From 61bf1b014fdf88f5c84f01f11d34477db9a2597a Mon Sep 17 00:00:00 2001 From: sanketsahu Date: Mon, 3 Aug 2026 18:50:20 +0530 Subject: [PATCH 1/2] fix: declare experimentalDecorators in the base tsconfig, and pin bun in CI The first CI run this fork has ever had went red: 3 failures in the mikro-orm sample, all `TypeError: undefined is not an object (evaluating 'target.constructor')` from @mikro-orm/core's @PrimaryKey. They pass locally and are unrelated to any recent change - CI pointing at `master`, which never receives pushes here, is what kept them invisible. The cause is a bun regression, reduced to: base.json { "compilerOptions": { "alwaysStrict": true } } tsconfig.json { "extends": "./base.json", "compilerOptions": { "experimentalDecorators": true } } Under bun 1.3.14 a legacy decorator on a class field receives `undefined` as its target; drop the `extends` and it receives the object. bun reads experimentalDecorators only from the base of an extends chain and ignores the child's value, so it applied modern TC39 semantics to decorators written against the legacy protocol. mikro-orm 5's decorators are legacy, hence the sample. bun 1.2.21, which is what I had locally, is unaffected. Declaring it in tsconfig.deno.json - the base of the chain - fixes it. Duplication with tsconfig.json, which tsc resolves identically either way, and preferable to the alternatives: dropping the `extends` also drops strict, noImplicitAny and strictNullChecks, since that base is where they come from, and a per-directory tsconfig beside the sample has no effect because bun resolves from the cwd. CI's bun is pinned rather than `latest`, since an unpinned toolchain lets a bun release break CI with no change of ours - which is exactly what happened. Verified under both 1.2.21 and 1.3.14: typecheck clean, 1266 pass / 0 fail, and the Deno port check still 9/9 with build:deno a no-op. Co-Authored-By: Claude Opus 5 --- .github/workflows/main.yml | 5 +++++ tsconfig.deno.json | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index c378adc7..ac2ec8b5 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -12,7 +12,12 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + # Pinned rather than `latest`: an unpinned toolchain means a bun release can + # break CI with no change of ours, which is how the decorator regression in + # 1.3.x first showed up here. Verified against 1.2.21 and 1.3.14. - uses: oven-sh/setup-bun@v1 + with: + bun-version: 1.3.14 - run: bun install - run: bun typecheck - run: bun test diff --git a/tsconfig.deno.json b/tsconfig.deno.json index ac70923d..c01d772b 100644 --- a/tsconfig.deno.json +++ b/tsconfig.deno.json @@ -1,6 +1,13 @@ { // === THIS IS THE DEFAULT DENO CONFIGURATION : https://deno.land/manual/getting_started/typescript "compilerOptions": { + // Also set in tsconfig.json, but it has to be here: bun (1.3.x) reads this + // option only from the base of an `extends` chain and ignores the child's + // value, so with it declared solely downstream, bun applied modern TC39 + // decorator semantics to legacy decorators. mikro-orm's @PrimaryKey then + // received `undefined` as its target and the samples blew up under CI's + // bun while passing on 1.2.x. Harmless duplication for tsc. + "experimentalDecorators": true, "allowJs": false, "allowUmdGlobalAccess": false, "allowUnreachableCode": false, From 1ad0abf01bed7a48a2869198bcadeb57492a00da Mon Sep 17 00:00:00 2001 From: sanketsahu Date: Mon, 3 Aug 2026 18:54:06 +0530 Subject: [PATCH 2/2] ci: bring CodeQL up to a supported version, and modernise the actions CodeQL was the 2020 template inherited from upstream and had never run successfully here, so nothing flagged how far behind it was. Two hard failures: Error: This version of the CodeQL Action was deprecated on January 18th, 2023, and is no longer updated or supported. Error: Encountered an error while trying to determine feature enablement: HttpError: Resource not accessible by integration So: codeql-action v1 -> v3, and a permissions block, which is what the second error is about - uploading results needs security-events: write, and the action reads workflow metadata to correlate runs. The default token grants neither. Also drops the Autobuild step. That exists for compiled languages; CodeQL extracts JS/TS straight from source, so it only added time and a way to fail. The language is now 'javascript-typescript', the current name for what used to be 'javascript'. actions/checkout v2 -> v4 in both workflows, which clears the Node 20 deprecation warnings the runner emits. No change to what is analysed or tested, only to the machinery running it. Co-Authored-By: Claude Opus 5 --- .github/workflows/codeql-analysis.yml | 63 +++++++++------------------ .github/workflows/main.yml | 2 +- 2 files changed, 21 insertions(+), 44 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 632e97d0..5a51a940 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -1,14 +1,3 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# name: "CodeQL" on: @@ -20,6 +9,14 @@ on: schedule: - cron: '24 7 * * 0' +# Without these, init fails with "Resource not accessible by integration": +# uploading results needs security-events: write, and the action reads workflow +# metadata to correlate runs. +permissions: + actions: read + contents: read + security-events: write + jobs: analyze: name: Analyze @@ -28,40 +25,20 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'javascript' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] - # Learn more: - # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed + language: ['javascript-typescript'] steps: - - name: Checkout repository - uses: actions/checkout@v2 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v1 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v1 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 https://git.io/JvXDl + - name: Checkout repository + uses: actions/checkout@v4 - # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines - # and modify them (or add more) to build your code if your project - # uses a compiled language + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} - #- run: | - # make bootstrap - # make release + # No Autobuild step: that exists for compiled languages (C/C++, C#, Java, + # Go). CodeQL extracts JS/TS straight from source, so building first buys + # nothing and adds a failure mode. - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ac2ec8b5..91bee81d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -11,7 +11,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 # Pinned rather than `latest`: an unpinned toolchain means a bun release can # break CI with no change of ours, which is how the decorator regression in # 1.3.x first showed up here. Verified against 1.2.21 and 1.3.14.