易良 a074d3b042 chore(ci): Disable install scripts in release CI and guard security-checks workflow (#9577) ... * chore(ci): Disable install scripts in release CI and guard security-checks workflow * fix(ci): complete release install hardening * test(ci): pin release install step count Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): scope release PAT to push step Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * fix(ci): export GH_TOKEN so the release-branch push uses CI_BOT_PAT * fix(ci): export GH_TOKEN so the credential helper sees it at push time An inline GH_TOKEN prefix only covers the gh auth setup-git call itself; the helper re-resolves the token when git push invokes it, so the push would fall back to the job token with persist-credentials disabled. * fix(test): anchor setup-git ordering check after the export line A comment in the push step mentions gh auth setup-git before the export, so indexOf found the comment first and the ordering assertion inverted. * style(test): wrap long line to satisfy prettier * fix(ci): address review findings on PAT handling and install comments - Pin gh auth setup-git before the git push it authenticates in both release and finalize workflow tests, so moving credential setup after the push no longer passes. - Correct the replay comment: npm run generate is not a lifecycle script and workspace lifecycle scripts stay disabled. - Drop the overstated push-boundary claim and record why the push needs the bot PAT rather than the job token. * test(ci): pin CI_BOT_PAT out of install steps and the publish job header * style(test): apply prettier's exact re-wrap for the two flagged calls * test(ci): pin CI_BOT_PAT out of the workflow-level headers too --------- Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>		2026-08-21 03:48:03 +00:00
..
ai-release-notes-workflow.test.js	chore(ci): Disable install scripts in release CI and guard security-checks workflow (#9577)	2026-08-21 03:48:03 +00:00
audit-runtime-critical.test.js	ci: run Windows merge queue tests on ECS (#8386)	2026-08-05 12:14:42 +00:00
build-and-publish-image-workflow.test.js	ci(autofix): restore sandbox image flow (#6261)	2026-07-03 15:30:58 +00:00
capture-tmux-ci.test.js	ci: install tmux and zip tooling on the Linux test lane, and pin it (#8792)	2026-08-11 05:47:39 +00:00
check-build-status.test.js	fix(review): report what the transcripts prove; build the roster in one call (#7033)	2026-07-18 00:43:57 +00:00
check-i18n.test.ts	fix(cli): localize approval mode UI labels (#6592)	2026-07-11 00:07:03 +00:00
check-voice-guard-sync.test.js	feat(voice): support trusted private ASR base URLs (#8350)	2026-08-06 14:04:57 +00:00
chrome-extension-package.test.js	fix(ci): cover release integration regressions (#5994)	2026-06-29 11:54:11 +00:00
ci-flaky-rerun-workflow.test.js	fix(ci): stop dropping agent settings in resolve and follow-up workflows (#9252)	2026-08-16 03:27:00 +00:00
ci-flaky-rerun.test.js	feat(ci): auto-open a deflake fix issue for confirmed flaky tests (#7231)	2026-07-19 16:49:29 +00:00
clean-package-build-artifacts.test.js	test(core): stabilize file history eviction test (#6637)	2026-07-10 06:39:52 +00:00
cli-entry.test.js	fix(cli): preserve Qwen Review startup version in footers (#8431)	2026-08-04 14:58:56 +00:00
comment-attachment-guard-workflow.test.js	ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool (#8502)	2026-08-04 03:48:24 +00:00
cross-package-contracts.test.js	refactor: centralize cross-package contracts (#9497)	2026-08-20 06:24:41 +00:00
desktop-oss-workflow.test.js	fix(desktop): harden release pipeline (#9009)	2026-08-12 16:38:12 +00:00
dev.test.js	fix(review): report what the transcripts prove; build the roster in one call (#7033)	2026-07-18 00:43:57 +00:00
e2e-workflow.test.js	fix(ci): keep the post-merge E2E signal on main alive (#7795)	2026-07-28 11:54:52 +00:00
generate-changelog.test.js	feat(release): user-facing bilingual digest for release notes (#9216)	2026-08-17 00:12:04 +00:00
generate-release-notes.test.js	feat(release): user-facing bilingual digest for release notes (#9216)	2026-08-17 00:12:04 +00:00
get-release-version-python-sdk.test.js	feat(sdk-python): add network timeouts to release version helper (#3833)	2026-05-05 19:25:00 +08:00
get-release-version.test.js	fix(ci): force-push release branch so retries replace failed attempts (#9076) (#9082)	2026-08-16 16:33:14 +00:00
install-script.test.js	fix(install): avoid Get-FileHash for Windows checksums (#9112)	2026-08-14 01:12:08 +00:00
integration-vitest-config.test.ts	fix(tests): apply integration worker limits to forks (#8689)	2026-08-08 00:53:33 +00:00
issue-triage-ownership-workflow.test.js	ci: remove broken legacy scheduled PR triage workflow (#8434)	2026-08-03 10:20:42 +00:00
