* ci(security): pin android-emulator-runner action by commit SHA
Scorecard Pinned-Dependencies flagged the two
reactivecircus/android-emulator-runner@v2 usages in android-e2e.yml as
third-party actions not pinned by hash (code-scanning alerts #116, #117).
Pin both to the full commit SHA the v2 tag currently resolves to
(e89f39f = v2.37.0), matching the @<sha> # <version> convention already
used by every other action in this workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci(pull-request): shard web unit tests and split out test_extensions
The jsdom unit suite was ~115s of the 280s test_web_app job — the slowest
check on every PR. Split it across two parallel shards with vitest --shard,
and move the browser-extension + koplugin tests into a new test_extensions
job.
- test_web_app: matrix shard [1, 2] running `vitest run --shard=N/2`;
Playwright + browser tests run on shard 1 only.
- test_extensions: extension tests + browser-ext build run always; the
koplugin Lua tests (and their ~45s LuaJIT/busted install) run only when
apps/readest.koplugin/** changed, detected via dorny/paths-filter
(pinned by SHA; needs pull-requests: read to list PR files).
- package.json: add test:pr:web:unit so CI can append --shard;
test:pr:web still runs the full sequence locally.
Cuts the PR critical path from ~280s toward ~188s (now build_tauri_app).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci(pull-request): isolate koplugin lint + LuaJIT install into test_extensions
build_web_app was the slowest PR job and installed LuaJIT + ran the koplugin
syntax check on every PR. Move all koplugin tooling into test_extensions,
gated on apps/readest.koplugin/** like the koplugin Lua tests already are:
- build_web_app drops the LuaJIT install.
- test_extensions installs LuaJIT/busted and runs `pnpm lint:lua` + `pnpm
test:lua` only when the koplugin sources changed.
- `pnpm lint` is now web-only (tsgo + biome); `lint:lua` stays a standalone
script that test_extensions (and local koplugin work) calls directly. This
also drops koplugin lint from the pre-push hook.
- verification rule updated to match.
Most PRs now skip the koplugin toolchain entirely.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dependabot[bot]