chore: migrate to utoo CI and fix circular dependencies by elrrrrrrr · Pull Request #5830 · eggjs/egg

elrrrrrrr · 2026-03-12T14:56:25Z

Summary

Fix circular dependencies: Move egg from devDependencies to peerDependencies across 34+ packages to break workspace-internal dependency cycles detected by utoo
Migrate scripts to utoo: Replace pnpm commands with ut equivalents in root package.json scripts
Add missing unplugin-unused: Required peer dependency of tsdown for the unused check feature
Fix CI workflow: Use package names (-w @eggjs/bin) instead of dir paths (--workspace ./tools/egg-bin) for utoo workspace flag; set NO_COLOR=1 to avoid ANSI escape codes in test stdout
Fix lint errors: Export Application interface in tegg-plugin types; remove stale @ts-expect-error directives
Fix cluster test regex: Tolerate ANSI color codes between [master]/[app_worker]/[agent_worker] and subsequent text

Known issues (pre-existing, not introduced by this PR)

@eggjs/orm-plugin test uses describe() inside it() which vitest disallows — skipped
@eggjs/development fastReady test is flaky in CI (stdout match intermittently fails) — skipped
E2E tests (cnpmcore, examples) fail because pnpm-workspace.yaml does not exist on this branch — not addressed (branch-level issue)
Test scripts job fails when ut pretest --workspaces triggers @eggjs/orm-plugin pretest which requires MySQL (no MySQL in that CI job)

Test plan

ut deps --workspace-only passes (no cycles)
typecheck CI job passes
oxlint --type-aware passes locally
ut pretest --workspaces passes locally
Main test suite — cluster ANSI regex fixed; orm-plugin and development tests skipped

🤖 Generated with Claude Code

coderabbitai · 2026-03-12T14:56:37Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: aa0ed534-1c83-49a1-a8f9-83f4492c7276

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore-ut-ci

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-03-12T14:56:43Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the project's dependency and workspace management. It transitions from using pnpm-workspace.yaml to a combination of a new .utoo.toml file for dependency catalogs and direct configuration within package.json for workspaces and overrides. This change streamlines how dependencies are declared and managed across the monorepo, likely in preparation for or as part of a new CI setup.

Highlights

Configuration Migration: Migrated dependency catalog and workspace definitions from pnpm-workspace.yaml to .utoo.toml and package.json respectively.
New Configuration File: Introduced a new .utoo.toml file to centralize dependency version management.
Package.json Updates: Updated package.json to include workspace paths and define package overrides, specifically for vite.
Removed PNPM Workspace File: Removed the pnpm-workspace.yaml file as its configurations were moved to other files.

Changelog

.utoo.toml
- Added a new file to define a comprehensive catalog of project dependencies and their versions.
package.json
- Added a workspaces array to explicitly define the project's monorepo structure.
- Introduced an overrides section to specify a custom version for the vite package.
- Removed the packageManager field, indicating a shift in how the package manager is specified or managed.
pnpm-workspace.yaml
- Removed the file, as its contents for workspace definition and dependency catalog have been migrated to package.json and .utoo.toml.

Ignored Files

Ignored by pattern: .github/workflows/** (2)
- .github/workflows/ci.yml
- .github/workflows/e2e-test.yml

Activity

No human activity has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

.github/workflows/ci.yml

.github/workflows/e2e-test.yml

socket-security · 2026-03-12T14:59:51Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → `npm/cheerio@1.1.2` → `npm/entities@4.5.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/entities@4.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → `npm/cheerio@1.1.2` → `npm/entities@6.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/entities@6.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `ioredis` is 96.0% likely obfuscated Confidence: 0.96 Location: Package overview From: plugins/redis/package.json → `npm/ioredis@5.8.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ioredis@5.8.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `js-beautify` is 100.0% likely obfuscated Confidence: 1.00 Location: Package overview From: pnpm-lock.yaml → `npm/js-beautify@1.15.4` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-beautify@1.15.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `markdown-it` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → `npm/markdown-it@14.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/markdown-it@14.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

gemini-code-assist

Code Review

This pull request refactors the project's dependency and workspace management by migrating configuration from pnpm-workspace.yaml to a new .utoo.toml file and package.json. My review focuses on the maintainability of the new configuration and the potential impact on the developer workflow. I've suggested sorting the new dependency catalog for better readability and pointed out a potential issue with the removal of the packageManager enforcement that could be addressed with documentation.