lint.test.js	fix(ci): cache downloaded linters on ECS runners (#9001)	2026-08-13 05:13:23 +00:00
live-host-oss-workflow.test.js	fix(ci): restore Live Host release mirroring (#8917)	2026-08-11 07:08:26 +00:00
main-ci-failure-issue-workflow.test.js	fix(ci): keep the post-merge E2E signal on main alive (#7795)	2026-07-28 11:54:52 +00:00
no-ak-integration-ci.test.js	feat(web-shell): add transcript contract prevalidation (#9388)	2026-08-19 14:13:12 +00:00
package-assets.test.js	fix(review): harden the pipeline against four live-run failures (#9086)	2026-08-14 04:38:49 +00:00
package-scripts.test.js	chore(ci): Disable install scripts in release CI and guard security-checks workflow (#9577)	2026-08-21 03:48:03 +00:00
pr-force-push-reminder-workflow.test.js	ci(autofix): run agents on dedicated ECS runners (#6207)	2026-07-03 07:40:07 +00:00
pr-self-report-label.test.js	feat(autofix): escalate stopped takeover PRs and age out unanswered pauses (#8960)	2026-08-15 17:32:23 +00:00
qwen-autofix-fork-bridge-workflow.test.js	feat(autofix): bridge fork-PR reviews into the credentialed review lane (#8676)	2026-08-07 16:11:48 +00:00
qwen-autofix-workflow.test.js	fix(ci): make autofix finding replies idempotent (#9463)	2026-08-20 14:10:26 +00:00
qwen-fleet-shepherd-workflow.test.js	fix(ci): stop counting wedged queued runs as in-flight in the shepherd (#9518)	2026-08-20 13:37:22 +00:00
qwen-pr-review-workflow.test.js	fix(ci): stop the fallback comment from denying a review it already posted (#9462)	2026-08-20 23:51:05 +00:00
qwen-repo-hygiene-workflow.test.js	fix(ci): route workflow label mutations through REST (#8761)	2026-08-09 15:05:15 +00:00
qwen-resolve-workflow.test.js	fix(ci): keep the review workflow under the expression-length limit (#8720)	2026-08-08 05:53:35 +00:00
qwen-triage-finalize-workflow.test.js	fix(ci): rename triage status marker to avoid duplicate-guard collision (#7723)	2026-07-26 15:51:22 +00:00
qwen-triage-workflow.test.js	fix(ci): heal a symlinked workspace instead of wedging the runner on it (#9498)	2026-08-20 13:54:36 +00:00
release-helpers.test.js	refactor: extract shared release helper utilities (#3834)	2026-05-05 10:15:17 +08:00
release-sdk-workflow.test.js	fix(ci): skip empty SDK release PR (#6861)	2026-07-14 13:19:42 +00:00
release-workflow.test.js	fix(ci): force-push release branch so retries replace failed attempts (#9076) (#9082)	2026-08-16 16:33:14 +00:00
review-source-digest.test.ts	refactor(cli): consolidate shared helpers ahead of the legacy audit skill (#9345)	2026-08-19 14:53:44 +00:00
review-worktree-cleanup-workflow.test.js	fix(ci): clean review worktrees after cancellation (#8474)	2026-08-05 02:39:36 +00:00
sandbox-command.test.js	fix(scripts): avoid shell injection in sandbox command detection (#6108)	2026-07-01 16:20:40 +08:00
sdk-java-workflow.test.js	ci: route trusted-author fork PRs and no-checkout jobs to the ECS pool (#8502)	2026-08-04 03:48:24 +00:00
sdk-node-exporter-stub.test.js	perf(telemetry): lazy-load the SDK and split OTLP exporter chains by protocol (#7276)	2026-07-21 07:35:30 +00:00
security-workflows.test.js	chore(ci): Add security hygiene: CODEOWNERS for release workflows, least-privilege permissions, security checks and Scorecard (#9008)	2026-08-14 01:22:53 +00:00
serve-ab-workflow.test.js	fix(ci): heal a symlinked workspace instead of wedging the runner on it (#9498)	2026-08-20 13:54:36 +00:00
serve-fast-path-bundle-check.test.js	feat(ci): fail the startup bundle check when the CLI entry is hoisted into a chunk (#8203)	2026-07-31 08:57:57 +00:00
start.test.js	fix(review): report what the transcripts prove; build the roster in one call (#7033)	2026-07-18 00:43:57 +00:00
test-setup.ts	feat(installer): add standalone archive installation (#3776)	2026-05-11 13:25:48 +08:00
update-ecs-runner-qwen-workflow.test.js	fix(ci): reconcile ECS runner updater on workflow changes (#8373)	2026-08-02 09:25:17 +00:00
upload-aliyun-oss-assets.test.js	feat(installer): add standalone hosted install and uninstall flow (#3828)	2026-05-21 11:57:10 +08:00
verify-capture.test.js	fix(ci): avoid verify capture color conflict (#8236)	2026-07-31 14:15:40 +00:00
vitest-global-setup.test.js	fix(devx): fail with actionable message when unit-test build prerequisites are missing (#9149) (#9171)	2026-08-18 13:19:09 +00:00
vitest.config.ts	fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes (#9277)	2026-08-18 06:49:40 +00:00
workflow-helpers.js	ci: run Windows merge queue tests on ECS (#8386)	2026-08-05 12:14:42 +00:00
workflow-size.test.js	fix(ci): keep qwen-autofix.yml under GitHub's 500 KB start-runs limit (#9517)	2026-08-20 01:56:45 +00:00
workspaces.test.js	feat(desktop): Add desktop app package with Qwen ACP SDK integration (#3778)	2026-06-11 21:57:20 +08:00