@1aboveio/skills 1.0.8 → 1.0.10

package/skills/cicd/github-flow/scripts/flow.test.mjs

@@ -1,114 +0,0 @@
-// Tests for the delivery declaration and the flow guess. The guess fixtures are
-// the facts read from four real repos on 2026-10-04, each with the flow its owner
-// says it uses.
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import { guessFlow, parseDelivery, renderDelivery, validateDelivery } from './flow-core.mjs'
-
-const CLI = fileURLToPath(new URL('./flow.mjs', import.meta.url))
-const direct = (n) => Array.from({ length: n }, (_, i) => `docs: note ${i}`)
-const merged = (n) => Array.from({ length: n }, (_, i) => `Merge pull request #${100 + i} from 1aboveio/topic-${i}`)
-const squashed = (n) => Array.from({ length: n }, (_, i) => `fix: thing ${i} (#${200 + i})`)
-
-test('proxy-cache: a PR rule everyone bypasses, direct history -> direct', () => {
-  const guess = guessFlow({ mergifyConfig: false, ruleTypes: ['pull_request'], autoMerge: false, allowedMethods: ['squash', 'merge', 'rebase'], subjects: direct(20) })
-  assert.equal(guess.flow, 'direct')
-  assert.equal(guess.done, 'committed')
-  assert.ok(guess.evidence.some((e) => /bypass/.test(e)))
-})
-
-test('github-runner: recent PR merges after older direct pushes -> pull-request with merge commits', () => {
-  const subjects = [...merged(5), ...direct(13), ...merged(2)]
-  const guess = guessFlow({ mergifyConfig: false, ruleTypes: ['pull_request'], autoMerge: false, allowedMethods: ['squash', 'merge', 'rebase'], subjects })
-  assert.equal(guess.flow, 'pull-request')
-  assert.equal(guess.mergeMethod, 'merge')
-})
-
-test('pi-better-harness: required checks and auto-merge -> pull-request, squash, auto-merge', () => {
-  const guess = guessFlow({ mergifyConfig: false, ruleTypes: ['pull_request', 'deletion', 'non_fast_forward', 'required_status_checks'], autoMerge: true, allowedMethods: ['squash', 'merge', 'rebase'], subjects: squashed(20) })
-  assert.deepEqual([guess.flow, guess.mergeMethod, guess.autoMerge, guess.queue], ['pull-request', 'squash', true, null])
-})
-
-test('ai: a Mergify config -> merge-queue through mergify', () => {
-  const guess = guessFlow({ mergifyConfig: true, ruleTypes: ['pull_request', 'required_status_checks', 'update'], autoMerge: true, allowedMethods: ['squash', 'merge'], subjects: merged(20) })
-  assert.deepEqual([guess.flow, guess.queue], ['merge-queue', 'mergify'])
-})
-
-test('a GitHub merge_queue rule -> merge-queue through github', () => {
-  const guess = guessFlow({ mergifyConfig: false, ruleTypes: ['merge_queue', 'pull_request'], autoMerge: true, allowedMethods: ['squash'], subjects: squashed(3) })
-  assert.deepEqual([guess.flow, guess.queue], ['merge-queue', 'github'])
-})
-
-test('unreadable GitHub settings still guess from history and say so', () => {
-  const guess = guessFlow({ mergifyConfig: false, ruleTypes: null, autoMerge: null, allowedMethods: null, subjects: direct(4) })
-  assert.equal(guess.flow, 'direct')
-  assert.ok(guess.evidence.includes('GitHub branch rules unreadable'))
-})
-
-test('the history merge method is used only when the repo allows it', () => {
-  const guess = guessFlow({ mergifyConfig: false, ruleTypes: ['required_status_checks'], autoMerge: false, allowedMethods: ['rebase'], subjects: merged(5) })
