From f285b2dff7b8e035cfd241016770c0de61519048 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Tue, 29 Sep 2026 20:06:15 +0200 Subject: [PATCH 1/3] :construction_worker: Add actionlint and zizmor checks for workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: David Barragán Merino --- .github/actionlint.yaml | 14 ++ .github/workflows/build-bundle.yml | 1 - .../workflows/build-docker-admin-console.yml | 2 +- .github/workflows/build-docker.yml | 1 - .github/workflows/lint-workflows.yml | 78 +++++++++++ .github/workflows/plugins-deploy-package.yml | 1 - .github/zizmor.yml | 123 ++++++++++++++++++ 7 files changed, 216 insertions(+), 4 deletions(-) create mode 100644 .github/actionlint.yaml create mode 100644 .github/workflows/lint-workflows.yml create mode 100644 .github/zizmor.yml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000000..166202b6e3 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,14 @@ +# actionlint configuration — https://github.com/rhysd/actionlint/blob/main/docs/config.md +self-hosted-runner: + labels: + - penpot-standar-runner + - penpot-extended-runner + +paths: + .github/workflows/**/*.{yml,yaml}: + ignore: + # shellcheck style/info notices that are pervasive in the existing + # scripts (unquoted `>> $GITHUB_OUTPUT`, repeated redirects). Real + # shellcheck warnings and errors are still reported. + - 'SC2086:info' + - 'SC2129:style' diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml index 8db99ea68c..43ce74c1b6 100644 --- a/.github/workflows/build-bundle.yml +++ b/.github/workflows/build-bundle.yml @@ -20,7 +20,6 @@ on: description: 'Name of the branch or ref' type: string required: true - default: 'develop' force: description: 'Rebuild and overwrite even if this version already exists in S3' type: boolean diff --git a/.github/workflows/build-docker-admin-console.yml b/.github/workflows/build-docker-admin-console.yml index 4c11db6fba..e193d47704 100644 --- a/.github/workflows/build-docker-admin-console.yml +++ b/.github/workflows/build-docker-admin-console.yml @@ -64,7 +64,7 @@ jobs: # Locate the dispatched run using the correlation id embedded in its run-name RUN_ID="" - for i in $(seq 1 24); do + for _ in $(seq 1 24); do sleep 5 RUN_ID=$(gh run list --repo "$REPO" --workflow "$WORKFLOW" \ --limit 10 --json databaseId,displayTitle \ diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 9c86d6ea5d..271042700a 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -19,7 +19,6 @@ on: description: 'Name of the branch or ref' type: string required: true - default: 'develop' sha: description: >- Exact commit to check out (full 40-char SHA, e.g. from diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml new file mode 100644 index 0000000000..23f9849899 --- /dev/null +++ b/.github/workflows/lint-workflows.yml @@ -0,0 +1,78 @@ +name: "CI: Workflows" + +# Static analysis of the GitHub Actions workflows themselves: +# - actionlint: syntax, expressions, runner labels, job/step references, +# and shellcheck on every `run:` block. +# - zizmor: security audits (template injection, dangerous triggers, +# credential persistence, ...). Configured in .github/zizmor.yml. + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + paths: + - '.github/workflows/**' + - '.github/actions/**' + - '.github/actionlint.yaml' + - '.github/zizmor.yml' + push: + branches: + - develop + - staging + - main + paths: + - '.github/workflows/**' + - '.github/actions/**' + - '.github/actionlint.yaml' + - '.github/zizmor.yml' + workflow_dispatch: + +concurrency: + group: lint-workflows-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +env: + ACTIONLINT_VERSION: '1.7.12' + ZIZMOR_VERSION: '1.30.1' + +jobs: + lint: + name: Lint workflows + if: ${{ !github.event.pull_request.draft }} + # PR code is untrusted: never run this on the self-hosted runners. + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + + steps: + - name: Checkout + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + with: + persist-credentials: false + + - name: Install actionlint + run: | + curl -fsSL --retry 3 \ + "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \ + | tar -xz -C "$RUNNER_TEMP" actionlint + echo "$RUNNER_TEMP" >> "$GITHUB_PATH" + + # Each finding is emitted as a `::error` annotation on the PR diff. + - name: Run actionlint + run: | + # shellcheck disable=SC2016 # Go template, not shell expansion. + actionlint -format '{{range $err := .}}::error file={{$err.Filepath}},line={{$err.Line}},col={{$err.Column}},title=actionlint ({{$err.Kind}})::{{$err.Message}}\n{{end}}' + + - name: Run zizmor + if: ${{ !cancelled() }} + env: + # Enables the online audits (known-vulnerable-actions, + # impostor-commit, ref-confusion, ...). + GH_TOKEN: ${{ github.token }} + run: | + pipx run "zizmor==${ZIZMOR_VERSION}" \ + --config .github/zizmor.yml \ + --format github \ + .github/workflows diff --git a/.github/workflows/plugins-deploy-package.yml b/.github/workflows/plugins-deploy-package.yml index 8a65ef686f..eec741a009 100644 --- a/.github/workflows/plugins-deploy-package.yml +++ b/.github/workflows/plugins-deploy-package.yml @@ -23,7 +23,6 @@ on: description: 'Name of the branch' type: string required: true - default: 'develop' plugin_name: description: 'Publig name (from plugins/apps/-plugin)' type: string diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000000..bdaa8777e5 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,123 @@ +# zizmor configuration — https://docs.zizmor.sh/configuration/ +# +# Every audit is enforced for every workflow. The per-file ignores below are +# the findings that already existed when this check was introduced: each one +# is a pending