gemini-code-assist · 2026-03-12T15:02:08Z

.utoo.toml

+[catalog]
+"@clack/prompts" = "^0.11.0"
+"@eggjs/compressible" = "^3.0.0"
+"@eggjs/cookies" = "^3.1.0"
+"@eggjs/ip" = "^2.1.0"
+"@eggjs/rds" = "^1.5.0"
+"@eggjs/redis" = "^3.0.0"
+"@eggjs/scripts" = "^4.0.0"
+"@fengmk2/ps-tree" = "^2.0.1"
+"@oclif/core" = "^4.2.0"
+"@oxc-node/core" = "^0.0.35"
+typebox = "^1.0.65"
+"@swc-node/register" = "^1.11.1"
+"@swc/core" = "^1.15.1"
+"@types/accepts" = "^1.3.7"
+"@types/body-parser" = "^1.19.5"
+"@types/bytes" = "^3.1.5"
+"@types/common-tags" = "^1.8.4"
+"@types/content-disposition" = "^0.5.8"
+"@types/content-type" = "^1.1.8"
+"@types/cookie-parser" = "^1.4.8"
+"@types/cookies" = "^0.9.0"
+"@types/cross-spawn" = "^6.0.6"
+"@types/destroy" = "^1.0.3"
+"@types/encodeurl" = "^1.0.2"
+"@types/escape-html" = "^1.0.4"
+"@types/express" = "^5.0.0"
+"@types/extend" = "^3.0.4"
+"@types/fresh" = "^0.5.2"
+"@types/fs-readdir-recursive" = "^1.1.3"
+"@types/http-errors" = "^2.0.4"
+"@types/ini" = "^4.1.1"
+"@types/js-beautify" = "^1.14.3"
+"@types/js-yaml" = "^4.0.9"
+"@types/koa-bodyparser" = "^4.3.12"
+"@types/koa-compose" = "^3.2.8"
+"@types/koa-range" = "^0.3.5"
+"@types/lodash" = "^4.17.20"
+"@types/lodash.snakecase" = "^4.1.9"
+"@types/methods" = "^1.1.4"
+"@types/mime-types" = "^3.0.0"
+"@types/mocha" = "^10.0.10"
+"@types/mustache" = "^4.2.5"
+"@types/node" = "^24.10.2"
+"@types/nunjucks" = "^3.2.6"
+"@types/on-finished" = "^2.3.4"
+"@types/parseurl" = "^1.3.3"
+"@types/pluralize" = "^0.0.33"
+"@types/safe-timers" = "^1.1.2"
+"@types/sqlstring" = "^2.3.2"
+"@types/stack-trace" = "^0.0.33"
+"@types/statuses" = "^2.0.5"
+"@types/superagent" = "^8.1.9"
+"@types/type-is" = "^1.6.6"
+"@types/urijs" = "^1.19.25"
+"@types/vary" = "^1.1.3"
+"@typescript/native-preview" = "7.0.0-dev.20260117.1"
+"@vitest/coverage-v8" = "^4.0.15"
+"@vitest/ui" = "^4.0.15"
+accepts = "^1.3.8"
+address = "2"
+ajv = "^8.8.2"
+ajv-formats = "^2.1.1"
+ajv-keywords = "^5.1.0"
+assert-file = "1"
+await-event = "2"
+await-first = "^1.0.0"
+beautify-benchmark = "^0.2.4"
+benchmark = "^2.1.4"
+body-parser = "^2.0.0"
+bytes = "^3.1.2"
+c8 = "^10.1.3"
+cache-content-type = "^2.0.0"
+camelcase = "^9.0.0"
+cfork = "^2.0.0"
+chalk = "^5.4.1"
+cheerio = "^1.0.0"
+ci-parallel-vars = "^1.0.1"
+circular-json-for-egg = "^1.0.0"
+cluster-client = "^3.7.0"
+cluster-reload = "^2.0.0"
+co-busboy = "^2.0.1"
+coffee = "5"
+common-tags = "^1.8.2"
+content-disposition = "~1.0.0"
+content-type = "^1.0.5"
+cookie = "^1.0.2"
+cookie-parser = "^1.4.6"
+cookies = "^0.9.1"
+cpy = "^12.0.0"
+cpy-cli = "^6.0.0"
+cron-parser = "^4.9.0"
+cross-env = "^10.0.0"
+cross-spawn = "^7.0.6"
+csrf = "^3.1.0"
