Containerized jobs on this act_runner fail during setup: the runner
extracts its payload to /var/run/act, /var/run is a symlink to /run in
the Debian job image, and Docker's archive extractor refuses to write
through it ("path escapes from parent"). CI had never passed as a
result -- 19 runs, 19 failures, including the v0.5.0 release commit.
Every other repo on this runner already uses `runs-on: host`. ui-kit
builds no image and deploys nothing, so container isolation buys it
nothing.
Refs #6
Co-Authored-By: Claude Opus 5 <[email protected]>
Both are generated by scripts/build_demo_pdf.py — output/ holds the
rendered demo.pdf, tmp/ the intermediate page PNGs it rasterizes on the
way there (~2 MB of them).
Same category as the existing dist-* entries, so grouped with them.
scripts/build_demo_pdf.py itself is deliberately left untracked rather
than ignored — it is source, not output, and whether it belongs in the
repo is a separate call.
Co-Authored-By: Claude Opus 5 <[email protected]>
Publishing to the Gitea npm registry needs an _authToken, and the natural
place to put it is a .npmrc in the repo root — which was not ignored. The
committed .npmrc.example invites exactly that mistake.
The pattern matches the exact filename, so .npmrc.example is unaffected.
Nothing was leaked: no .npmrc has ever been committed here. This is
preventative.
Better still, publish with `npm publish --userconfig <path outside the
repo>` and keep the token out of the working tree entirely — that is how
v0.5.0 was published.
Co-Authored-By: Claude Opus 5 <[email protected]>
White on the danger fill lands ~3.3:1 against tuned dark-theme danger
tokens (e.g. delta's rust at 58% lightness) — below AA for 14px labels.
text-bg follows the primary variant's own pattern (bg-brand text-bg)
and holds ≥4.5:1 on both the kit default and delta's tokens.
Co-Authored-By: Claude Fable 5 <[email protected]>
Native <select> open menus are OS-drawn (grey/blue) and can't be themed.
Rebuilt Select on @radix-ui/react-select with a fully styled popover while
keeping the native drop-in API (value/onChange/<option> children). Empty-string
option values stay selectable via an internal sentinel.
GROKandClaude Opus 5