wehub-resource-sync
426e9eeabd
Benchmark Bridge Tests / benchmark (bunx @biomejs/biome check packages/lifeops-bench/src, benchmark-lint) (push) Waiting to run
Benchmark Bridge Tests / benchmark (bunx vitest run --config packages/lifeops-bench/vitest.config.ts --root packages/lifeops-bench --passWithNoTests, benchmark-tests) (push) Waiting to run
Build Agent Image / build-and-push (push) Waiting to run
Chat shell gestures / Chat shell gesture + parity e2e (push) Waiting to run
Cloud Gateway Discord / Test (push) Waiting to run
Cloud Gateway Webhook / Test (push) Waiting to run
Cloud Tests / lint-and-types (push) Waiting to run
Cloud Tests / unit-tests (push) Waiting to run
Cloud Tests / integration-tests (push) Waiting to run
Cloud Tests / e2e-tests (push) Blocked by required conditions
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Deploy Apps Worker (Product 2) / Determine environment (push) Waiting to run
Deploy Apps Worker (Product 2) / Deploy apps worker to apps-control host (${{ needs.determine-env.outputs.environment }}) (push) Blocked by required conditions
Deploy Eliza Provisioning Worker / Determine environment (push) Waiting to run
Deploy Eliza Provisioning Worker / Deploy worker to Hetzner host (${{ needs.determine-env.outputs.environment }} @ ${{ needs.determine-env.outputs.deployment_sha }}) (push) Blocked by required conditions
Dev Smoke / Classify changed paths (push) Waiting to run
Dev Smoke / bun run dev onboarding chat (push) Blocked by required conditions
Dev Smoke / Vite HMR dependency-level smoke (push) Blocked by required conditions
Electrobun Submodule Guard / electrobun gitlink is fetchable (push) Waiting to run
Publish @elizaos/example-code / check_npm (push) Waiting to run
Publish @elizaos/example-code / publish_npm (push) Blocked by required conditions
Publish @elizaos/plugin-elizacloud / verify_version (push) Waiting to run
Publish @elizaos/plugin-elizacloud / publish_npm (push) Blocked by required conditions
Sandbox Live Smoke / Sandbox live smoke (push) Waiting to run
Snap Build & Test / Build Snap (amd64) (push) Waiting to run
Snap Build & Test / Build Snap (arm64) (push) Waiting to run
supply-chain / sbom (push) Waiting to run
supply-chain / vulnerability-scan (push) Waiting to run
Build, Push & Deploy to Phala Cloud / build-and-push (push) Waiting to run
Test Packaging / Validate Packaging Configs (push) Waiting to run
Test Packaging / PyPI on Python ${{ matrix.python }} (push) Waiting to run
Test Packaging / Pack & Test JS Tarballs (push) Waiting to run
Test Packaging / elizaos CLI global-install smoke (node + bun) (push) Waiting to run
UI Fixture E2E / ui-fixture-e2e (push) Waiting to run
UI Fixture E2E / fixture-e2e (push) Waiting to run
UI Story Gate / story-gate (push) Waiting to run
vault-ci / test (macos-latest) (push) Waiting to run
vault-ci / test (ubuntu-latest) (push) Waiting to run
vault-ci / test (windows-latest) (push) Waiting to run
vault-ci / app-core wiring tests (push) Waiting to run
verify-patches / verify patches/CHECKSUMS.sha256 (push) Waiting to run
Voice Benchmark Smoke / voice-emotion fixture smoke (push) Waiting to run
Voice Benchmark Smoke / voiceagentbench fixture smoke (push) Waiting to run
Voice Benchmark Smoke / voicebench-quality unit smoke (push) Waiting to run
Voice Benchmark Smoke / voicebench TypeScript unit (no audio) (push) Waiting to run
Voice Benchmark Smoke / voice bench smoke summary (push) Blocked by required conditions
Windows CI / windows ([bun run --cwd packages/app-core test bun run --cwd packages/elizaos test bun run --cwd packages/cloud/shared test], app-and-cli) (push) Waiting to run
Windows CI / windows ([bun run --cwd packages/scenario-runner test bun run --cwd packages/vault test bun run --cwd packages/security test bun run --cwd plugins/plugin-coding-tools test], framework-packages) (push) Waiting to run
Windows CI / windows ([bun run --cwd plugins/plugin-elizacloud test bun run --cwd plugins/plugin-discord test bun run --cwd plugins/plugin-anthropic test bun run --cwd plugins/plugin-openai test bun run --cwd plugins/plugin-app-control test bun run --cwd plugins/pl… (push) Waiting to run
Windows CI / windows ([node packages/scripts/run-turbo.mjs run build --filter=@elizaos/core --filter=@elizaos/shared --filter=@elizaos/agent --concurrency=4 node packages/scripts/run-bash-linux-only.mjs scripts/verify-riscv64-buildpaths.sh node packages/scripts/run… (push) Waiting to run
Windows CI / windows ([node packages/scripts/run-turbo.mjs run typecheck --filter=@elizaos/core --filter=@elizaos/shared --filter=@elizaos/cloud-shared --concurrency=4 bun run --cwd packages/core test bun run --cwd packages/shared test], core-runtime, 75) (push) Waiting to run
Test Packaging / Build & Test PyPI Package (push) Waiting to run
Voice Workbench / headless workbench (mocked backends) (push) Has been cancelled
Voice Workbench / real acoustic lane (nightly, provisioned only) (push) Has been cancelled
ci / test (push) Has been cancelled
ci / lint-and-format (push) Has been cancelled
ci / build (push) Has been cancelled
ci / dev-startup (push) Has been cancelled
gitleaks / gitleaks (push) Has been cancelled
Markdown Links / Relative Markdown Links (push) Has been cancelled
Quality (Extended) / Homepage Build (PR smoke) (push) Has been cancelled
Quality (Extended) / Comment-only diff guard (push) Has been cancelled
Quality (Extended) / Format + Type Safety Ratchet (push) Has been cancelled
Quality (Extended) / Develop Gate (secret scan + UI determinism) (push) Has been cancelled