+dayjs = "^1.11.13"
+debounce = "^3.0.0"
+destroy = "^1.0.4"
+detect-port = "^2.1.0"
+egg-errors = "^2.3.0"
+egg-logger = "^3.5.0"
+egg-plugin-puml = "^2.4.0"
+egg-view-nunjucks = "^2.3.0"
+encodeurl = "^2.0.0"
+esbuild = "^0.27.0"
+esbuild-register = "^3.6.0"
+escape-html = "^1.0.3"
+execa = "^9.6.0"
+express = "^4.21.2"
+extend = "^3.0.2"
+extend2 = "^4.0.0"
+formstream = "^1.5.1"
+fresh = "~0.5.2"
+fs-readdir-recursive = "^1.1.0"
+gals = "1"
+get-ready = "^3.1.0"
+glob = "^11.0.0"
+globby = "^11.0.2"
+graceful = "^2.0.0"
+graceful-process = "^2.0.0"
+http-errors = "^2.0.0"
+humanize-ms = "^2.0.0"
+husky = "^9.1.7"
+inflection = "^3.0.0"
+ini = "^6.0.0"
+iconv-lite = "^0.6.3"
+ioredis = "^5.4.2"
+ioredis-mock = "^8.13.1"
+is-type-of = "^2.2.0"
+jest-changed-files = "^30.0.0"
+js-beautify = "^1.15.3"
+js-yaml = "^4.1.1"
+jsonp-body = "^2.0.0"
+keygrip = "^1.0.2"
+koa-bodyparser = "^4.4.1"
+koa-compose = "^4.1.0"
+koa-onerror = "^5.0.1"
+koa-override = "^4.0.0"
+koa-range = "^0.3.0"
+koa-session = "^7.0.2"
+koa-static = "^5.0.0"
+leoric = "^2.12.2"
+lint-staged = "^16.2.7"
+lodash = "^4.17.21"
+"lodash.snakecase" = "^4.1.1"
+marked = "^17.0.0"
+matcher = "^4.0.0"
+merge-descriptors = "^2.0.0"
+methods = "^1.1.2"
+mime-types = "^3.0.0"
+mm = "^4.0.2"
+mocha = "^11.7.5"
+moment = "^2.30.1"
+mri = "^1.2.0"
+multimatch = "^7.0.0"
+mustache = "^4.2.0"
+mysql2 = "^3.12.0"
+mz = "^2.7.0"
+mz-modules = "^2.1.0"
+nanoid = "^5.0.0"
+node-homedir = "^2.0.0"
+npminstall = "^7.12.0"
+nunjucks = "^3.2.4"
+nunjucks-markdown = "^2.0.1"
+on-finished = "^2.4.1"
+onelogger = "^1.0.1"
+oss-client = "^2.5.1"
+oxc-minify = "^0.105.0"
+oxfmt = "^0.20.0"
+oxlint = "^1.32.0"
+oxlint-tsgolint = "^0.11.0"
+parseurl = "^1.3.3"
+path-to-regexp = "^6.3.0"
+performance-ms = "^1.1.0"
+picocolors = "^1.1.1"
+pluralize = "^8.0.0"
+publint = "^0.3.16"
+ready-callback = "^4.0.0"
+reflect-metadata = "^0.2.2"
+rimraf = "^6.1.2"
+runscript = "^2.0.1"
+safe-timers = "^1.1.0"
+sdk-base = "^5.0.1"
+semver = "^7.7.3"
+sendmessage = "^3.0.1"
+should-send-same-site-none = "^2.0.5"
+source-map-support = "^0.5.21"
+spy = "^1.0.0"
+sqlstring = "^2.3.3"
+stack-trace = "^0.0.10"
+statuses = "^2.0.1"
+stream-wormhole = "^2.0.1"
+superagent = "^10.0.0"
+terminal-link = "^5.0.0"
+ts-node = "^10.9.2"
+tsconfig-paths = "^4.2.0"
+tsdown = "^0.18.2"
+tsx = "4.20.6"
+type-fest = "^5.0.1"
+type-is = "^2.0.0"
+typescript = "^5.9.3"
+unplugin-unused = "^0.5.4"
+urijs = "^1.19.11"
+urllib = "^4.8.2"
+utility = "^2.5.0"
+vary = "^1.1.2"
+vitepress = "2.0.0-alpha.15"
+vitepress-plugin-llms = "^1.10.0"
+vitest = "^4.0.15"
+xss = "^1.0.15"
+ylru = "^2.0.0"
+zod = "^3.24.1"