-  assert.equal(guess.mergeMethod, 'rebase')
-})
-
-test('every rendered declaration parses back to the same values', () => {
-  for (const flow of ['direct', 'pull-request', 'merge-queue']) {
-    for (const done of ['merged', 'committed']) {
-      for (const mergeMethod of ['squash', 'merge', 'rebase']) {
-        const text = `# Contributing\n\n${renderDelivery({ flow, done, mergeMethod })}\n## Next\n- flow: direct\n`
-        const parsed = parseDelivery(text)
-        assert.deepEqual(parsed, { flow, done, mergeMethod: flow === 'pull-request' ? mergeMethod : 'squash' })
-      }
-    }
-  }
-})
-
-test('the rendered section tells the agent not to stop at the commit only when done is merged', () => {
-  assert.match(renderDelivery({ flow: 'direct', done: 'merged' }), /Do not stop at the commit/)
-  assert.match(renderDelivery({ flow: 'direct', done: 'committed' }), /ask before pushing/)
-  assert.doesNotMatch(renderDelivery({ flow: 'direct', done: 'committed' }), /Do not stop/)
-})
-
-test('a hand-written section is read; a missing or unknown flow is not a declaration', () => {
-  assert.deepEqual(parseDelivery('## Delivery\n\nflow: merge-queue\ndone: merged\n'), { flow: 'merge-queue', done: 'merged', mergeMethod: 'squash' })
-  assert.equal(parseDelivery('## Delivery\n\n- done: merged\n'), null)
-  assert.equal(parseDelivery('## Delivery\n\n- flow: trunk\n'), null)
-  assert.equal(parseDelivery('## Other\n\n- flow: direct\n'), null)
-  assert.equal(parseDelivery(null), null)
-  assert.equal(parseDelivery('## Delivery\n\n- flow: direct\n').done, 'committed')
-})
-
-test('validateDelivery rejects unknown values', () => {
-  assert.deepEqual(validateDelivery({ flow: 'direct' }), [])
-  assert.equal(validateDelivery({ flow: 'gitflow', done: 'shipped', mergeMethod: 'ff' }).length, 3)
-})
-
-test('the CLI prints the declared flow without calling GitHub', () => {
-  const dir = mkdtempSync(join(tmpdir(), 'github-flow-'))
-  try {
-    spawnSync('git', ['init', '-q', dir])
-    writeFileSync(join(dir, 'CONTRIBUTING.md'), `# Contributing\n\n${renderDelivery({ flow: 'pull-request', mergeMethod: 'merge' })}`)
-    writeFileSync(join(dir, '.mergify.yml'), 'queue_rules: []\n')
-    const res = spawnSync(process.execPath, [CLI, '--repo-root', dir], { encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } })
-    assert.equal(res.status, 0, res.stderr)
-    const out = JSON.parse(res.stdout)
-    assert.deepEqual([out.source, out.flow, out.done, out.mergeMethod, out.queue], ['declared', 'pull-request', 'merged', 'merge', null])
-  } finally {
-    rmSync(dir, { recursive: true, force: true })
-  }
-})
-
-test('the CLI fails with exit 2 outside a git repo and on an unknown argument', () => {
-  const dir = mkdtempSync(join(tmpdir(), 'github-flow-'))
-  try {
-    assert.equal(spawnSync(process.execPath, [CLI, '--repo-root', dir], { encoding: 'utf8', env: { ...process.env, GIT_CEILING_DIRECTORIES: tmpdir() } }).status, 2)
-    assert.equal(spawnSync(process.execPath, [CLI, '--wat'], { encoding: 'utf8' }).status, 2)
-  } finally {
-    rmSync(dir, { recursive: true, force: true })
-  }
-})

package/skills/cicd/github-flow/scripts/persist-conventions.test.mjs

@@ -1,108 +0,0 @@
-// Tests for github-flow's persist-conventions: the real CLI against real files in a temp repo.
