ci: source-dir resolver from metadata entry_point (Refs #33) #36

Merged

jmiller merged 3 commits from fix/ci-resolve-source-dir into dev 2026-07-18 18:22:02 +00:00

Conversation 0 Commits 3 Files Changed 4

+205 -10

3 Commits

Author	SHA1	Message	Date
jmiller	3d1f81f613	ci: harden source-dir resolver (fail-closed, token input, visibility) [#33] ... Composite action (resolve-source-dir): - Add inputs.mokogit_token and inputs.strict; secrets are not accessible inside composite actions, so the token is passed in and used in the metadata curl instead of ${{ secrets.* }}. - Fail-closed metadata handling: capture curl exit status (no `|| true`). On curl failure, error+exit when strict=true, else warn and treat entry_point as absent. Parse JSON without swallowing errors (invalid JSON is a hard error). Keep the MOKOGIT_URL/GIT_ORG/GIT_REPO guard. - normalize(): a resolved "." / "./" (repo root) is treated as invalid and mapped to empty so it can never produce a bogus HEAD:. reference. - A genuine metadata-vs-Makefile conflict still ALWAYS errors, regardless of strict. npm-publish.yml: - Pass mokogit_token + strict:'true' to the resolve step. - Checkout fetch-depth: 2 for the before/HEAD~1 diff on shallow clones. - Detect short-circuits changed=true on workflow_dispatch (no diff base). - Fix the ERE metachar escaper so '.' is escaped correctly (class lists ] first and [ last to avoid a [. collating-symbol parse; the replacement reaches sed as a literal backslash + matched char). Verified the built pattern still matches 'source/' as a path prefix. - Guard Setup Node.js and Install dependencies on changed=='true'. - Emit a ::notice:: listing files when no publishable changes are found. npm-build-test.yml + npm-tool-inventory.yml: - Add job-level MOKOGIT_URL/GIT_ORG/GIT_REPO env (same vars.* || github.* defaults) so the resolver runs consistently. - Pass mokogit_token + strict:'false' (warn+default on unreachable metadata; a real conflict still errors). - Emit a ::warning:: before falling back to src/index.ts. - Inventory only: assert the entry file is readable before counting tools so an unreadable file is not silently counted as zero. Authored-by: Moko Consulting	2026-07-18 12:35:27 -05:00
jmiller	9071afcba5	ci: wire source-dir resolver into npm-tool-inventory [#33] ... Add the shared resolve-source-dir composite action to the tool inventory workflow and drive the source entry file from its output. Replace the hardcoded `src/index.ts` runtime greps with `${{ steps.srcdir.outputs.source_dir }}index.ts`, falling back to `src/index.ts` when the resolved file is absent. List both `source/index.ts` and `src/index.ts` in the push `paths:` filter transitionally, since static YAML cannot consume step outputs. Copyright + SPDX header preserved. Authored-by: Moko Consulting	2026-07-18 12:18:25 -05:00
jmiller	15bdf697e9	ci: resolve source dir from metadata entry_point with Makefile conflict guard [#33] ... Add a shared composite action `.mokogit/actions/resolve-source-dir` that resolves the repo source directory from the MokoGIT metadata API (`.entry_point`) and cross-checks the Makefile `SRC_DIR`, erroring on conflict. Values are normalized to a trailing slash and default to `source/` when empty or unreachable. Outputs `source_dir` (e.g. `source/`) and `source_glob` (e.g. `source/**`). Wire the resolver into two workflows: - npm-publish.yml: add the resolver step after Checkout and a Detect publishable changes step whose source-dir alternative is built from the resolved dir instead of a literal `src/`; guard Build/bump/Publish on the detect output. - npm-build-test.yml: add `source/**` alongside `src/**` in the push and pull_request `paths:` filters (static YAML, kept transitionally), and point the tool-count grep at `${source_dir}index.ts` with a fallback to `src/index.ts`. Copyright + SPDX headers preserved on all workflow files. Authored-by: Moko Consulting	2026-07-18 12:08:51 -05:00