Quality (Extended) / Develop Gate (lint) (push) Has been cancelled
86 lines
4.3 KiB
YAML
86 lines
4.3 KiB
YAML
name: elizaOS CodeQL
|
|
|
|
# Keep the default CodeQL query selection. This config narrows what the JS/TS
|
|
# extractor ingests so the build-mode:none database stops OOMing (exit 137 in
|
|
# the dataflow queries). For interpreted/no-build languages, paths-ignore
|
|
# filters EXTRACTED files (not just reported results), so excluding generated
|
|
# build output and non-product trees genuinely shrinks the DB + mmap footprint.
|
|
# Every glob below targets build artifacts, vendored-dependency trees, or
|
|
# non-product (research/eval/demo) code. ZERO product server/runtime/security
|
|
# source is excluded: packages/core, agent/src, app-core/src, app/src, ui/src,
|
|
# cloud/**, security, vault, feed/packages/api, and plugins/** all stay scanned.
|
|
paths-ignore:
|
|
# WHY: this benchmark fixture is deliberately invalid TypeScript; the Solana
|
|
# runner test writes bad code here to assert syntax failures are reported
|
|
# cleanly. Analyzing it adds noisy parser diagnostics without adding security
|
|
# coverage.
|
|
- packages/benchmarks/solana/solana-gym-env/voyager/skill_runner/_test_bad.ts
|
|
|
|
# WHY: installed dependencies, not first-party source (CodeQL skips these by
|
|
# default; listed explicitly to also drop the vendored llama.cpp webui
|
|
# node_modules JS the extractor would otherwise ingest).
|
|
- '**/node_modules/**'
|
|
# WHY: compiled JS build output mirroring src/*.ts (the real source stays).
|
|
# #1 OOM driver by file count (packages/app-core/scripts/bun-riscv64/dist
|
|
# alone is ~88k generated .js).
|
|
- '**/dist/**'
|
|
# WHY: compiled bundles, not source (e.g. packages/app/electrobun/build, ~18.5k
|
|
# generated .js). The app's real UI source in packages/app/src stays.
|
|
- '**/build/**'
|
|
# WHY: Next.js build output; each SSR route bundle inlines ~22MB of deps
|
|
# (packages/feed/**/.next). The feed's true source in src + api stays.
|
|
- '**/.next/**'
|
|
# WHY: repeated example-app build output (numbered .next-build-NNNN dirs).
|
|
- '**/.next-build-*/**'
|
|
# WHY: Turbo task cache, never source.
|
|
- '**/.turbo/**'
|
|
# WHY: test-coverage reports, generated artifacts.
|
|
- '**/coverage/**'
|
|
# WHY: generic build/export output dir, generated not authored.
|
|
- '**/out/**'
|
|
# WHY: Python virtualenvs ship vendored JS (trame, litellm swagger-ui) that
|
|
# bloats ingest; never product source.
|
|
- '**/.venv/**'
|
|
- '**/venv/**'
|
|
# WHY: vendored Python deps (site-packages) that include bundled JS; not source.
|
|
- '**/site-packages/**'
|
|
# WHY: Storybook build output (packages/ui/storybook-static); ui's real source
|
|
# in packages/ui/src stays.
|
|
- '**/storybook-static/**'
|
|
# WHY: fully bundled mobile agent build output (packages/agent/dist-mobile*),
|
|
# 107MB across 2 files; the real agent source in packages/agent/src stays.
|
|
- '**/dist-mobile/**'
|
|
- '**/dist-mobile-ios/**'
|
|
# WHY: Playwright HTML run reports, generated test artifacts.
|
|
- '**/playwright-report/**'
|
|
# WHY: the web bundle baked into the iOS IPA at build time — a compiled copy
|
|
# of app source already analyzed in packages/app/src.
|
|
- '**/ios/App/App/public/**'
|
|
# WHY: the web bundle baked into the Android APK at build time — a compiled
|
|
# copy of app source already analyzed elsewhere.
|
|
- '**/android/app/src/main/assets/public/**'
|
|
- '**/platforms/android/app/src/main/assets/public/**'
|
|
# WHY: transient desktop-shell build-probe bundles under platforms/*/tmp
|
|
# (~21MB each); pure throwaway build output.
|
|
- '**/platforms/*/tmp/**'
|
|
# WHY: minified bundles are unreadable generated output, not source.
|
|
- '**/*.min.js'
|
|
# WHY: vendored Bun-from-source toolchain build cache (~88k generated .js); the
|
|
# single largest OOM contributor. Lives under scripts/, not src/.
|
|
- packages/app-core/scripts/bun-riscv64/**
|
|
# WHY: ML research code + datasets + vendored .venv JS; not shipped product and
|
|
# not a JS/TS attack surface (Python pipelines).
|
|
# WHY: eval/benchmark harnesses, fixtures, and datasets; not deployed product,
|
|
# no live untrusted-input surface.
|
|
- packages/benchmarks/**
|
|
# WHY: 37 standalone reference/demo apps (documentation samples), not the
|
|
# shipped product handling untrusted input.
|
|
- packages/examples/**
|
|
# WHY: device/OS images, OS landing page, robotics; not a server/runtime
|
|
# untrusted-input surface.
|
|
- packages/os/**
|
|
# WHY: Docusaurus docs site; marketing/docs, not product runtime.
|
|
- packages/docs/**
|
|
# WHY: marketing site; not an untrusted-input runtime surface.
|
|
- packages/homepage/**
|