github-featured / composiohq--composio

发布

0 发布 1,233 Git 标签

RSS 订阅源
  • @composio/cli@0.2.33-beta.291 4b790dc0ce
    比较

    fix(docs): correct toolkit versions and enforce production source (#3837)

    frostbyte_neo 发布于 2026-07-15 13:16:44 +00:00

    What this fixes

    This is a follow-up to #3770, not a second root-cause fix.

    #3770 moved the docs data workflow from staging to production,
    centralized the production API URL, removed staging hosts from the
    committed data, and added the hostname guard. The committed toolkit
    catalog still retained staging-derived version values, however,
    because that PR intentionally did not regenerate the full catalog. After
    #3770 merged, the scheduled production regeneration began failing with
    401 Unauthorized: the repository's existing COMPOSIO_API_KEY secret
    is staging-scoped.

    The customer-visible result was that nearly every toolkit page showed
    the internal staging version 20260703_00; Gmail's production version
    was 20260702_01.

    Changes

    • Correct every version in docs/public/data/toolkits.json from the
      production toolkit changelog. Toolkits absent from that changelog
      receive null, matching the full generator's semantics. No other JSON
      field changes.
    • Move production changelog fetching and version application into shared
      toolkit-versions.ts logic used by the full catalog generator.
    • Add bun run generate:toolkit-versions as the narrow, reproducible
      generator for version-only repairs.
    • Reject any non-production COMPOSIO_API_BASE in the toolkit and
      meta-tool generators before a request is made.
    • Keep the version-distribution check as a smoke signal for the known
      whole-catalog staging-bump pattern, while testing the production source
      boundary separately. The distribution heuristic is no longer described
      as proof of provenance.
    • Fail before writing when the production changelog response is
      malformed or contains no versions.

    CI policy compatibility

    • Replace the enterprise-blocked mise action with allowlisted tool setup
      actions while continuing to resolve exact versions from mise.lock.
      Install the existing pinned mise CLI release through a checksum-verified
      repository script for lock freshness and preinstall validation.
    • Run the existing GitHub Advanced Security alert check locally and
      notify Slack through the already-allowlisted Slack action, avoiding the
      central workflow dependency rejected by the enterprise action policy.

    Verification

    • bun test tests/static/ — 30 passed.
    • Targeted ESLint for every changed script/test — passed.
    • bun run types:check — passed.
    • bun run build — passed.
    • Explicit staging override of generate-toolkits.ts — rejected before
      network access.
    • Verified the JSON data change remains version-only; toolkit ordering,
      tools, triggers, descriptions, and counts are unchanged.

    Remaining deployment action

    An administrator still needs to replace COMPOSIO_API_KEY with a
    production-scoped key. The scheduled docs-update-data workflow is
    correctly pinned to production and therefore fails loudly with the
    current staging credential instead of republishing staging data. Once
    the secret is corrected, the normal full-catalog generator remains the
    authoritative refresh path.

    Triggered by: abhishek@composio.dev | Source: slack
    Session: https://zen.corp.composio.io/dashboard/#/chat/zen-3a77f73eb146

    Co-authored-by: Zen Agent zen@composio.dev
    Co-authored-by: abhishek abhishek@composio.dev
    Co-authored-by: jkomyno alberto@composio.dev

    下载附件