ci: publish signed fork nightlies - #2
Merged
Conversation
github-actions
Bot
added
vouch:trusted
incognitojam
force-pushed
the
t3code/fork-nightly-releases
branch
from
August 5, 2026 11:43
96177f4 to
8778380
Compare
incognitojam
changed the title
incognitojam
force-pushed
the
t3code/fork-nightly-releases
branch
from
August 5, 2026 11:58
8778380 to
fd80fab
Compare
incognitojam
added a commit
that referenced
this pull request
Aug 6, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 6, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 6, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 6, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 7, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 8, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 8, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 9, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 10, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 11, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 11, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 14, 2026
`#123`, `GH-123` and `owner/repo#123` name an issue or a pull request, and a bare URL to one is written back as that shorthand. Neither is GFM, so remark left both as they were. The link is addressed at `/issues/{n}` whichever kind it turns out to be: the host redirects that to `/pull/{n}` for a pull request, so the link is right in a browser before anything is known about it. Inert without a repository to read a number against, which is what keeps `#2` in a conversation the plain text it reads as. Nothing passes one yet. The matching rules are GitHub's own, each checked against its renderer: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. The body is read twice — as a tree to linkify, as text to collect what to ask about — so the two are held to an invariant rather than to each other: asking covers everything rendered, since over-asking costs one entry in a batch while under-asking would leave a rendered reference unanswered for good. A test holds that containment over the bodies where they disagree. The marker travels as a data attribute, so the sanitizer's allowlist is part of the feature: one missing from it is stripped silently, and every test that stops before the rehype half keeps passing while nothing renders at all.
incognitojam
added a commit
that referenced
this pull request
Aug 14, 2026
`#123`, `GH-123` and `owner/repo#123` name an issue or a pull request, and a bare URL to one is written back as that shorthand. Neither is GFM, so remark left both as they were. The link is addressed at `/issues/{n}` whichever kind it turns out to be: the host redirects that to `/pull/{n}` for a pull request, so the link is right in a browser before anything is known about it. Inert without a repository to read a number against, which is what keeps `#2` in a conversation the plain text it reads as. Nothing passes one yet. The matching rules are GitHub's own, each checked against its renderer: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. The body is read twice — as a tree to linkify, as text to collect what to ask about — so the two are held to an invariant rather than to each other: asking covers everything rendered, since over-asking costs one entry in a batch while under-asking would leave a rendered reference unanswered for good. A test holds that containment over the bodies where they disagree. The marker travels as a data attribute, so the sanitizer's allowlist is part of the feature: one missing from it is stripped silently, and every test that stops before the rehype half keeps passing while nothing renders at all.
incognitojam
added a commit
that referenced
this pull request
Aug 14, 2026
`#123`, `GH-123` and `owner/repo#123` name an issue or a pull request, and a bare URL to one is written back as that shorthand. Neither is GFM, so remark left both as they were. The link is addressed at `/issues/{n}` whichever kind it turns out to be: the host redirects that to `/pull/{n}` for a pull request, so the link is right in a browser before anything is known about it. Inert without a repository to read a number against, which is what keeps `#2` in a conversation the plain text it reads as. Nothing passes one yet. The matching rules are GitHub's own, each checked against its renderer: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. The body is read twice — as a tree to linkify, as text to collect what to ask about — so the two are held to an invariant rather than to each other: asking covers everything rendered, since over-asking costs one entry in a batch while under-asking would leave a rendered reference unanswered for good. A test holds that containment over the bodies where they disagree. The marker travels as a data attribute, so the sanitizer's allowlist is part of the feature: one missing from it is stripped silently, and every test that stops before the rehype half keeps passing while nothing renders at all.
