chore(tinyvectors): retire the npm lane — registry tag archive at v0.3.5 - #242
Open
Jesssullivan wants to merge 3 commits into
Open
chore(tinyvectors): retire the npm lane — registry tag archive at v0.3.5#242Jesssullivan wants to merge 3 commits into
Jesssullivan wants to merge 3 commits into
Conversation
Executes the 2026-07-25 channel decision (TIN-3165): tinyvectors now resolves from the exact GitHub tag archive the bazel-registry names, with the integrity-verified prepare hook (sha256 hard-fail against the registry pin, byte-identical tree proof, dist built from verified bytes). MODULE.bazel lockstep at 0.3.5; Bazel site lanes consume the hermetic @tummycrypt_tinyvectors//:pkg via the new override seam. Behavior deltas from 0.2.3, flagged: dark mode finally engages the screen blend (0.3.5 multi-signal detection matches this site's data-mode signal — 0.2.3 only watched a .dark class that never existed here); enablePointerPhysics pinned false to suppress the new default-on pointer physics; 0.3.0 gel-feel motion character comes with the version line. npm ci fresh-install proof: zero npmjs fetches for tinyvectors, negative pin test exit 1; vite build + lint green; Bazel lanes all PASSED incl. 10/10 e2e with the four blob specs.
Jesssullivan
enabled auto-merge
July 25, 2026 13:48
Both container builds ran their npm install before COPY'd sources, so the new root prepare hook (scripts/build-tinyvectors.mjs) was absent at install time and the shadow-image build failed with Cannot find module. Same defect shape the GFTB review caught in its ContainerFile; the script now lands ahead of npm install/ci in both files.
Unblocks the production-scoped npm audit gate (GHSA-c2j3-45gr-mqc4, low). Calendar-driven: the advisory published after main's last CI run (July 17), so the gate fails on any branch today regardless of diff. 8-line lockfile bump via npm audit fix; npm ci + full site build green with the verified tinyvectors hook.
Jesssullivan
had a problem deploying
to
blog-shadow-dispatch
July 25, 2026 15:05 — with 
GitHub Actions
Error
GitHub Actions
Error
This was referenced Jul 25, 2026
Owner
Author
|
Credential replacement is now bounded in #243: a dedicated Contents-read GitHub App installed only on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Last consumer migration for the npm retirement (TIN-3165); pattern of record from dsa-woodshed.space#49 + GFTB#152.
Changes: tarball pin to the registry-named v0.3.5 archive; integrity-verified prepare hook (sha256 hard-fail, byte-identical tree proof, dist from verified bytes; adapted to this repo's npm rail + pacote rename allowance); MODULE.bazel lockstep; Bazel site lanes consume the hermetic
@tummycrypt_tinyvectors//:pkgvia a new override seam.Behavior deltas (flagged, intended): dark mode finally engages the
screenblend — 0.2.3 only watched a.darkclass this site never sets, 0.3.5's multi-signal detection matches the existingdata-modesignal with zero new wiring (verified in the built bundle).enablePointerPhysics={false}pinned to suppress the new default-on pointer physics. The 0.3.0 gel-feel motion character comes with the version line.Validation (adversarially double-verified):
npm cifresh install with zero npmjs fetches for tinyvectors + corrupted-pin negative test exit 1; vite build + lint green; Bazel://:pkg, vite-build smoke, svelte-check, vitest, workspace checks, and//:playwright_chromium_e2e10/10 incl. all four Blob Background specs all PASSED; render verdict under GitHub-Pages semantics with light/dark screenshots.Follow-ups noted, not in scope: the two dev-only
@tummycrypt/vite-plugin-*@0.2.2deps still resolve from npmjs (same retirement treatment later); no parity guard yet tying MODULE.bazel/pin/SRI (woodshed's script is the template); non-site workflows pay the one-time hook build (~60-90s) — trimmable with --ignore-scripts later.