chore: cherry-pick main commits to resolve dev conflicts (unblocks #360)#368
Merged
AugustoL merged 2 commits intoApr 29, 2026
Merged
Conversation
|
🚀 Preview: https://pr-368--openscan.netlify.app |
Storacha's add-to-web3 action uses different UnixFS encoding parameters (1 MiB raw-leaf chunks) than our local Kubo setup (256 KiB UnixFS-wrapped chunks), producing mismatched CIDs between local and CI builds. Replace Storacha with Kubo in the CI workflow to ensure identical IPFS hashes in both environments. Also guard the local build script's IPFS commands behind a Kubo availability check.
AugustoL
force-pushed
the
chore/merge-main-into-dev
branch
from
2df8d2c to
11d2b77
Compare
AugustoL
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Cherry-pick the two commits from
mainthat conflict withdev's release branch (#360), so PR #360 becomes mergeable. Original authorship preserved on both commits.Type of Change
Changes Made
Cherry-picked
fix(ci): replace Storacha with Kubo for consistent IPFS hash generation(originally6c3e3econ main, fix(ci): replace Storacha with Kubo for IPFS hash generation #321) — Storacha'sadd-to-web3action uses different UnixFS encoding parameters than local Kubo, producing mismatched CIDs between local and CI builds. Replaces it with Kubo CLI in the workflow and adds acommand -v ipfsguard to the local build script. Conflicted with the SHA-pin forstoracha/add-to-web3from fix(security): address H-1, H-2, M-3, M-4 from security review #365 — pin dropped because Storacha is no longer used.CI: Update actions/checkout and actions/setup-node to @v5(originally61b6caeon main, Fix npm publish github action #349) — applied cleanly topublish-npm.yml. Bun setup pin from fix(security): address H-1, H-2, M-3, M-4 from security review #365 untouched.Why cherry-pick instead of merge
A merge of
mainintodevwould surface every commit onmainsince the v1.2.5-alpha cycle in this PR (env migration, IPFS hash update, version bump, etc.) — even though only 3 files differ. Cherry-picking only the two commits that actually conflict keeps this PR's commit list and history minimal: 2 commits, 3 files.Checklist
Additional Notes
dev, PR v1.2.6-a #360 (dev → main) will be mergeable.STORACHA_PRINCIPAL,STORACHA_PROOF) are no longer referenced by any workflow ondevafter this merges. They can be removed from the repo's GitHub secrets afterward.