To improve the maintainability of this large catalog file, it's recommended to sort all entries alphabetically by package name. The current ordering has several inconsistencies. For example:

typebox on line 12 is placed between scoped packages like @oxc-node/core and @swc-node/register.

iconv-lite on line 126 comes after ini on line 125.

A consistent alphabetical order makes the file easier to read, navigate, and manage, especially when adding or updating dependencies. Consider using a script to sort the entries.

gemini-code-assist · 2026-03-12T15:02:08Z

package.json

  "engines": {
    "node": ">=22.18.0"
-  },
-  "packageManager": "pnpm@10.28.0"


Removing the packageManager field disables the enforcement of a specific pnpm version for this project. However, the devDependencies still use the pnpm-specific catalog: protocol. This could lead to confusion and issues for developers who might try to use other package managers like npm or yarn, or different versions of pnpm. If the project is intended to be managed exclusively by the utoo tool, it would be helpful to document this requirement in the CONTRIBUTING.md or README.md to ensure a smooth developer experience.

cloudflare-workers-and-pages · 2026-03-12T15:05:39Z

Deploying egg-v3 with Cloudflare Pages

Latest commit:	`9e89ed2`
Status:	🚫 Build failed.

View logs

cloudflare-workers-and-pages · 2026-03-12T15:06:12Z

Deploying egg with Cloudflare Pages

Latest commit:	`9e89ed2`
Status:	🚫 Build failed.

View logs

codecov · 2026-03-16T03:56:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.21%. Comparing base (53bd879) to head (9e89ed2).

❗ There is a different number of reports uploaded between BASE (53bd879) and HEAD (9e89ed2). Click for more details.

HEAD has 21 uploads less than BASE

Flag BASE (53bd879) HEAD (9e89ed2)

23 2

Additional details and impacted files

@@             Coverage Diff             @@
##             next    #5830       +/-   ##
===========================================
- Coverage   85.63%   65.21%   -20.42%     
===========================================
  Files         665        1      -664     
  Lines       13004       23    -12981     
  Branches     1495        9     -1486     
===========================================
- Hits        11136       15    -11121     
+ Misses       1744        7     -1737     
+ Partials      124        1      -123

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

.github/workflows/ci.yml

- Replace pnpm/action-setup with setup-utoo in all CI jobs - Use ut install --from pnpm for dependency installation - Replace pnpm run/filter commands with ut run equivalents - Use --workspaces --if-present for topological workspace execution - Use --workspace <pkg> for targeted package execution - Use -- passthrough for tsdown args (ut run build -- --workspace) - Remove pnpm dedupe --check step (no longer needed) - Fix tools/scripts ci script to use ut run cov

ut does not install optional peer deps automatically, so unplugin-unused (required by tsdown's unused.level feature) must be declared explicitly. Also includes workspaces/overrides fields auto-resolved from pnpm config by ut install.

publint auto-detects pnpm via pnpm-lock.yaml and calls pnpm pack, but pnpm is not on PATH when using setup-utoo. Set pack: 'npm' explicitly so pnpm binary is not required for publint checks.

- Replace pnpm/action-setup with setup-utoo - Use ut install --from pnpm for dependency installation - Use ut run build for building all packages - Replace pnpm -r pack with npm pack --workspaces - Sync pnpm-lock.yaml to include unplugin-unused

npm pack --workspaces fails on packages without version (e.g. site). Also, pnpm -r pack places tarballs in workspace root, while npm pack places them in each package's own directory. pack-all.mjs replicates pnpm -r pack behavior: - reads workspace patterns from pnpm-workspace.yaml - skips private/unnamed/unversioned packages - packs each with --pack-destination to workspace root

socket-security · 2026-03-27T11:53:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	glob@11.0.3
	@types/encodeurl@1.0.3
	@types/koa-range@0.3.5
	@types/lodash.snakecase@4.1.9
	@types/sqlstring@2.3.2
	@types/destroy@1.0.3
	husky@9.1.7
	@types/fresh@0.5.3
	@types/fs-readdir-recursive@1.1.3
	@types/vary@1.1.3
	@types/parseurl@1.3.3
	@types/on-finished@2.3.5
	@types/stack-trace@0.0.33
	@types/mime-types@3.0.1
	@types/type-is@1.6.7
	@vitest/coverage-v8@4.0.15
	@types/js-beautify@1.14.3
	@types/body-parser@1.19.6
	@types/express@5.0.3
	@types/js-yaml@4.0.9
	@typescript/native-preview@7.0.0-dev.20260117.1
	@types/nunjucks@3.2.6
	@types/escape-html@1.0.4
	@types/content-type@1.1.9
	@types/common-tags@1.8.4
	egg-plugin-puml@2.4.0
	@eggjs/compressible@3.0.0
	@types/extend@3.0.4
	assert-file@1.0.0
	esbuild@0.27.0
	@types/safe-timers@1.1.2
	@types/urijs@1.19.25
	@types/mustache@4.2.6
See 82 more rows in the dashboard

