Node 22 ships npm 10.x which doesn't support trusted publishing via
OIDC (requires npm 11.5.1+). Node 24 bundles it natively, removing the
need for the `npm install -g npm@latest` step which was failing with a
`Cannot find module 'promise-retry'` error due to npm corrupting itself
during self-upgrade.
Add a rollup job that gates on all 8 E2E shards so it can be a single
required check. Exempt emdashbot from PR template validation alongside
dependabot and renovate.
GITHUB_TOKEN can't trigger CI on PRs it creates, so the changesets
release PR could never pass required checks. Use a GitHub App token
instead, which triggers workflows normally.
Also pins all actions to commit SHAs and uses frozen lockfile.
* chore: add PR template, issue templates, and contribution policy
Drive-by feature PRs are becoming a problem. This adds guardrails:
- PR template with type selection, checklist, and AI disclosure
- Bug report issue template (structured YAML form)
- Issue config that redirects features to Discussions and disables blank issues
- PR compliance workflow that enforces template completion and requires
a Discussion link for feature PRs
- Contribution policy in CONTRIBUTING.md (acceptance tiers, AI PR rules)
- Agent-facing rules in AGENTS.md (follow the template, no bulk changes)
* fornat
* fix(tests): remove explicit beforeAll timeouts that override global hookTimeout
Integration tests passed 60s timeouts to beforeAll, overriding the
120s hookTimeout in vitest.smoke.config.ts. On CI the dev server
startup can consume the full 60s, leaving no time for setup + seeding.
Also bumps createTestServer's default waitForServer timeout from 60s
to 90s, leaving 30s margin within the 120s hook budget.
* fix(tests): don't remove shared node_modules symlink during cleanup
Multiple integration test suites run concurrently and share the
fixture/node_modules symlink. When the suite that created it finishes
first, its cleanup deletes the symlink, causing other suites to fail
with MODULE_NOT_FOUND when their server process tries to resolve astro.
The symlink is gitignored so it's safe to leave in place.
- Fix playground-toolbar test: URL changed to github.com but test still expected docs.emdashcms.com
- create-emdash: extract selectTemplate() to eliminate unsafe/unnecessary type assertions
- create-emdash: use type-safe Object.keys filter instead of bare cast
- cloudflare/cache: use Reflect.get with typeof guard instead of double type assertion
- x402/enforcer: replace unsafe request cast with Reflect.get type guards for CF bot management
- x402/middleware: suppress unavoidable virtual module any-cast with eslint comment
On a fresh CF deployment, if the first request hits a public page, the
middleware fast-path skips runtime init. Template helpers like
getSiteSettings() then query an empty database and crash with
'no such table: options'.
Add a one-time setup probe in the middleware fast-path: check if the
migrations table exists, and redirect to the setup wizard if not.
The check is cached for the worker lifetime after first success.
Also includes release workflow update to use GitHub App token and
admin branding changeset.
