release: source-dir standardization + npm two-zip release (dev -> main) #39

Merged

jmiller merged 10 commits from dev into main 2026-07-18 18:24:38 +00:00

Conversation 0 Commits 10 Files Changed 16

+344 -45

10 Commits

Author	SHA1	Message	Date
jmiller	9d5402ba12	Merge pull request 'ci: npm release archives from source + two zips (Refs #35)' (#38) from fix/npm-release-from-source into dev	2026-07-18 18:23:32 +00:00
jmiller	fd3d0d2055	Merge pull request 'standards: migrate src/ -> source/ and retire dist/ (Refs #34)' (#37) from fix/standardize-source-dir into dev	2026-07-18 18:22:30 +00:00
jmiller	eb939d9acb	Merge pull request 'ci: source-dir resolver from metadata entry_point (Refs #33)' (#36) from fix/ci-resolve-source-dir into dev	2026-07-18 18:22:01 +00:00
jmiller	3d1f81f613	ci: harden source-dir resolver (fail-closed, token input, visibility) [#33] ... Composite action (resolve-source-dir): - Add inputs.mokogit_token and inputs.strict; secrets are not accessible inside composite actions, so the token is passed in and used in the metadata curl instead of ${{ secrets.* }}. - Fail-closed metadata handling: capture curl exit status (no `|| true`). On curl failure, error+exit when strict=true, else warn and treat entry_point as absent. Parse JSON without swallowing errors (invalid JSON is a hard error). Keep the MOKOGIT_URL/GIT_ORG/GIT_REPO guard. - normalize(): a resolved "." / "./" (repo root) is treated as invalid and mapped to empty so it can never produce a bogus HEAD:. reference. - A genuine metadata-vs-Makefile conflict still ALWAYS errors, regardless of strict. npm-publish.yml: - Pass mokogit_token + strict:'true' to the resolve step. - Checkout fetch-depth: 2 for the before/HEAD~1 diff on shallow clones. - Detect short-circuits changed=true on workflow_dispatch (no diff base). - Fix the ERE metachar escaper so '.' is escaped correctly (class lists ] first and [ last to avoid a [. collating-symbol parse; the replacement reaches sed as a literal backslash + matched char). Verified the built pattern still matches 'source/' as a path prefix. - Guard Setup Node.js and Install dependencies on changed=='true'. - Emit a ::notice:: listing files when no publishable changes are found. npm-build-test.yml + npm-tool-inventory.yml: - Add job-level MOKOGIT_URL/GIT_ORG/GIT_REPO env (same vars.* || github.* defaults) so the resolver runs consistently. - Pass mokogit_token + strict:'false' (warn+default on unreachable metadata; a real conflict still errors). - Emit a ::warning:: before falling back to src/index.ts. - Inventory only: assert the entry file is readable before counting tools so an unreadable file is not silently counted as zero. Authored-by: Moko Consulting	2026-07-18 12:35:27 -05:00
jmiller	a9a8785e3b	ci: fail-closed release artifacts + npm-safe pre-release guard [#35] ... Address silent-failure findings from code review in the #35 release work. npm-auto-release.yml: - Resolve source directory: pass the now-required action inputs (mokogit_token from secrets.MOKOGIT_TOKEN, strict: 'true') so the release fails closed if the source dir cannot be resolved. - Package release artifacts: add `set -euo pipefail`; refuse to build a misleading source zip when source_dir resolves empty or to '.'; and assert both zips exist and are non-empty before publishing. - GitHub Release: add `set -euo pipefail` and remove the `2>/dev/null || true` suppression on `gh release upload --clobber` so a failed artifact upload fails the job instead of advertising a new version with stale/missing artifacts. Convert the release-notes fallback to an `if` form so it is safe under `set -e`. - Tool inventory: warn when the resolved entrypoint is missing before falling back to src/index.ts, and assert the entry file is readable before grep so an unreadable file is not silently counted as 0 tools. pre-release.yml: - Add an early npm/MCP detection step (package.json at repo root) that runs before any php call; npm repos clean-exit eligibility with proceed=false and a notice pointing to npm-auto-release.yml, and skip the php platform-detection step entirely (php may be absent on the npm fresh-clone path). - For non-npm repos, warn when platform detection returns empty so an eligible Joomla repo is not silently no-op'd. Joomla behavior is otherwise unchanged. Authored-by: Moko Consulting	2026-07-18 12:33:44 -05:00
jmiller	9071afcba5	ci: wire source-dir resolver into npm-tool-inventory [#33] ... Add the shared resolve-source-dir composite action to the tool inventory workflow and drive the source entry file from its output. Replace the hardcoded `src/index.ts` runtime greps with `${{ steps.srcdir.outputs.source_dir }}index.ts`, falling back to `src/index.ts` when the resolved file is absent. List both `source/index.ts` and `src/index.ts` in the push `paths:` filter transitionally, since static YAML cannot consume step outputs. Copyright + SPDX header preserved. Authored-by: Moko Consulting	2026-07-18 12:18:25 -05:00