clean-up, not an accepted risk. New workflows are checked +# with no exceptions. Remove a file from a list in the same PR that fixes it, +# and the whole rule entry once its list is empty. +rules: + # Avoid installing packages ad hoc inside `run:`. + adhoc-packages: + ignore: + - plugins-deploy-api-doc.yml + - plugins-deploy-package.yml + - plugins-deploy-styles-doc.yml + # Use `persist-credentials: false` in actions/checkout. + artipacked: + ignore: + - build-bundle.yml + - build-docker-devenv.yml + - build-docker.yml + - plugins-deploy-api-doc.yml + - plugins-deploy-package.yml + - plugins-deploy-packages.yml + - plugins-deploy-styles-doc.yml + - release.yml + - tests-backend.yml + - tests-common.yml + - tests-e2e.yml + - tests-exporter.yml + - tests-frontend.yml + - tests-library.yml + - tests-mcp.yml + - tests-plugins.yml + - tests-wasm.yml + # Avoid restoring caches in release/publish workflows. + cache-poisoning: + ignore: + - plugins-deploy-api-doc.yml + - plugins-deploy-styles-doc.yml + # Review `pull_request_target` usage. + dangerous-triggers: + ignore: + - auto-label.yml + - commit-checker.yml + # Declare least-privilege `permissions:` per workflow/job. + excessive-permissions: + ignore: + - auto-label.yml + - build-adhoc.yml + - build-bundle.yml + - build-develop.yml + - build-docker-admin-console.yml + - build-docker-devenv.yml + - build-docker.yml + - build-staging.yml + - build-tag.yml + - build-tmp-tokens.yml + - commit-checker.yml + - plugins-deploy-packages.yml + - tests-backend.yml + - tests-common.yml + - tests-e2e.yml + - tests-exporter.yml + - tests-frontend.yml + - tests-library.yml + - tests-mcp.yml + - tests-plugins.yml + - tests-wasm.yml + # Scope GitHub App tokens. + github-app: + ignore: + - auto-label.yml + # Pass only the secrets each reusable workflow needs. + secrets-inherit: + ignore: + - build-adhoc.yml + - build-develop.yml + - build-staging.yml + - build-tag.yml + - build-tmp-tokens.yml + - plugins-deploy-packages.yml + # Style nudge towards the `$/...` syntax; not worth enforcing. + self-repository: + disable: true + # Replace actions that duplicate built-in runner tools. + superfluous-actions: + ignore: + - release.yml + # Pin container images to a digest. + unpinned-images: + ignore: + - plugins-deploy-package.yml + - tests-backend.yml + - tests-common.yml + - tests-e2e.yml + - tests-exporter.yml + - tests-frontend.yml + - tests-library.yml + - tests-mcp.yml + - tests-plugins.yml + - tests-wasm.yml + # Pin actions to a full commit SHA. + unpinned-uses: + ignore: + - auto-label.yml + - build-bundle.yml + - build-docker-devenv.yml + - build-docker.yml + - commit-checker.yml + - plugins-deploy-api-doc.yml + - plugins-deploy-package.yml + - plugins-deploy-packages.yml + - plugins-deploy-styles-doc.yml + - release.yml + - tests-backend.yml + - tests-common.yml + - tests-e2e.yml + - tests-exporter.yml + - tests-frontend.yml + - tests-library.yml + - tests-mcp.yml + - tests-plugins.yml + - tests-wasm.yml From fc184c05edc73ebecd4876e081965dfe9ac819de Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 30 Sep 2026 12:47:20 +0200 Subject: [PATCH 2/3] :fire: Remove temporal files --- frontend/paste-1.png | Bin 17941 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 frontend/paste-1.png diff --git a/frontend/paste-1.png b/frontend/paste-1.png deleted file mode 100644 index ee61282363b69d9f7e437f2e202a71f9e96f5071..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17941 zcmeIacT`hd_%0YL3L>AM1*CpT6$BIoq$>zW?;tgR6bXc0qy-cK6#)%RI?^F@2mwM< z1f)v|2%(7dgwPX&0J)p*_nW(B?wYdZ&di!wcg;V9oaCId&%59KmgjkP-s)jF1y)PBLQP{RuC9RYgcyKl=&< z@()Dq@gu_*X{%FyFAVLcJ2nHwRuWD>;XZxt^^cRM71xc5pU_ifacO}W z+r95^J$Nu82=0AKN~!_8xRY;KgO@fbY@okX0~o7&f=7Q}zppnV1oBI;jrVT|#QMQW zaQqJYiBk{=OHAkq2;_olD>x^D+Zz0ByL1Nv37tI$9=6r}^o9Tb>;LPP>5mb~y1ABN z<+<&iP>n+MYCCkzFTaC83i(imcDM9x5Y1bjTM2>k_`$2Va|Z72g}6awi{7bW4J*X7 zSZZI4$Qei|tC68$?&?knO62)S{iO@*0f?;~3XjVA2x8sbOPar&feTh4r*k?~d+_k=U^&6XQNvRH1Vj=LB?LdbJ7LqeVPwS8;p zx3=viQp?}zy_ddpXHwRJSFL_r>SEbx2&D6t6jNdvbGe<*P3s5PYh2$CWJRJOkTOf& zr7y_s-w7q!r!Q0+Y%W=D7#l)b(IxY;Pd%*~k+`>^U--SjAYY<>H9nO*cG$Y&zy2Tb z%wIQW`)-Z|{`jC#8?|-?wX9u<)*VcU1nZ(z`QYHxi1V*s^hzq;1y7?{6!cb#ZlRx! zC$xKz~AD<@dAp`P)QpW{AwI31tZt!q^$us+3GalC~8eH6hU%=hqrudSA8 z{|{Kwx)B;p=5}Co1_3a^%z4v`$JS()LfqFb{>JYu=BXz?oe#p?|8@{~FG$bGSc-0b z6&5y9pyRgp=g){)rjIF{i;0UXlQp;zUklH(B<*zdk!P`e70$%pzq7;Wc8McJkEa6HzC1iwn{H6>cftpE3+J)2(Nj#5qH3^- znzvJj%(TWsin;yT9607SCL*#{kthnyFSEoZ)-y35^=2G~Tf)t2U65ET7T%;1&AM_t z4EHt`rPxkkj3&w*>Q--WmP|F9M)aobCG)I|n!61q3a5@#*eGESQ)K=1lkuqD%8$8D z!>*&FrK#k(SlaLe8in>+@|D}0zwGJxd+bsxE^Oe-orj*DRS}F>ZPAtk9emX#?ueeg zKFgJrmAr{^i+cTgj))tQk|sXOKOXH)dSUw0H3oY`X$HdPwIhM+O*w!5yqF51g-z6X zh8)yaDQ`J3C&q3q z^Rk(C6c|j#DXI;1#qkSG7EsqibjQcXVIu;Dar`<%y~&xyUP~g~{r$CgI_jMJ=$fy! zb(TZ#pQwz$wLN-j@!ICodd~zn)EwiQcm3W`_Lvnl$#;F4TWzA+ae$ZF{A0XY?doXY zt*acVm$+4yGigDlZcXG``Mr4q^z%W*;ryu*>N+hah9hdM#I(8?CkYw3diuht5{r8E z%lz89U{c}y)p|K9PGka(FvMGHNWJHXtZ^9^Qya=wjuN+i7y>>pKzff^`gM18sbQuA zQe!yf_|yWZBpTshZ+o9Q105;U<3_*O#MHt$9=Nxyqn0QY=r5iRK&iMa#3*Ir*_)}9^t1Ix_;CC1uMzOz$9ApKBI5qB0;llCFR!%cN{vmzMT z9H>rXW$7e&e*QQfr!TM0NC(_M_AvcCs@T>GLltGJ-etUO(4UH4hiVDe$t?bi7Zyzc zZAyS#ZHRzx`-@lf83 z8d6bFabb0}1Q^EzIlsPM{^!pheWIPCqtLy328^sD81tiFVN3+DLOw=DMrLPc*T8Us zP5XqF;wBy7-ucG4`P+F-HW;M?%DQi=X*pSxH6RdZvLrIi0DKGMO?hxb-^;`rF zhBMHSE3Nlhdfpx1Wrp>&Ob)*8FI!xkeOUMwj-ZTdhQEIOy!R84+ykT#K9qd zu|K__AS0l`?C|76OU2eZp_K{oFduLhCXZ7c!z}>ZBB__FS;O>cL zEycBPd|6|otlAKNW>B$cOWHHP5M}<~$V(UEx^mIZV@|VQ!vhXBX~T&-L=doQIA_rS5vV=k(%$AE}e5 zYg5>S4HhagKO|1I>WgjS^1alT(}={ z6eLIac|q8+VW$e?vGMCsG>43Ktin;h#V;ORR9F`YD zrRQN%{C|Ubp-`zT(d%Yr*#EHA`g`fZN7f%YrtfQ!*(AKZZy|Fj>DXnakQ6;`{MryI z*0pK<5!OEVER#|B%P=@bRqIp9r8&OQCp49Y7tl0I3-7~uwyWd$@Pt}}%bj>kMhj=) zroBIP-#E}b!