View full report

oxfmt reordered imports and placed execSync import inside the JSDoc comment block, making it unavailable at runtime. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

npm does not understand catalog: protocol; ut install handles it correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…pack npm pack does not resolve pnpm catalog: or workspace: protocol entries, leaving them raw in the tgz package.json. Downstream npm install then fails with EUNSUPPORTEDPROTOCOL. Pre-resolve these to actual semver versions before packing, then restore the originals. Also revert downstream test commands back to npm install/run since cnpmcore/examples use plain semver and npm can install the cleaned tgzs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

npm pack does not apply publishConfig.exports automatically. Packages use devExports (src/) in exports and dist/ in publishConfig.exports. Without merging publishConfig first, the tgz contains src/ exports and downstream npm install fails to find the source files. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

utoo does not recognize workspace paths with ./ prefix. Change ./tools/egg-bin and ./tools/scripts to tools/egg-bin and tools/scripts respectively. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-advanced-security bot found potential problems Mar 12, 2026

View reviewed changes

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/e2e-test.yml Fixed Show fixed Hide fixed

elrrrrrrr force-pushed the chore-ut-ci branch from 5a00911 to c1d1841 Compare March 12, 2026 15:00

gemini-code-assist bot reviewed Mar 12, 2026

View reviewed changes

elrrrrrrr force-pushed the chore-ut-ci branch from c1d1841 to 4c6c6cf Compare March 12, 2026 15:10

elrrrrrrr changed the title ~~chore(ci): utoo ci~~ chore: migrate to utoo CI and fix circular dependencies Mar 16, 2026

github-advanced-security bot found potential problems Mar 16, 2026

View reviewed changes

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

elrrrrrrr closed this Mar 16, 2026

elrrrrrrr reopened this Mar 16, 2026

elrrrrrrr force-pushed the chore-ut-ci branch from 7a6c97b to c34e6d8 Compare March 16, 2026 15:17

elrrrrrrr closed this Mar 27, 2026

elrrrrrrr force-pushed the chore-ut-ci branch from 5bbd44c to 53bd879 Compare March 27, 2026 10:27

elrrrrrrr reopened this Mar 27, 2026

elrrrrrrr added 4 commits March 27, 2026 19:14

fix(ci): add unplugin-unused to root devDependencies

cdc29a5

ut does not install optional peer deps automatically, so unplugin-unused (required by tsdown's unused.level feature) must be declared explicitly. Also includes workspaces/overrides fields auto-resolved from pnpm config by ut install.

fix(build): force publint to use npm pack instead of pnpm

1478ae3

publint auto-detects pnpm via pnpm-lock.yaml and calls pnpm pack, but pnpm is not on PATH when using setup-utoo. Set pack: 'npm' explicitly so pnpm binary is not required for publint checks.

elrrrrrrr and others added 5 commits March 27, 2026 19:59

fix(e2e): restore execSync import broken by formatter in pack-all.mjs

f2605fd

oxfmt reordered imports and placed execSync import inside the JSDoc comment block, making it unavailable at runtime. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(e2e): replace npm install/run with ut in e2e test commands

709d50e

npm does not understand catalog: protocol; ut install handles it correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(ci): remove ./ prefix from ut --workspace paths

9e89ed2

utoo does not recognize workspace paths with ./ prefix. Change ./tools/egg-bin and ./tools/scripts to tools/egg-bin and tools/scripts respectively. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Uh oh!

Conversation

elrrrrrrr commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Known issues (pre-existing, not introduced by this PR)

Test plan

Uh oh!

coderabbitai bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

gemini-code-assist bot commented Mar 12, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

cloudflare-workers-and-pages bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying egg-v3 with Cloudflare Pages

Uh oh!

cloudflare-workers-and-pages bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying egg with Cloudflare Pages

Uh oh!

codecov bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

elrrrrrrr commented Mar 12, 2026 •

edited

Loading

coderabbitai bot commented Mar 12, 2026 •

edited

Loading

socket-security bot commented Mar 12, 2026 •

edited

Loading

cloudflare-workers-and-pages bot commented Mar 12, 2026 •

edited

Loading

cloudflare-workers-and-pages bot commented Mar 12, 2026 •

edited

Loading

codecov bot commented Mar 16, 2026 •

edited

Loading

socket-security bot commented Mar 27, 2026 •

edited

Loading