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { existsSync, lstatSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import { parseDelivery } from './flow-core.mjs'
-
-const CLI = fileURLToPath(new URL('./persist-conventions.mjs', import.meta.url))
-
-function withRepo(fn) {
-  const dir = mkdtempSync(join(tmpdir(), 'github-flow-persist-'))
-  try {
-    return fn(dir, (name) => readFileSync(join(dir, name), 'utf8'))
-  } finally {
-    rmSync(dir, { recursive: true, force: true })
-  }
-}
-
-const run = (dir, ...args) => spawnSync(process.execPath, [CLI, '--repo-root', dir, ...args], { encoding: 'utf8' })
-
-test('without --write it previews and writes nothing', () => {
-  withRepo((dir) => {
-    const res = run(dir, '--flow', 'direct')
-    assert.equal(res.status, 0)
-    assert.match(res.stdout, /CI conventions: preview only/)
-    assert.match(res.stdout, /Delivery: preview only/)
-    assert.equal(existsSync(join(dir, 'CONTRIBUTING.md')), false)
-  })
-})
-
-test('--write with --flow writes both sections, and the declaration reads back', () => {
-  withRepo((dir, read) => {
-    assert.equal(run(dir, '--flow', 'pull-request', '--merge-method', 'merge', '--write').status, 0)
-    const text = read('CONTRIBUTING.md')
-    assert.deepEqual(text.match(/^## .+$/gm), ['## CI conventions', '## Delivery'])
-    assert.deepEqual(parseDelivery(text), { flow: 'pull-request', done: 'merged', mergeMethod: 'merge' })
-    assert.match(read('AGENTS.md'), /\(CONTRIBUTING\.md\)/)
-  })
-})
-
-test('a re-run with a new flow replaces only the Delivery block', () => {
-  withRepo((dir, read) => {
-    run(dir, '--flow', 'direct', '--write')
-    const ci = read('CONTRIBUTING.md').split('## Delivery')[0]
-    assert.equal(run(dir, '--flow', 'merge-queue', '--done', 'committed', '--write').status, 0)
-    const text = read('CONTRIBUTING.md')
-    assert.equal(text.split('## Delivery')[0], ci)
-    assert.equal(text.match(/^## Delivery$/gm).length, 1)
-    assert.deepEqual(parseDelivery(text), { flow: 'merge-queue', done: 'committed', mergeMethod: 'squash' })
-  })
-})
-
-test('without --flow it writes CI conventions only and says Delivery was skipped', () => {
-  withRepo((dir, read) => {
-    const res = run(dir, '--write')
-    assert.equal(res.status, 0)
-    assert.match(res.stdout, /Delivery: skipped/)
-    assert.deepEqual(read('CONTRIBUTING.md').match(/^## .+$/gm), ['## CI conventions'])
-  })
-})
-
-test('an invalid delivery value fails with exit 2 and writes nothing', () => {
-  withRepo((dir) => {
-    for (const args of [['--flow', 'gitflow'], ['--done', 'merged'], ['--flow', 'direct', '--merge-method', 'ff']]) {
-      assert.equal(run(dir, ...args, '--write').status, 2, args.join(' '))
-    }
-    assert.equal(existsSync(join(dir, 'CONTRIBUTING.md')), false)
-  })
-})
-
-test('--delivery-only writes the Delivery section without CI conventions', () => {
-  withRepo((dir, read) => {
-    assert.equal(run(dir, '--flow', 'direct', '--delivery-only', '--write').status, 0)
-    assert.deepEqual(read('CONTRIBUTING.md').match(/^## .+$/gm), ['## Delivery'])
-    assert.equal(run(dir, '--delivery-only', '--write').status, 2)
-  })
-})
-
-test('CLAUDE.md reaches the conventions: created as a symlink to AGENTS.md, appended when silent, kept otherwise', () => {
-  withRepo((dir, read) => {
-    assert.match(run(dir, '--flow', 'direct').stdout, /CLAUDE\.md: would link/)
-    assert.equal(existsSync(join(dir, 'CLAUDE.md')), false)
-    assert.match(run(dir, '--flow', 'direct', '--write').stdout, /CLAUDE\.md: linked to AGENTS\.md/)
-    assert.ok(lstatSync(join(dir, 'CLAUDE.md')).isSymbolicLink())