^(H`RAX=uEO($M_z2;n8YL4>n5%7Nza0_)70WBL{Vk+Y}{l2HdWefQ~p zqLYM!>8-yE^AVhV{qEg69yNz*Q@Bh=VQ1(|7$;608IQD(Z5RahOi@LT7QMb)+ZQfz z(IisD(&ylL8r<|@SOj4LTmE+pM*Ak2^{Q5QiuMo{g zpQEpg)+AHbe&(+QQ-x|B-MV;qGo_wkqTj)8>*Q?k!C2U{IZ_do!cj2h(tXC0K5H&W zo+A5HUrcufEkd&z3aZFG#Q=Usda0!zxqjC*PB2#(UzdHO!E{?(4(;KY`_BvC?|3gP z&i_Qi|6HX;|_s#h^6P;;!dDui_cz?Q_{*x{jtbXRqnOdrl zfkE~6#HuT%ptsWXSsv0FS|1?2ql{0r8BFc(7z9mzq~9Irn*xqPF|j?k>qD3}kfXbR z#71I~+UfCe<0U^in?}4^|MB;y3asoD=@0Z3%ZKn3nc8WPuit;%chkIB@5SYC3D=S- zbBuu0%KNX}DJTO>hP3be25+n=`<%Kozwv7+mb0F|BAkD1ZR`x~MAC94IBerTCKi9F z=t%J$;KF75uyw(V4kKO?q^v(oHT30}-2%q6&oAien^FQE`~j7kN;>Mo=$OphXp2vc z<7UzkjZXHAJ9~la)^VB1`oK1Ra&ihz3fy7KvN}ZveC{&7ic)Dga$BtXnpyEz9L~sK z{UGe5lHzflb!m>@X*GIyb;8i_nbG4~SkARlGrX|#WJ$7X-KIlwpF?t*CaaW9RYWX@ z8&*Mp$FS+_#nE~EdVE2_*!pZPTxN>WNw+|nL+y-Q@mayC8WhaHF(mD&K-g-uB+6iy zQ(a4{pmEY-@674K^&d9ABr{b%UFuJf?%pTmJI&s}!Y{vk@x|~@dSa!0);|Mp0I@6w z&-LO-bgFVZHX01axpyQr{)Ma+sC2iscgKLuO3uD~DV-E#42(mh&~X~KW&QHR=-GZ1 z#@xDDoG@fya0Mq~<|q5-%>hxeVrr(wKi4(nm(7`Q3H<=ryNP!1Q4S_~TR+o^+q?sN z%i8G)A2awwxwxV;eNkZTJa;yje&$^tOyRu$c+Ry!*-BpiI8r9U@lM?wehK?>jfPrH zbQedpLh4MWo0|o13kYo2TV8`IDEJWZG$eItaqTm(yE7P#P?eUseQw_IYS3y9Zg6ed zJ%N7bS`JL5T(eAWS_wJQ zXSO$9(1QVlc7ZvTJXK^xr|R1N)m7E%mQN?aq88 zV@$Y%BP|N#!y=Y9nwusXJi_>9Iz zSF)Y9pJ+9bec?~*6*oOpiy#^EG$MI+*FLDkc@~Fj^pV-UKwwQ_H`Y% zSd?$)kjK5PX>vyNOtxa;|{5G9+SwA^L3rJfbA3%dk$odl`u`C zr!tNg)!kZ@w#A(Z!)#^LD65=*adQT_K88b{NA2D7arNs?PAyD+shR|t7ll>TB67^X zUs$9i23P;W;51W$IxWFM%z~RYon;)&Cp)8IgGaa}fc@OJ`w|a?j!E1AO>I{KXjsD;Z6-{FY^Y(8?p-`yf^W7GEt1N5X zz5K>rJ7K!odNh((RzQsO%Y$ugGyO>7YJ#qLVH<~l^G`F?AACkDh=`WW z^l8P)9;Sf=Qs%Z4?Bu)~snDm}BLPQ0+b*|X!x(OEcMkVx45mLLw+GVDhtmalX~P?p zmv`E-!;!hX42xZ30|Tz!7YomWZ0ZV-teu!G$qVEs_N{R0NZhe$&FZ4GQf=|^w(%*dMvB^b|!(-G0FS0U* zDa{iW`J&oyin?)OLp?TwUd7Mbr9bdBwuN3+ZB0@c3)x zGkSVPVO-g_T1hP4+EFplAMP45`-xa@&tkHw@NOf`(X)L;yW?pIx zr`hM6jpgJn`oj_~?o=FK?TA~?9!!n+a^tEi#?&s}7e3`8*%;zJ;L3=#NlSTrf9&Ha zDsKYfy$EJt=J(A_Q)_%+GYbfc#`REDJ0Ud_n<%CG3KP><`N$r*e_e;xNR4m zsy-XdQfk!GVnY2{29lzCQ775cLKc%%QSq>$kk1VYjn0rYqNA)DFRjU;567arrJ%AC zKGJs|X)yPico+1;IHn%u@M#ae&G9h1@0eJsrUQ@66_^L`m5I}CD8t3= zZN;l{A@mINJ3T45lpv}%$8?L1NLd-Z^N^u}@Luhf%n6p)p?Zw|_4Q^|)){;tWl>0z zHh~LBkiLP_VP{98NRw4+hvjT#A1dznydh<0CL&B+@iik?#Lv-}xd#^ftt}vP&j2p% zZ5a1v(M;B{)(#Du>F0n=HRpi3u*R9V5N&0sVh<~c`K1!Q>YCc;aAw3Ui=*X8zn`@o zq~LOpAA>jcg+K(<26bsj03}?VTpzM4!pMGCy)Q+z*iw@pd*dKw(N4_iONprW&W}f0 z=?F|jG)H;4W3Wikiaz6gKH#nA9*1S$APp_$!Y}?1Y!lkIC7uQ-*|XXi4N`7=^LGKUs+qb zJ<_YK_$px}rvRRvotlb`c+Z*hh+7puD)fC|tPE~`|HTMPvZi+J_>TQJrAK9N6jd-C z7V#ZmaD4py==Diu%=B)krgn?MYpSp7Sf~xR_wS#2cvRjLzP8whN;yt!&FT0aq9W4J z(2xg(gR!