enricobuehlerandClaude Fable 5 cd67bd5d30 ci(audit): scope decky to shipped deps; make docs-site non-blocking deterministically ...

First real-runner dispatch (run 13627) surfaced two calibration issues:
* pnpm audit flagged 6 high advisories — all in decky's devDependencies
  (the rollup build toolchain), which never ship: the plugin bundle carries
  prod deps only. --prod scopes the gate to what users get, matching the
  locally-validated state (clean).
* docs-site relied on job-level continue-on-error, which act_runner does
  not reliably honor — replaced with a step-level '||' warning so the known
  advisories can never take the run red while staying visible in the log.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-29 00:59:29 +02:00

..

android-screenshots.yml

ci: SHA-pin secret-bearing third-party actions + audit the web dep tree

2026-07-06 07:28:45 +02:00

android.yml

ci(android): survive fleet-load download truncation in the SDK setup

2026-07-22 22:12:02 +02:00

announce.yml

feat(ci/release): author release notes in-repo + announce stable releases to Discord

2026-07-23 16:43:18 +02:00

apple.yml

fix(security): anti-replay, 0600 client key, open redirect, supply-chain

2026-07-10 10:04:23 +02:00

arch.yml

fix(packaging): every channel that ships punktfunk-gamescope now builds it

2026-07-28 18:03:30 +02:00

audit.yml

ci(audit): scope decky to shipped deps; make docs-site non-blocking deterministically

2026-07-29 00:59:29 +02:00

bench-gpu.yml

bench(ci): report-only regression harness — Tier-1/2 in CI + Tier-3 GPU runner

2026-06-13 19:24:52 +00:00

ci.yml

fix(ci): the shader drift gate never ran — dash has no process substitution

2026-07-28 18:28:29 +02:00

deb.yml

fix(packaging/tray): the .deb must build the tray in its own cargo invocation

2026-07-28 17:01:59 +02:00

decky.yml

fix(decky): actually ship shortcut artwork + Steam Input layout in the published plugin

2026-07-21 22:36:55 +02:00

deploy-services.yml

feat(packaging/winget): install the Windows host with winget, from our own source

2026-07-26 19:09:13 +02:00

docker.yml

build(ci): cross-compile and publish an aarch64 Linux client

2026-07-25 14:32:45 +02:00

flatpak.yml

ci(flatpak): drop the use-vc TCP-DNS hack — the runner-side cache made it the failure

2026-07-23 00:27:52 +02:00

linux-client-screenshots.yml

fix(packaging): vulkan-headers build dep + ship punktfunk-session across desktop packages

2026-07-07 23:41:10 +02:00

plugin-kit-publish.yml

ci(plugin-kit): quote the step name that contains a colon

2026-07-26 20:45:58 +02:00

release.yml

feat(ci/apple): export the iOS .ipa to the release + run artifacts

2026-07-23 18:18:45 +02:00

rpm.yml

fix(packaging): every channel that ships punktfunk-gamescope now builds it

2026-07-28 18:03:30 +02:00

sbom.yml

ci: the supply chain accounts for itself — per-release SBOM, full-tree audits, a real license gate

2026-07-29 00:59:29 +02:00

sdk-publish.yml

build(sdk): publish @punktfunk/host to the Gitea npm registry

2026-07-17 15:54:36 +02:00

web-screenshots.yml

feat(web): CI screenshot capture for the mgmt console

2026-06-28 15:05:27 +00:00

windows-drivers.yml

fix(drivers): the pad channel asks the devnode who to trust, not the mailbox

2026-07-28 16:54:40 +02:00

windows-host.yml

fix(ci/windows): the web install was the one CI site still running lifecycle scripts

2026-07-29 00:18:27 +02:00

windows-msix.yml

feat(client/windows): make the console UI findable, and launchable on its own

2026-07-19 19:06:06 +02:00

windows.yml

fix(security): anti-replay, 0600 client key, open redirect, supply-chain

2026-07-10 10:04:23 +02:00