-    assert.equal(read('CLAUDE.md'), read('AGENTS.md'))
-  })
-  withRepo((dir, read) => {
-    writeFileSync(join(dir, 'CLAUDE.md'), '# Claude\n\nUse pnpm.\n')
-    run(dir, '--flow', 'direct', '--write')
-    assert.ok(read('CLAUDE.md').startsWith('# Claude\n\nUse pnpm.\n\n## Contributing'))
-    assert.match(read('CLAUDE.md'), /\[CONTRIBUTING\.md\]\(CONTRIBUTING\.md\)/)
-  })
-  withRepo((dir, read) => {
-    writeFileSync(join(dir, 'CLAUDE.md'), 'See AGENTS.md.\n')
-    assert.match(run(dir, '--flow', 'direct', '--write').stdout, /CLAUDE\.md: unchanged/)
-    assert.equal(read('CLAUDE.md'), 'See AGENTS.md.\n')
-  })
-  withRepo((dir) => {
-    writeFileSync(join(dir, 'AGENTS.md'), '# Agents\n')
-    symlinkSync('AGENTS.md', join(dir, 'CLAUDE.md'))
-    assert.match(run(dir, '--flow', 'direct', '--write').stdout, /CLAUDE\.md: unchanged/)
-    assert.ok(lstatSync(join(dir, 'CLAUDE.md')).isSymbolicLink())
-  })
-})

package/skills/cicd/mergify/scripts/audit.test.mjs

@@ -1,201 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { spawnSync } from 'node:child_process'
-
-// @characterizes mergify-audit-cli
-// @covers mergify-audit-core
-// @level integration
-import { auditText, blockUnder, pullRequestBranches } from './audit-core.mjs'
-
-const SCRIPT = fileURLToPath(new URL('./audit.mjs', import.meta.url))
-const TEMPLATE = fileURLToPath(new URL('../assets/templates/mergify.yml', import.meta.url))
-const status = (f, check) => f.find((x) => x.check === check)?.status
-const run = (args) => spawnSync('node', [SCRIPT, ...args], { encoding: 'utf8' })
-const tmp = (body) => { const p = `${fs.mkdtempSync('/tmp/mgaudit-')}/m.yml`; fs.writeFileSync(p, body); return p }
-
-// ---- blockUnder: the one bit of structure-awareness ----
-test('blockUnder returns the indented body of a key, and null when absent', () => {
-  const y = 'a:\n  x: 1\n  y: 2\nb:\n  z: 3\n'
-  assert.match(blockUnder(y, 'a'), /x: 1/)
-  assert.doesNotMatch(blockUnder(y, 'a'), /z: 3/) // stops at the dedent to `b`
-  assert.equal(blockUnder(y, 'nope'), null)
-})
-
-// ---- the shipped template audits clean (dogfood: the default passes its own audit) ----
-test('the skill template passes its own audit with no warn/fail', () => {
-  const f = auditText(fs.readFileSync(TEMPLATE, 'utf8'))
-  const bad = f.filter((x) => x.status === 'warn' || x.status === 'fail')
-  assert.deepEqual(bad, [], `template should be clean, got: ${JSON.stringify(bad)}`)
-  assert.equal(status(f, 'enqueue-policy'), 'pass')
-})
-
-// ---- decidable failures ----
-test('deprecated auto_merge: true is a FAIL', () => {
-  assert.equal(status(auditText('merge_protections_settings:\n  auto_merge: true\n'), 'deprecated-forms'), 'fail')
-})
-test('deprecated autoqueue is a FAIL', () => {
-  assert.equal(status(auditText('queue_rules:\n  - name: d\n    autoqueue: true\n'), 'deprecated-forms'), 'fail')
-})
-test('a comment that merely NAMES a deprecated form does not trip the check', () => {
-  assert.equal(status(auditText('# do not use auto_merge: true here\nqueue_rules: {}\n'), 'deprecated-forms'), 'pass')
-})
-
-// ---- enqueue policy ----
-test('auto_merge_conditions without a review arm WARNs (the retired indiscriminate form)', () => {
-  assert.equal(status(auditText('merge_protections_settings:\n  auto_merge_conditions:\n    - "-draft"\n'), 'enqueue-policy'), 'warn')
-})
-test('auto_merge_conditions with approval but no changes-requested arm WARNs', () => {
-  const y = 'merge_protections_settings:\n  auto_merge_conditions:\n    - "#approved-reviews-by >= 1"\n'
-  assert.equal(status(auditText(y), 'enqueue-policy'), 'warn')
-})