|Xo@YSqcoe!sGYj3mUBebGpmSVnNqX0%rKMf@k@dMOGbm?k%hShtpp1UZ z%hMCtu5XvhHN4*N8~y-WXHlhtYCo>ajarBiJ%IR#6xpop?OxNcx63UcE`JUKv2}Y% z@MhH?OL^pd_iqAP^>ZRPhC--C0ZuR~Zy8y>%v(g;xKuoIM^{8d1UCFRCxD4Fn^DN* zi6CO(s3*mURV?8BN!BYm2Rk4G#LKMdgLEr6xfWq0G*aojJCnJ+w#F*w^zQfEMdJM1 zxqoMa?;DrF*UcBvDG!ugUE8_ue2#7tr*t^cACQK+7e>8#?cNZ->dXj>9L??GH@rND zt_RBu9PJ-2l8N49+_BeM2qo6PtwAp*{O7;`%w{{~e9}^NHF+4>UaOXi1itLxvo86N zZg;g-SSG<;(ZAkb8UW;7vtGb}TEsCJsCZcKx@K$h^AW0P&3Z-8bjMjmeL*dAHijjy z(<;bR2IDfc%g`cNJtgXFjIug}9Cyk*YR5iha!;XtUdC3U6pCWYpDqCeN!8Qa6O}8> zyzDZ?pf<)>5{kbkW=a;S(q2x~1=xqj>KRe;ip7S8Yiw8iSY@{YI6!a{YJq0Y&hf$a zl|qnv7(dN#pp5Bb8#Ss+|N2!?m>TfXwRx%ew}x4G_`ZFgAlBp$oAD73mx997=C4eb zu}#qF*3B;~c6lM@Uw3)#ZhXMOj1&*<3Ln@m^6svCQV$#`%&dOf!U4-gj`m{7E?oV_ zV)d2M;+91v#;DqZMk|B0x}MsSimZpA)T#k>1uuWPo+1AEakXTm5CmP2;(KWH=~b8# zN|JXP^3tZg{8QZD+E&>MS3B(V-JchxrS(QM*=}ua8$3KbtNup8*VIk2^nL4xzv{7p z%a5;TCh1)_D!rTaNJ$F&KnM^E8ny5%(~rkZO+h*9*Hz048mKEQe;-FK`&=XVVq+>c zaxLVbJYXH2BqUDD7NqK1IygFp-=~jjw=Ejl?&-mspI|)Yv-NG$Qz3X1QbNY0X+m&OS@u^&-fvu} ztpM=MNkJOUdN!X)!!XoW7&ADd|b5*aI0Ep90`%JdRjxek*)He*qy_ljVc7m}xYPfstJ_qVyC&!RZ!Z$i zV^#@(4+GR5+Iz*%tYJq+E7i9;r{@$T%lNN5#lHaJK2~J#R@z5U&$8iL;`m|*TS2i- z=5)hmN71`C&-wiPB-_7z6X4@h`TY4a+Ttz*5;MEHe6maeAko=t4MdT{ePa0p)-MyV zcfXgB0Lb(Kh&KQTh(9ZzZSC%gZXXfLxk>?7NcgjPIYo}DL7HwdNA7I2F?G$%Kot&m z;u@QR@7sKRAZ$(v1E_g^aNx~Lgfx@&~HX~5P;GDs1a}| z%rSdgWbocH_4Vu1jGVHM!Gj}n^E8qOGqj^vR!P?qhrX1R)|X1PwSZ{2T84ER=94?v zQ1bNk9c_Ji%1$g9+)4n2D;}?IDe1C21F@Jp$AT8%WpaT!{ zhaYka3k43B6v|P-R0_bAeBtS7X@VBJtK-#Xm9}{i7df&4!2R7$(6t4Q_ib-)zg`Q4 zKrG&C@SqFr5Ra=Jv~amP7*m+7ZpxgTpB!YusnQ(vRJ` zo_Frz#Zf>=>tcOLF1w6e@|tYm`P~ogdlFZ^y}b;Ztg8&zUCRR`mhe+uk4y-}keQnW zyh0r?lkoH#EBCVEg>yuFR;un4?!ST>&*J!_I{~T2kezLhm3E{ zl(wekNEnm+YAX=1jQxGG!w9z2pALAPV!)k$Z);NmG%6;LK?vO7ZK%gpApwCO`(!qD z%d?PQtlzLt{=4KtF}7j=W3xoM(16GT{g3s7?;C6#&aE3Cx5%ghEKOF4%yw3~fd|ME zlv)eV^7Hc_m(~DAL)BO<0bH=o^tCaqLi75H6R0>6_@;ad($e=}ERa^*OVBi2i#o3~1FMGK&j<&C>?X}pTB`!tB39)m6Pwhg{XZcPF9(@E~DpU%cMSh=pP?fc{CO-o0` z@HnOmhMq&oV(T(V@gS#vk@mE1u@OH7`E~B}d%<%T7>(Mptg-gSQOYYtMd~_QAKPs| zMn$3Q#MJChUjT9-z_1d7jE$4=3YiJKqHdY2MI4aOiN~#lueh2`pDu0zJX(BnRHi0m zSG&~eD7c=u^dBAWs*A`rg1_1{{LGn%5qd}{_g%W26wqFXuhhyUAcKr&`ZCQuo}rBD zrKGkfWT97r(|Rqo~DRB+jSOIb35b`IZKTWe_M;eQPCxDJ%H__O{#DvU#=Lr$9U-_?XM=#xhCF5)dx0Io% z-K-n*=NaNO`J&Svn07h#KVOf5$A~aNAW9n|f788*mB~H>4a)z~p#_lN{F?YHrTd=` z{J^4i&$|oOVB+ChU9`ZRl0Q9Pk$-;*0Xm~vOW~!*A|L-ht%U>fvtR04Kchrt8cstV ziZ>n1KZ_BWO?lW_crqg%#H))*|9#8ye{j)Xmc@T15Ic3STBlUsds-_)LWTZi{Sw~; zffv!_pm1kogdRWj9~9uqVMtTm79vd3jOMqpjCl>(_xn@6dos@`) zS<3?Wk`he1F(ebTD9s~Vxd!~aYRA;wjYAM^y`XO_ynvkwucvm8?99)N&vcJq)a%qhs1wR&a(3&m*DOZfR?Mw zN~G)j{OaLAAYz7D&sr=sL;a%wjijs%ehv;4LT5rkQOsU}$TT~9QOFwKWoFO3hmvMH%Ve?+0o(Xdz-oQkj+x~!sa z9$$c3|6tSI*Yz>7AgM#MUhPywY>9CTFg6!xH!hmAb)9rqAhEkCS>(5yER#|8JFo=xoYR_UWd5**qojd`?E(CYA`4{I5_Nq zd)3eWR+PcG8u!$a>?BebW><;;Y6#leBz;n?%VgH~QTRN8AgJ~ZXaY}ReFYU1XjS{A zC2tA^>>cfI)vAh;*`zfOBQ6@mT@(Hf7&cdhdKNMQKdwPQZ`9+K+5#X-3xeeh93wMd zGS9Io3kwT%`^;3jI>&VQV>pa_jg5;aopUh)a>7RNXVOkfi(2mh0Xfdq?AL|R=1u!S zSm-IXfS&jBW4e0H;)-pFG2Eg_KY7I|smT)3nh*;>$z$+)L3Q1UknX2}wETX@c0T(x zh>IB{{FU+IXb_Bl^wW#@yX^Ug9k)-DY3zA&Ff08;txTP-k}I3^2}bKywJ5 zzYg3BFOtM^T||9#vQbUg45Qcf%bGNUuAcP80!x86KI?d>j6_oNd)wDvzn=7e@nXW& zjcT70M8p}aKT?