incognitojam
added a commit
that referenced
this pull request
Aug 14, 2026
> [!NOTE] > `#123`, `GH-123` and `owner/repo#123` in a pull request body are now links, the way they are on > GitHub. What each number turns out to be decides where it opens: a pull request in a project on > this machine opens as a tab beside the one being read, an issue opens in a browser, and a number > the host has nothing under is underlined in red and still opens. GitHub's autolinked references are its own extension rather than GFM, so remark left them as they were: every `pingdotgg#6039` an agent or a reviewer wrote in a description, a comment or a review stayed plain text, and following one meant retyping it into a browser. Reading them is the easy half. Knowing what one *is* takes asking the host, and a body can name a dozen — so they are asked about together, in one GraphQL document, aliased by repository and by number. `issueOrPullRequest` answers which of the two each number turned out to be, which is what decides where it opens; a cache keeps a panel of many bodies from spawning a process per body for numbers a neighbour just resolved. The link is addressed at `/issues/{n}` before any of that comes back, because the host redirects that to `/pull/{n}` for a pull request — so it is already right in a browser, and resolving only ever improves it. A reference clicked before its answer arrives follows it as written. Everything else follows from one rule: **only an answer marks a link as broken.** A request that failed on the way — rate limited, logged out, offline — leaves every reference exactly as it was, and a null is read as nothing-there only where the host filed `NOT_FOUND` against it, since `FORBIDDEN` is SAML or an IP allowlist standing between the reader and something they can very likely open themselves. A host having a bad minute must not repaint a body full of good references as mistakes. Inert unless a surface passes the repository to read numbers against, so `#2` in a conversation — where it is far more likely to be a step than an issue — stays the plain text it reads as. ## Before / after The description of #126, which cites the stale-stack guard from `#95` and the window it was built for (`#94`). | Before | After | | --- | --- | | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/before.png" alt="Reference numbers rendered as plain grey text" width="460"> | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/after.png" alt="The same numbers rendered as links" width="460"> | `#95` resolves to a pull request and opens as a tab here; `#94` resolves to an issue and opens in a browser, since there is no issue surface to open it in. A reference the host has nothing under keeps its link colour and takes the mark an unknown word takes. No pull request in this repository happens to cite a number the repository lacks, so the state below was forced on a resolved reference to photograph it: <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/missing.png" alt="A reference underlined with a red wavy line" width="460"> ## Reading the commits Three layers, each of which stands alone: the plugin that reads references and renders nothing differently on its own, the request that answers them and is called by nobody, then the wiring that turns both on. ## Verification - `vp test run` for the touched suites: `sourceControl` (147), `GitManager`, and the web `markdown-github-references`, `chat` and `pullRequest` suites (469). - Targeted `tsgo --noEmit` for `apps/web`, `apps/server` and `packages/contracts`, at each of the three commits rather than only at the tip. - The matching rules are GitHub's own, each checked against its renderer before being written down: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. - Read live against this repository in `test-t3-app`: references linkified in a real description, `#95` re-addressed itself to `/pull/95` and opened here, `#94` stayed addressed for the browser. That pass is also what found two faults nothing else did — a memoized renderer holding the first render's answers, and a mark cancelled by `.chat-markdown a { text-decoration: none }`. --- Written by an agent (T3 Code, claude-opus-5).
incognitojam
added a commit
that referenced
this pull request
Aug 15, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 15, 2026
> [!NOTE] > `#123`, `GH-123` and `owner/repo#123` in a pull request body are now links, the way they are on > GitHub. What each number turns out to be decides where it opens: a pull request in a project on > this machine opens as a tab beside the one being read, an issue opens in a browser, and a number > the host has nothing under is underlined in red and still opens. GitHub's autolinked references are its own extension rather than GFM, so remark left them as they were: every `pingdotgg#6039` an agent or a reviewer wrote in a description, a comment or a review stayed plain text, and following one meant retyping it into a browser. Reading them is the easy half. Knowing what one *is* takes asking the host, and a body can name a dozen — so they are asked about together, in one GraphQL document, aliased by repository and by number. `issueOrPullRequest` answers which of the two each number turned out to be, which is what decides where it opens; a cache keeps a panel of many bodies from spawning a process per body for numbers a neighbour just resolved. The link is addressed at `/issues/{n}` before any of that comes back, because the host redirects that to `/pull/{n}` for a pull request — so it is already right in a browser, and resolving only ever improves it. A reference clicked before its answer arrives follows it as written. Everything else follows from one rule: **only an answer marks a link as broken.** A request that failed on the way — rate limited, logged out, offline — leaves every reference exactly as it was, and a null is read as nothing-there only where the host filed `NOT_FOUND` against it, since `FORBIDDEN` is SAML or an IP allowlist standing between the reader and something they can very likely open themselves. A host having a bad minute must not repaint a body full of good references as mistakes. Inert unless a surface passes the repository to read numbers against, so `#2` in a conversation — where it is far more likely to be a step than an issue — stays the plain text it reads as. The description of #126, which cites the stale-stack guard from `#95` and the window it was built for (`#94`). | Before | After | | --- | --- | | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/before.png" alt="Reference numbers rendered as plain grey text" width="460"> | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/after.png" alt="The same numbers rendered as links" width="460"> | `#95` resolves to a pull request and opens as a tab here; `#94` resolves to an issue and opens in a browser, since there is no issue surface to open it in. A reference the host has nothing under keeps its link colour and takes the mark an unknown word takes. No pull request in this