-test('hybrid (approval + no open change request) PASSes', () => {
-  const y = 'merge_protections_settings:\n  auto_merge_conditions:\n    - "#approved-reviews-by >= 1"\n    - "#changes-requested-reviews-by = 0"\n'
-  assert.equal(status(auditText(y), 'enqueue-policy'), 'pass')
-})
-test('no auto_merge_conditions is a NOTE (manual enqueue, ok if deliberate) — not a warn', () => {
-  assert.equal(status(auditText('merge_protections_settings:\n  post_comment: true\n'), 'enqueue-policy'), 'note')
-})
-
-// ---- injection mode ----
-test('missing branch_protection_injection_mode: merge WARNs when a queue exists', () => {
-  assert.equal(status(auditText('queue_rules:\n  - name: d\n'), 'injection-mode'), 'warn')
-})
-test('no queue_rules → injection check ABSTAINs, never a false pass', () => {
-  assert.equal(status(auditText('merge_protections_settings: {}\n'), 'injection-mode'), 'abstain')
-})
-
-// ---- draft placement (epic-986) ----
-test('-draft inside queue_conditions WARNs; in auto_merge_conditions it does NOT', () => {
-  const bad = 'queue_rules:\n  - name: d\n    queue_conditions:\n      - -draft\n'
-  assert.equal(status(auditText(bad), 'draft-placement'), 'warn')
-  const ok = 'merge_protections_settings:\n  auto_merge_conditions:\n    - "-draft"\n    - "#approved-reviews-by >= 1"\n'
-  assert.equal(status(auditText(ok), 'draft-placement'), 'pass')
-})
-
-// ---- gate anchor ----
-test('a gate anchor asserted <2× WARNs; ≥2× PASSes', () => {
-  assert.equal(status(auditText('x: &gate {}\ny: *gate\n'), 'gate-anchor'), 'warn')
-  assert.equal(status(auditText('x: &gate {}\ny: *gate\nz: *gate\n'), 'gate-anchor'), 'pass')
-})
-
-// ---- batch mode (SKILL.md Rule 3) ----
-test('no batch_size WARNs — unset runs at Mergify\'s built-in 1, so batches never form', () => {
-  assert.equal(status(auditText('queue_rules:\n  - name: d\n    queue_conditions:\n      - base = main\n'), 'batch-mode'), 'warn')
-})
-test('explicit batch_size: 1 WARNs (batching off)', () => {
-  assert.equal(status(auditText('queue_rules:\n  - name: d\n    batch_size: 1\n'), 'batch-mode'), 'warn')
-})
-test('batch_size: 3 PASSes (batching on)', () => {
-  assert.equal(status(auditText('queue_rules:\n  - name: d\n    batch_size: 3\n'), 'batch-mode'), 'pass')
-})
-test('dynamic batch_size {min, max} PASSes (batching on)', () => {
-  assert.equal(status(auditText('queue_rules:\n  - name: d\n    batch_size:\n      min: 1\n      max: 10\n'), 'batch-mode'), 'pass')
-})
-test('no queue_rules → batch check ABSTAINs, never a false pass', () => {
-  assert.equal(status(auditText('merge_protections_settings: {}\n'), 'batch-mode'), 'abstain')
-})
-
-test('a queue rule with no checks_timeout WARNs: unset means auto, which dequeues green PRs', () => {
-  const f = auditText('queue_rules:\n  - name: main\n    batch_size: 3\n')
-  assert.equal(status(f, 'checks-timeout'), 'warn')
-  assert.match(f.find((x) => x.check === 'checks-timeout').detail, /main \(unset = auto\)/)
-})
-test('an explicit checks_timeout duration WARNs and names the rule', () => {
-  const f = auditText('queue_rules:\n  - name: docs\n    checks_timeout: null\n  - name: main\n    checks_timeout: 35 minutes\n')
-  assert.equal(status(f, 'checks-timeout'), 'warn')
-  const detail = f.find((x) => x.check === 'checks-timeout').detail
-  assert.match(detail, /main \(35 minutes\)/)
-  assert.doesNotMatch(detail, /docs/)
-})
-test('checks_timeout: null on every rule PASSes', () => {
-  const f = auditText('queue_rules:\n  - name: docs\n    checks_timeout: null\n  - name: main\n    batch_size: 3\n    checks_timeout: null\n')
-  assert.equal(status(f, 'checks-timeout'), 'pass')
-})