{XpXZ5-i<|IU%Rc5?`1mu-AnwA?PUo2v*`UB}+-sd5ZpR-M`|A&jd z{Xi$1<>J813`&)rW9I-OY0t9fpmqR7O?Y^?prC;Jb75irScCbxyRg5eRLT&|Vp1PB zPvkrmzP3={DBwS4#bH+Wglm}(t_5Q_XT=(+VkHOW)!hV{q^;F_-)=F*ommRXYdebYN zyEEEm=VakCi{RiZQm*fFdg>hhy2Ji{;E{V{%8LuEk1=nBuf znk?iw#^XC+mCL>TQ|dC;pxfj$jiOC?5mn1l6d$fbeknJX06s$EW@k`u%~V?JI-=PX z^qAz2;z^GCVIf0|2Cn)5tk0Y91##y1Fo5Bq1bNUmea`7zZdRq~7`SGZrLH%q?jG#j z1)#sJ^YD#Y6lc)Et@^+hKNEo{N`?bDu*8IYoBg^@NRx%= z<4h*jqSf5$S_$R7y?siV0%0NGb3nP0WYb_tw3XY4qWSdU4_9-j4%T2Gxv^$$Sada! zwy|*`c*5^_kuNjt0PCTlHdKEqaz{O^L%QO{TX=eiq^r{yg=BnpekA!tpo#n1K33^5J2`h2i>Y$ArH^N(@_WM1Q>xm?;kV z3LT+ls6GK<(Y!Oqzq3$yek=BQaaYu0k;lNA^hO`XjPe6ovpkCRp4**yf<&Zkn!sr< z^7rKr>!hdUwZIcQ&k^06x|*1}%GK)3F3{v;A7HV>0{#rWkxzP_yX7XXGmK`cPTxXk za7=H|+gLj{8T)MMnc&EhYbbptu0g_*mHz0;Fe|mavsQwfA~Eoa|x0Zrj z%fOw;Qnm{->v_9!C8>$R#fIhpm@hBTGWji<>WxpK-TJ30+|yuqXYbd?cPwI0c1d_a zu&czkF9n4bZM@B_qr*rY5Q-Rk-vIU{T)i?+1m)RpHr2d{M_*uLm2qk5fUbNhpaz?) zNe((V*y#(b_MY3p;(+AH*JYeX4dCUvsT2-0;I2ydHtF!bNg`?GB63t9o6#(iKShxI zL5_1X44S-jSg}k@ndx%wU8FUaXE(}fnf=K-;7(CP+UC#jfy_=gmLzv;X^buU$?GOj z*Y#Q)Gd}R_g-edsnQ{?Vr-RLCTP>?6Rp!6jNLN2gGL|Q&MYNF1J*mEAit+GKFv_r8 z=lL6Wy2B~zEvH>85-p(8GPR>AP{4IhX9DB?(RQuT2r(jv!G5nLeOqH>}NxQu^jc-OA1~|KW4+U@x@8c+_OxbLFfc7 zBJyhE_$@pW*4GdZRTG8BfcCra5m7*GXw!!+-b+N;a=pczY_6h?+?SP7x}_)?X&mVnVN>MZmD(-=`6tb{#;{# zvx@*!t)Yz zUMa_d1|CL&AQWlpB57+pb*z$yLcJP%U*Dq4T!IRRpts zP;#5Y9Nj_j^4uO3#API9e69|pbX7kJ#x5w=`@>}XUs3wat<7uwjug?U(t6=bUa)!A z5QpDt;4Br@5VO2YXrNL7hNK&J6kKdUjTvw#S_wtaKOeLx?Tj6aNv;+h-`x}^@~Cm1 zI6~&eV5Ulbh@_(_dm+n9Ax$^b2sBKK)mm9XA1nd-;!}hCi%dk&YLS>I+2Z+v!GIG! zG81-?mQ26G{>*$j%V?9ga__S1kWQ>Z=`*3RLIDM6bVEls4v+ttqUU(`)rq}5Dly`g z`rFgmL#8c-KhZm6DZ~vZ9K_L#U|nP`~AIhqbvaN)MaS z=AH>0E{o19d;;f>9V-Zq6qH#h=@k)?-fD{_?5@U{9j-=Qb)|WdQp8QL4t?k;*C7mM z|A<^Eh_m{TUfQ(XGWx;fowEy=8i!aGlo#E_B7|Y?RPADPsvv)LoS06A{{H4^vcG3U zwkwNeP(fGjCE6iIesxHdU*aJ95$%O`1|u5_wyh=lBsp-=gOrSUh|2KSQ=*Y$#Zo!{ zESfLaJ9IZ?WKx9xsPvVyxnM;>1nNL+R!TIH%SLH);-$1sXV1+Y!=6EI@59dZ@9o3G zKO6M;f&Bq_v z-@u;w9w6!D-JdvT&?5g1xz$`#cQ`ztL1rG!L4BoC600L4C$u@sPl(EL7cexx7rkE_ zXBNxGEvW!)pT0Nshojbv7iCl?FVDI^p|MZy^YeD-EEAi#lo*#%oZ3uNQG!w^cH=g8ftj$rj#nbkmIsDo!to zSeTG*2m{0$3K8~D95(s*v&}3J^O>N02R%JK^?&~>0Y$?cLxg_46CnE%7=_^ zn`eK0b@H%o-uz7X>te6n40LVC*t-pRIUnzKm_1)cjd`=*^hx3R-5aL#3|FU7k)Q@f zJNBFS!b_BuCuBlCr|b|77KOBCI&28r^A}2AY?&@N+F#%DodDsS8$V*g#3o47t_9 zH!F<|jEyNbEx1e!F+MCzoRIRWz0GV95uck8;{P}}b65!j9#aVt6r3iQq9hEq)U?FP)xh? z(h^i%Fe7JZtwSy4&bpU)i)%$p`8|ZbAc0ThW2*#R&g0Iqsbea$+Ob~%P`AKVgo3;o zr-3tGw^@NouF}BG7)V%;QCZ6B&-_}T9rZeD{QGxo*Zh1g-qE_Hr!HqY!?o%;iNi8o_o)a^X+~t zB_-3-H(+9U^a6tj-sbQhVbYC5G}#MRJtszH5>_*UQyT1S>hbGG1#~se6boRE7)7kN zL=8oct1-_n2Mg=lru_(A$`tVl!4}2UP})Pfff!