repository happens to cite a number the repository lacks, so the state below was forced on a resolved reference to photograph it: <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/missing.png" alt="A reference underlined with a red wavy line" width="460"> Three layers, each of which stands alone: the plugin that reads references and renders nothing differently on its own, the request that answers them and is called by nobody, then the wiring that turns both on. - `vp test run` for the touched suites: `sourceControl` (147), `GitManager`, and the web `markdown-github-references`, `chat` and `pullRequest` suites (469). - Targeted `tsgo --noEmit` for `apps/web`, `apps/server` and `packages/contracts`, at each of the three commits rather than only at the tip. - The matching rules are GitHub's own, each checked against its renderer before being written down: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. - Read live against this repository in `test-t3-app`: references linkified in a real description, `#95` re-addressed itself to `/pull/95` and opened here, `#94` stayed addressed for the browser. That pass is also what found two faults nothing else did — a memoized renderer holding the first render's answers, and a mark cancelled by `.chat-markdown a { text-decoration: none }`. --- Written by an agent (T3 Code, claude-opus-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 18, 2026
> [!NOTE] > `#123`, `GH-123` and `owner/repo#123` in a pull request body are now links, the way they are on > GitHub. What each number turns out to be decides where it opens: a pull request in a project on > this machine opens as a tab beside the one being read, an issue opens in a browser, and a number > the host has nothing under is underlined in red and still opens. GitHub's autolinked references are its own extension rather than GFM, so remark left them as they were: every `pingdotgg#6039` an agent or a reviewer wrote in a description, a comment or a review stayed plain text, and following one meant retyping it into a browser. Reading them is the easy half. Knowing what one *is* takes asking the host, and a body can name a dozen — so they are asked about together, in one GraphQL document, aliased by repository and by number. `issueOrPullRequest` answers which of the two each number turned out to be, which is what decides where it opens; a cache keeps a panel of many bodies from spawning a process per body for numbers a neighbour just resolved. The link is addressed at `/issues/{n}` before any of that comes back, because the host redirects that to `/pull/{n}` for a pull request — so it is already right in a browser, and resolving only ever improves it. A reference clicked before its answer arrives follows it as written. Everything else follows from one rule: **only an answer marks a link as broken.** A request that failed on the way — rate limited, logged out, offline — leaves every reference exactly as it was, and a null is read as nothing-there only where the host filed `NOT_FOUND` against it, since `FORBIDDEN` is SAML or an IP allowlist standing between the reader and something they can very likely open themselves. A host having a bad minute must not repaint a body full of good references as mistakes. Inert unless a surface passes the repository to read numbers against, so `#2` in a conversation — where it is far more likely to be a step than an issue — stays the plain text it reads as. The description of #126, which cites the stale-stack guard from `#95` and the window it was built for (`#94`). | Before | After | | --- | --- | | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/before.png" alt="Reference numbers rendered as plain grey text" width="460"> | <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/after.png" alt="The same numbers rendered as links" width="460"> | `#95` resolves to a pull request and opens as a tab here; `#94` resolves to an issue and opens in a browser, since there is no issue surface to open it in. A reference the host has nothing under keeps its link colour and takes the mark an unknown word takes. No pull request in this repository happens to cite a number the repository lacks, so the state below was forced on a resolved reference to photograph it: <img src="https://raw.githubusercontent.com/yngatech/t3code/assets/github-reference-links/missing.png" alt="A reference underlined with a red wavy line" width="460"> Three layers, each of which stands alone: the plugin that reads references and renders nothing differently on its own, the request that answers them and is called by nobody, then the wiring that turns both on. - `vp test run` for the touched suites: `sourceControl` (147), `GitManager`, and the web `markdown-github-references`, `chat` and `pullRequest` suites (469). - Targeted `tsgo --noEmit` for `apps/web`, `apps/server` and `packages/contracts`, at each of the three commits rather than only at the tip. - The matching rules are GitHub's own, each checked against its renderer before being written down: `foo#123` and `#123abc` are not references, `(#123)`, `#123.`, `#123-abc` and `/#123` are, `#0` is not, and code spans and link labels are left alone. - Read live against this repository in `test-t3-app`: references linkified in a real description, `#95` re-addressed itself to `/pull/95` and opened here, `#94` stayed addressed for the browser. That pass is also what found two faults nothing else did — a memoized renderer holding the first render's answers, and a mark cancelled by `.chat-markdown a { text-decoration: none }`. --- Written by an agent (T3 Code, claude-opus-5).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fork needs an independent release path because the inherited upstream release workflow relies on private runners, credentials, and hosted infrastructure that are unavailable here.
This adds a fork-only workflow that runs every six hours or on manual dispatch. It rebases the human-maintained
mainpatch stack onto the latestpingdotgg/t3code@main, verifies the candidate, builds the macOS arm64 desktop app, and publishes a GitHub prerelease. Failed rebases or builds are never promoted to the successfulnightlybranch.macOS artifacts are required to be Developer ID signed and notarized. The workflow fails instead of publishing an unsigned release when Apple configuration is missing, and validates that the provisioning profile contains
CUL32MJZ4U.dev.incognitojam.t3codeplus every configured Clerk associated domain before building.Release assets are uploaded to a hidden draft first and the prerelease is published only after the complete asset set is present. Any prepare, build, or release failure sends a run summary to the configured Discord webhook.
Validation:
actionlint .github/workflows/fork-nightly.ymlpingdotgg/t3code@mainvp test run scripts/build-desktop-artifact.test.ts scripts/resolve-nightly-release.test.ts apps/desktop/src/app/DesktopAppIdentity.test.ts apps/desktop/src/app/DesktopEnvironment.test.ts(45 tests)Model: GPT-5.6 (Codex harness in T3 Code)