-test('checks_timeout: null in defaults.queue_rule covers rules that do not override it', () => {
-  const base = 'defaults:\n  queue_rule:\n    checks_timeout: null\nqueue_rules:\n  - name: main\n    batch_size: 3\n'
-  assert.equal(status(auditText(base), 'checks-timeout'), 'pass')
-  assert.equal(status(auditText(base + '  - name: slow\n    checks_timeout: 1 hour\n'), 'checks-timeout'), 'warn')
-})
-test('a comment that mentions checks_timeout: null does not count as setting it', () => {
-  const f = auditText('queue_rules:\n  - name: main\n    # checks_timeout: null\n    batch_size: 3\n')
-  assert.equal(status(f, 'checks-timeout'), 'warn')
-})
-test('no queue_rules → checks-timeout ABSTAINs, never a false pass', () => {
-  assert.equal(status(auditText('merge_protections_settings: {}\n'), 'checks-timeout'), 'abstain')
-})
-
-test('absent batch_size WARN points at batch_size: 3 (the skill default)', () => {
-  const f = auditText('queue_rules:\n  - name: d\n')
-  const d = f.find((x) => x.check === 'batch-mode').detail
-  assert.match(d, /batch_size: 3/)
-})
-
-// ---- CLI exit codes ----
-// ---- stack-ready: commits kept, CI on stacked PRs (configuration.md, "Stack-ready") ----
-test('a queue rule that squashes is a NOTE and names the rule; merge and merge-batch PASS', () => {
-  // kyc 2026-10-16: the default queue squashed, so a PR built on another conflicted after its parent landed.
-  // stack-sandbox 2026-10-20: a squash queue landed a GitHub-native stack, partial landing included, so it only matters off native stacks.
-  const cfg = (m) => `queue_rules:\n  - name: release\n    merge_method: merge\n  - name: default\n    merge_method: ${m}\n`
-  const squash = auditText(cfg('squash')).find((x) => x.check === 'merge-method')
-  assert.equal(squash.status, 'note')
-  assert.match(squash.detail, /default \(squash\) — fine for GitHub-native stacks; a Depends-On stack/)
-  assert.doesNotMatch(squash.detail, /release/)
-  assert.equal(status(auditText(cfg('merge-batch')), 'merge-method'), 'pass')
-  assert.equal(status(auditText(cfg("'squash'")), 'merge-method'), 'note', 'a quoted squash is still a squash')
-  assert.equal(status(auditText(cfg('somethingnew')), 'merge-method'), 'abstain', 'an unrecognized method is checked by hand, never passed')
-  assert.equal(status(auditText('a: 1\n'), 'merge-method'), 'abstain')
-})
-
-test('pullRequestBranches reads the base filter in every trigger shape, and null means any base', () => {
-  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches: [main]\n    paths-ignore:\n      - docs/**\n'), ['main'], 'fmm-express test.yml')
-  assert.equal(pullRequestBranches('on:\n  pull_request:\n    branches: ["**"]\n  schedule:\n    - cron: "0 6 * * 1"\n'), null, 'a1 security-scan.yml')
-  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches:\n      - main\n      - release/*\n'), ['main', 'release/*'])
-  assert.deepEqual(pullRequestBranches('on: { pull_request: { branches: [main] }, workflow_dispatch: }\n'), ['main'])
-  assert.equal(pullRequestBranches('on: { pull_request: , workflow_dispatch: }\n'), null)
-  assert.equal(pullRequestBranches('on:\n  pull_request:\n  workflow_dispatch:\n'), null)
-  assert.equal(pullRequestBranches('on:\n  push:\n    branches: [main]\n'), null, 'no pull_request trigger is not this check\'s business')
-  assert.equal(pullRequestBranches('on:\n  pull_request_target:\n    branches: [main]\n'), null)
-  assert.equal(pullRequestBranches('on:\n  pull_request:\n    # branches: [main]\n'), null, 'a commented-out filter is no filter')
-  // Round-5 audit: branches-ignore skips some base too, so a stack on that base gets no CI.