{T>t^VL=O3lrW)`LXxH64WttV+L zT0haZ(JrG1Kh4cQq$W~>uQ87y)>?10gH+1qfGDI412u9xn3REi%YwF^qk_boh@=Va zI7INsW{mkx8~42{cfEC!lPU#K#nhnB$I<2ppI@!1t(~`+Ve!BZ2JX6?zFcN@w0xPB zJe@jmxDZtO;`eoqz1fiCqRHOZXYk8<;w_uGa)Kvx&yBwW7an>7E5#xuwFFd0dJK*O zhCtxpL&BK@R6x4IF=;!AN%J@CllO$N8)_&nI%a-`*@!rXGX731+qdfFpu>RaoL z@*~TmOIqlo%yRtV-TMSq6sXIpu=$9)pzw+~Tr%oof4V>a)Dk57;sGev@Wc}B^XQzL zu6rkiva6~r2;xB6)D&qk(y${bM?EB>C&w{1X|U>NxYr$mD%ucu;s{tLC~s2WVsBDv zX8D9BJJ_zMHZxs3Bc?Co*e`O=`pM9TkmkZRjgTKmEZ2|Ra*bF!Lt~@eJ;kFw?h)$S z77NdqC}^BJW6C}*RoH*sKx zYOx~Nr~2P+HGjxhw-NRUGQx4-I?8!6B5YF`8e?)f_7Nf=Vitc|H~2pff6V77=i>~U zw+#HB^{MP76%`-!F3lDF^Z|zHsotZP zIU03~xNpzg-PaUNquyPZ5ee;a6c!x%Qoj(=dGS4%HsA$N#E` z!mgjliTOUz!)-T$WOY6dc>Xg5$G;1JbpM!{WHJ|A>c67~PI$;WYulHjBi#`195ar` zFPW+`&n^(T)w-KIXy=%(UhNX>>T*dmJm|~4qpkJ==(S927_C_ApB`*ol@6hlC^qz!1U|}10m_(? zYf<#he~?e?k3ofxa~*|`yxHpa_ePV;%g>gb1$E@!%60W=GL1B4sljf--np6C(BChO zl_!O!K73o|`VW$LPVqDI%f`_7hgM2i<)6z7bp>`BuFy9*tp{8(7^W*!H}v+SI8{~S z8BEz+YK&tuygJsG^sms?fZWirBNSDK(M_}`_)OGx)=Ti8R6NAayy1Ds zueEbuvjrKvkVoT8!AqLfJJN6;WSnhkEQ-Ag0+~FYComLbk-+1F^c9J*dV(~d)qZ5> z&_FtLe*`Dd=O6<}WkU$)xV5#vGz8N7Nf0poQQ&ZX*ux<;i}$-qx$vvg) zWv@l|WrcwW@{rTsG@s&uOyy>N)_*3#+p{5e%tNu6f~Q~R^A+Tt$H$!jzcP>$ zN42;xWO(SBf~{cj61&sU@fld_;CHWb22jQ*{5y*lvwPbE@B#O-S@%K*RFOkF}2ZrgzG-o1}7G_TRz)9UK#l+s?9C-UNH>oH4v1dZ5TMe9T?CUX2I@+4WgD(nIp7l`#I_|SN!|rp!JilTwr&>7@ zJIO4IS5z|Oy%0WmWw{B@siiZKO9UaG(z1~SA{7GhH;uJ1wi#LbnK9d)=qyfJTP++W zPH--$JA6fg_eJ;wN#?JRR@FbvoNbMYw53d!0eAb^C+~OhP3u3$19Y zJV}N;yB%<0n?7e30o^mt`1FBZduH>%V&TifoJ;(wkRS^)%aPf|h<%SB;*1Q#NuTu@ zgWV%JG^>yB(MHazur`L4jwNtgf0`S^$4<7If$CFrrcOS3fdd(4Z==lPSjlutnCN+)myEUb4#B75_REVm3QvU6_YOYFKoHEGk}F1M=z8P7 zjRqb);*jqz=gT=b8WA~RW9Bp>k+UV}bC!Pd=OXtc5Gy{MY6;$LdYAAnQGsgsXwUP@ z#(t_>Lao{9v#zJXr86|l-wqjPcZx!Pa-Mn6F3tk^RbPXvk~_H}`ftoxa|rt S9sj5bL`_-yaham^tN#Mymt}bX From 7d4feac46b1f2861f665e8e383e81f96e1ccd4e6 Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 30 Sep 2026 12:50:28 +0000 Subject: [PATCH 3/3] :bug: Fix svg-attrs test passing MapEntry to SQL query The import-svg-attrs-asset helper called (first result) on the map returned by import-files!, yielding a clojure.lang.MapEntry instead of a file UUID. PostgreSQL rejected the MapEntry as a query parameter with "Can't infer the SQL type". Extract the id via (first (:file-ids result)) as the neighboring test already does. AI-assisted-by: longcat-2.5-preview-free --- backend/test/backend_tests/binfile_test.clj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/test/backend_tests/binfile_test.clj b/backend/test/backend_tests/binfile_test.clj index 72a17bac6f..715def2ad2 100644 --- a/backend/test/backend_tests/binfile_test.clj +++ b/backend/test/backend_tests/binfile_test.clj @@ -215,7 +215,7 @@ (assoc ::bfc/profile-id (:id profile)) (assoc ::bfc/input input) (v3/import-files!))] - (bfc/get-file th/*system* (first result)))) + (bfc/get-file th/*system* (first (:file-ids result))))) (t/deftest import-binfile-v3-preserves-camel-case-svg-attrs ;; The json reader used by the v3 import rewrites every key of every