fix/memory 20695

.github/VOUCHED.td

@@ -10,14 +10,21 @@
 adamdotdevin
 -agusbasari29 AI PR slop
 ariane-emory
+-atharvau AI review spamming literally every PR
+-danieljoshuanazareth
+-danieljoshuanazareth
 edemaine
 -florianleibert
 fwang
 iamdavidhill
 jayair
 kitlangton
 kommander
+-opencode2026
+-opencodeengineer bot that spams issues
 r44vc0rp
 rekram1-node
+-robinmordasiewicz
 -spider-yamet clawdbot/llm psychosis, spam pinging the team
 thdxr
+-toastythebot

.github/actions/setup-bun/action.yml

@@ -3,14 +3,6 @@ description: "Setup Bun with caching and install dependencies"
 runs:
   using: "composite"
   steps:
-    - name: Cache Bun dependencies
-      uses: actions/cache@v4
-      with:
-        path: ~/.bun/install/cache
-        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
-        restore-keys: |
-          ${{ runner.os }}-bun-
-
     - name: Get baseline download URL
       id: bun-url
       shell: bash
@@ -31,6 +23,31 @@ runs:
         bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
         bun-download-url: ${{ steps.bun-url.outputs.url }}
 
+    - name: Get cache directory
+      id: cache
+      shell: bash
+      run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
+
+    - name: Cache Bun dependencies
+      uses: actions/cache@v4
+      with:
+        path: ${{ steps.cache.outputs.dir }}
+        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-bun-
+
+    - name: Install setuptools for distutils compatibility
+      run: python3 -m pip install setuptools || pip install setuptools || true
+      shell: bash
+
     - name: Install dependencies
-      run: bun install
+      run: |
+        # Workaround for patched peer variants
+        # e.g. ./patches/ for standard-openapi
+        # https://github.com/oven-sh/bun/issues/28147
+        if [ "$RUNNER_OS" = "Windows" ]; then
+          bun install --linker hoisted
+        else
+          bun install
+        fi
       shell: bash

.github/workflows/close-issues.yml

@@ -0,0 +1,24 @@
+name: close-issues
+
+on:
+  schedule:
+    - cron: "0 2 * * *" # Daily at 2:00 AM
+  workflow_dispatch:
+
+jobs:
+  close:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Close stale issues
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: bun script/github/close-issues.ts

.github/workflows/deploy.yml

@@ -11,7 +11,7 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   deploy:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
 

.github/workflows/docs-locale-sync.yml

@@ -9,7 +9,8 @@ on:
 
 jobs:
   sync-locales:
-    if: github.actor != 'opencode-agent[bot]'
+    if: false
+    #if: github.actor != 'opencode-agent[bot]'
     runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -34,7 +35,7 @@ jobs:
       - name: Compute changed English docs
         id: changes
         run: |
-          FILES=$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" -- 'packages/web/src/content/docs/*.mdx' || true)
+          FILES=$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" -- ':(glob)packages/web/src/content/docs/*.mdx' || true)
           if [ -z "$FILES" ]; then
             echo "has_changes=false" >> "$GITHUB_OUTPUT"
             echo "No English docs changed in push range"
@@ -47,60 +48,26 @@ jobs:
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
+      - name: Install OpenCode
+        if: steps.changes.outputs.has_changes == 'true'
+        run: curl -fsSL https://opencode.ai/install | bash
+
       - name: Sync locale docs with OpenCode
         if: steps.changes.outputs.has_changes == 'true'
-        uses: sst/opencode/github@latest
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
           OPENCODE_CONFIG_CONTENT: |
             {
               "permission": {
                 "*": "deny",
-                "read": {
-                  "*": "deny",
-                  "packages/web/src/content/docs": "allow",
-                  "packages/web/src/content/docs/*": "allow",
-                  "packages/web/src/content/docs/*.mdx": "allow",
-                  "packages/web/src/content/docs/*/*.mdx": "allow",
-                  ".opencode": "allow",
-                  ".opencode/agent": "allow",
-                  ".opencode/glossary": "allow",
-                  ".opencode/agent/translator.md": "allow",
-                  ".opencode/glossary/*.md": "allow"
-                },
-                "edit": {
-                  "*": "deny",
-                  "packages/web/src/content/docs/*/*.mdx": "allow"
-                },
-                "glob": {
-                  "*": "deny",
-                  "packages/web/src/content/docs*": "allow",
-                  ".opencode/glossary*": "allow"
-                },
-                "task": {
-                  "*": "deny",
-                  "translator": "allow"
-                }
-              },
-              "agent": {
-                "translator": {
-                  "permission": {
-                    "*": "deny",
-                    "read": {
-                      "*": "deny",
-                      ".opencode/agent/translator.md": "allow",
-                      ".opencode/glossary/*.md": "allow"
-                    }
-                  }
-                }
+                "read": "allow",
+                "edit": "allow",
+                "glob": "allow",
+                "task": "allow"
               }
             }
-        with:
-          model: opencode/gpt-5.3-codex
-          agent: docs
-          use_github_token: true
-          prompt: |
+        run: |
+          opencode run --agent docs --model opencode/gpt-5.3-codex <<'EOF'
             Update localized docs to match the latest English docs changes.
 
             Changed English doc files:
@@ -118,6 +85,7 @@ jobs:
             7. Keep locale docs structure aligned with their corresponding English pages.
             8. Do not modify English source docs in packages/web/src/content/docs/*.mdx.
             9. If no locale updates are needed, make no changes.
+          EOF
 
       - name: Commit and push locale docs updates
         if: steps.changes.outputs.has_changes == 'true'

.github/workflows/nix-hashes.yml

@@ -17,6 +17,10 @@ on:
       - "patches/**"
       - ".github/workflows/nix-hashes.yml"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # Native runners required: bun install cross-compilation flags (--os/--cpu)
   # do not produce byte-identical node_modules as native installs.
@@ -56,7 +60,7 @@ jobs:
           nix build ".#packages.${SYSTEM}.node_modules_updater" --no-link 2>&1 | tee "$BUILD_LOG" || true
 
           # Extract hash from build log with portability
-          HASH="$(grep -oE 'sha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | tail -n1 || true)"
+          HASH="$(nix run --inputs-from . nixpkgs#gnugrep -- -oP 'got:\s*\Ksha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | tail -n1 || true)"
 
           if [ -z "$HASH" ]; then
             echo "::error::Failed to compute hash for ${SYSTEM}"