fix(ci): License-Secret-Injection — CI seit License-Guard rot#7
Merged
Conversation
license-activation.ts imports the gitignored generated module _license-secret.ts, but Mingly had no generation script — CI failed at typecheck/test on every run since the license guard landed, and local builds silently depended on a stale hand-placed file. - scripts/inject-secret.ts: reads MINGLY_LICENSE_SECRET from env/.env, falls back to a dev marker (same pattern as docmind-desktop) - prebuild:main lifecycle hook regenerates it on every build - ci.yml: explicit inject steps before tsc/vitest (they bypass npm lifecycle); build/release jobs get the secret via the prebuild hook - tsx added as devDependency (deterministic in CI, no on-demand npx) MINGLY_LICENSE_SECRET is set as repo secret and in local .env. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Was
Inject-Secret-Mechanik von docmind-desktop nach Mingly portiert; CI erzeugt
_license-secret.tsjetzt selbst.Warum
license-activation.tsimportiert das gitignorte, generierte_license-secret.ts— aber Mingly hatte (anders als Docmind) kein Generierungs-Script. CI war seit dem License-Guard-Commit auf jedem Lauf rot (TS2307), lokale Builds hingen an einer lose auf Disk liegenden Datei mit Dev-Fallback-Secret — das ist auch im publizierten v0.7.1 drin (siehe Review-Punkte).Änderungen
scripts/inject-secret.ts(Port von docmind, MINGLY_LICENSE_SECRET)prebuild:main-Hook in package.jsonMINGLY_LICENSE_SECRETgesetzt; lokales .env mit Production-Secret,_license-secret.tsregeneriert (IS_PRODUCTION_SECRET=true)Tests
typecheck grün, Testsuite Exit 0,
npm ci --dry-runExit 0.Review-Punkte
--publish always— Kollisionsrisiko mit manuell notarisierten Artefakten (separat gestellt)🤖 Generated with Claude Code