jmiller	afa5887e4c	ci: attach full-repo and source zips to npm release [#35] ... Mirror the Joomla two-artifact model for npm/MCP releases: instead of a single tar.gz, attach two ZIPs to the GitHub Release. npm-auto-release.yml: - Replace the tar.gz "Package source" step with "Package release artifacts" (id: package) producing: * ${REPO_NAME}-${VERSION}.zip — full repo, tracked files only via `git archive --format=zip HEAD` (excludes .git/node_modules/dist). * ${REPO_NAME}-${VERSION}-source.zip — resolved source subtree via `git archive --format=zip "HEAD:${SRC%/}"` (tree-ish path, no trailing slash). Emits repo_zip / source_zip step outputs. - Move packaging to run AFTER "Create git tag" and immediately before "GitHub Release" so both zips reflect the final released tree (the old position ran before the version-badge release commit). Keeps its `if: steps.version.outputs.skip != 'true'` guard. - GitHub Release step now uploads BOTH zips: passed as trailing args to `gh release create` and via `gh release upload ... --clobber`. - Update the header comment to describe the full-repo + source zip artifacts instead of the compiled dist/. - Build / "Verify dist output" steps left as-is (dist still verified in CI). Authored-by: Moko Consulting	2026-07-18 12:16:11 -05:00
jmiller	8707d66108	refactor: migrate src/ to source/ and retire dist/ references [#34] ... Standardize the template on `source/` as the source input directory and retire user-facing `src/` references, per issue #34. Changes: - git mv src -> source (history preserved for all .ts files) - source/*.ts: update PATH headers /src/ -> /source/ - tsconfig.json: rootDir and include point at source/ - package.json: lint script targets source/ - Makefile: add SRC_DIR := source (CI resolver source of truth) - README.md, CLAUDE.md, docs/ARCHITECTURE.md: source path refs -> source/ The `dist/` directory is retained solely as tsc's compiled build output (outDir), which is already gitignored and never committed/published; releases go through the MokoGIT release system. No new dist/ references were introduced. Authored-by: Moko Consulting	2026-07-18 12:11:23 -05:00
jmiller	42c7863997	ci: archive release from source dir and ensure npm setup in release workflows [#35] ... npm-auto-release.yml: - Add a "Resolve source directory" step using the composite action ./.mokogit/actions/resolve-source-dir (id: srcdir), placed after checkout/setup and before the archive/inventory steps. - Archive from the resolved source dir instead of dist/: strip the trailing slash from steps.srcdir.outputs.source_dir and tar with -C "$SRC" . (step renamed "Package dist" -> "Package source"). - paths: filter now matches both 'source/**' and 'src/**' (transitional; static YAML cannot consume the action output). - Tool-inventory greps resolve the entrypoint from source_dir + "index.ts" with a fallback to src/index.ts when the resolved file is missing. - registry-url intentionally NOT added: this workflow publishes via GitHub Releases (gh release), not npm publish, so no npm auth/registry is used. pre-release.yml: - This is the PHP/Joomla pipeline with no Node/npm setup. It already gates all build steps on a "Joomla only" eligibility check, so npm repos skip the release logic. Added a job-level documenting note directing npm/MCP repos to npm-auto-release.yml, and guarded the php-cli/composer apt-get install on the absence of package.json so npm repos don't pull the PHP toolchain. Low-risk and reversible; platform detection still runs. Authored-by: Moko Consulting	2026-07-18 12:09:09 -05:00
jmiller	15bdf697e9	ci: resolve source dir from metadata entry_point with Makefile conflict guard [#33] ... Add a shared composite action `.mokogit/actions/resolve-source-dir` that resolves the repo source directory from the MokoGIT metadata API (`.entry_point`) and cross-checks the Makefile `SRC_DIR`, erroring on conflict. Values are normalized to a trailing slash and default to `source/` when empty or unreachable. Outputs `source_dir` (e.g. `source/`) and `source_glob` (e.g. `source/**`). Wire the resolver into two workflows: - npm-publish.yml: add the resolver step after Checkout and a Detect publishable changes step whose source-dir alternative is built from the resolved dir instead of a literal `src/`; guard Build/bump/Publish on the detect output. - npm-build-test.yml: add `source/**` alongside `src/**` in the push and pull_request `paths:` filters (static YAML, kept transitionally), and point the tool-count grep at `${source_dir}index.ts` with a fallback to `src/index.ts`. Copyright + SPDX headers preserved on all workflow files. Authored-by: Moko Consulting	2026-07-18 12:08:51 -05:00