CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
* chore(papi): commit the sources behind the four polkadot-api packages
papi-utils, bizinikiwi-bindings, metadata-builders and merkleize-metadata
held only dist/ builds, and no repository held their source. Every
source map in dist/ embeds the TypeScript it was compiled from; that is
now committed as src/ (59 files), and it matches upstream polkadot-api
(MIT) exactly once @polkadot-api/* imports are renamed:
papi-utils @polkadot-api/utils 0.2.0
bizinikiwi-bindings @polkadot-api/substrate-bindings 0.16.6
metadata-builders @polkadot-api/metadata-builders 0.13.0-0.13.2
merkleize-metadata @polkadot-api/merkleize-metadata 1.1.21-1.1.23
scripts/check-papi-sources.mjs, run in the lint job, fails unless the
source embedded in dist/ is exactly the committed src/. tsconfig.json
excludes these src/ trees; ESLint already skipped the packages. Each
README now states the upstream package and version.
* chore(papi): keep the upstream sources in upstream-src/
The pezkuwi-dev build treats any package with a src/ directory as its
own: it requires our license header on every file and builds it. These
are upstream files that must stay byte-identical to the source embedded
in dist/, so they live in upstream-src/ instead, which neither the build
nor the root tsconfig picks up.
- every matrix step (lint, test, build) must pass; nothing is allowed
to fail silently
- after build, scripts/check-built-manifests.py checks the package.json
each build/ directory holds, which is what npm receives: entry points
must exist, no ./build/ or ./cjs/cjs/ paths, no string spread into
exports, no workspace:/link: ranges
- the tree must be unchanged after the step: `yarn lint` runs
eslint --fix and `yarn build` regenerates the augment interfaces, so
both used to pass on a tree they had rewritten
- the dot-notation exclusion had been renamed from kusama to zagros
(no such directory) instead of dicle; with the dicle augmentation in
the lint program, eslint --fix rewrote api.query['registrar'] style
accesses that the build cannot compile
- the four compiled-only packages (bizinikiwi-bindings,
merkleize-metadata, metadata-builders, papi-utils) have no sources
here and are not linted
- the auto-approve and auto-merge bots are removed
- .prettierrc.cjs uses @pezkuwi/dev
dependabot[bot]