockfile.yml` which runs on `v*` tag pushes and updates `package-lock.json` so maintainers don't need to run the three commands manually after pushing the tag. Keep the existing commands visible for local/manual use but mark them as optional/automated..github/workflows/post-publish-lockfile.yml (1)
19-22: Commits pushed withGITHUB_TOKENwon't trigger subsequent workflow runs.When using
secrets.GITHUB_TOKENfor the checkout/push, GitHub intentionally prevents the resulting push from triggering other workflows (to avoid infinite loops). This means the lockfile commit won't be validated by CI workflows likeci.root.ymlorci.core.yml.If CI validation of the lockfile commit is desired, you'd need to use a Personal Access Token (PAT) or GitHub App installation token instead. However, the current behavior may be acceptable if the lockfile refresh is considered low-risk.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/post-publish-lockfile.yml around lines 19 - 22, The workflow currently uses the GITHUB_TOKEN in the checkout/push step (the actions/checkout@v4 entry with token: ${{ secrets.GITHUB_TOKEN }}), which prevents pushes from triggering subsequent workflows; replace the use of GITHUB_TOKEN with a dedicated Personal Access Token (store it as a repo secret, e.g., PAT_TOKEN) and update the checkout/push steps to use that secret so lockfile commits can trigger CI, or explicitly document/accept the current behavior if CI validation is not required.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/post-publish-lockfile.yml:
- Around line 19-22: The workflow currently uses the GITHUB_TOKEN in the
checkout/push step (the actions/checkout@v4 entry with token: ${{
secrets.GITHUB_TOKEN }}), which prevents pushes from triggering subsequent
workflows; replace the use of GITHUB_TOKEN with a dedicated Personal Access
Token (store it as a repo secret, e.g., PAT_TOKEN) and update the checkout/push
steps to use that secret so lockfile commits can trigger CI, or explicitly
document/accept the current behavior if CI validation is not required.
In `@PUBLISHING.md`:
- Around line 71-77: Add a brief sentence after the "After every publish"
instructions noting that the lockfile refresh is automated: reference the GitHub
Actions workflow `.github/workflows/post-publish-lockfile.yml` which runs on
`v*` tag pushes and updates `package-lock.json` so maintainers don't need to run
the three commands manually after pushing the tag. Keep the existing commands
visible for local/manual use but mark them as optional/automated.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 45f225d6-7c8f-4a97-b5c4-244ffff30e69
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
.github/workflows/post-publish-lockfile.ymlPUBLISHING.md
This pull request updates the dependency versions for the
@passiveintent/coreand@passiveintent/reactpackages in both thedemoanddemo-reactprojects to always use the latest available versions.Dependency version updates:
@passiveintent/coreand@passiveintent/reactdependencies indemo-react/package.jsonto use the"latest"version instead of a fixed version range.@passiveintent/coredependency indemo/package.jsonto use the"latest"version instead of a fixed version range.…kagesDescription
Type of change
Checklist
npm run lintandnpm run typechecklocallynpm run test:unit -w @passiveintent/core)Summary by CodeRabbit
Chores
Documentation