-  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches-ignore: [rush/**]\n'), ['!rush/**'])
-  assert.deepEqual(pullRequestBranches('on:\n  pull_request:\n    branches-ignore:\n      - \'stack/**\'\n'), ['!stack/**'])
-})
-
-test('stacked-pr-ci is a NOTE on base-filtered workflows, PASSes without filters, and ABSTAINs with none read', () => {
-  // fmm-express and identity 2026-10-16: required CI ran on PRs into main only, so Depends-On stacked PRs got none.
-  // stack-sandbox 2026-10-20: a [main]-filtered workflow ran on every PR of a GitHub-native stack.
-  const w = (name, text) => ({ name, text })
-  const filtered = auditText('a: 1\n', { workflows: [w('test.yml', 'on:\n  pull_request:\n    branches: [main]\n'), w('deploy.yml', 'on:\n  push:\n    branches: [main]\n')] }).find((x) => x.check === 'stacked-pr-ci')
-  assert.equal(filtered.status, 'note')
-  assert.match(filtered.detail, /test\.yml \[main\] — fine for GitHub-native stacks/)
-  assert.doesNotMatch(filtered.detail, /deploy\.yml/)
-  assert.equal(status(auditText('a: 1\n', { workflows: [w('ci.yml', 'on:\n  pull_request:\n')] }), 'stacked-pr-ci'), 'pass')
-  assert.equal(status(auditText('a: 1\n', { workflows: [] }), 'stacked-pr-ci'), 'abstain')
-  assert.equal(status(auditText('a: 1\n'), 'stacked-pr-ci'), 'abstain')
-})
-
-test('CLI reads .github/workflows beside the config, or --workflows', () => {
-  const dir = fs.mkdtempSync('/tmp/mgaudit-')
-  fs.mkdirSync(`${dir}/.github/workflows`, { recursive: true })
-  fs.writeFileSync(`${dir}/.github/workflows/test.yml`, 'on:\n  pull_request:\n    branches: [main]\n')
-  fs.copyFileSync(TEMPLATE, `${dir}/.mergify.yml`)
-  const beside = run(['--file', `${dir}/.mergify.yml`, '--json'])
-  assert.equal(beside.status, 0, 'a base filter is a note: GitHub-native stacks still get CI')
-  assert.equal(JSON.parse(beside.stdout).findings.find((x) => x.check === 'stacked-pr-ci').status, 'note')
-  fs.mkdirSync(`${dir}/clean`)
-  fs.writeFileSync(`${dir}/clean/ci.yml`, 'on:\n  pull_request:\n')
-  const clean = run(['--file', `${dir}/.mergify.yml`, '--workflows', `${dir}/clean`, '--json'])
-  assert.equal(clean.status, 0)
-  assert.equal(JSON.parse(clean.stdout).findings.find((x) => x.check === 'stacked-pr-ci').status, 'pass')
-})
-
-test('CLI exits 2 on FAIL, 1 on WARN, 0 with --allow-warn, 0 on PASS', () => {
-  assert.equal(run(['--file', tmp('merge_protections_settings:\n  auto_merge: true\n')]).status, 2)
-  const warnCfg = tmp('queue_rules:\n  - name: d\n')
-  assert.equal(run(['--file', warnCfg]).status, 1)
-  assert.equal(run(['--file', warnCfg, '--allow-warn']).status, 0)
-  assert.equal(run(['--file', TEMPLATE]).status, 0)
-  assert.equal(run(['--file', '/nonexistent.yml']).status, 2)
-})

package/skills/cicd/mergify/scripts/entrypoints.test.mjs

@@ -1,106 +0,0 @@
-// @covers mergify-core-wrapper-topology
-// @level integration
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-const SCRIPTS = dirname(fileURLToPath(import.meta.url))
-const SKILL = dirname(SCRIPTS)
-const TEMPLATE = join(SKILL, 'assets', 'templates', 'mergify.yml')
-const AUDIT_CORE = join(SCRIPTS, 'audit-core.mjs')
-const AUDIT_WRAPPER = join(SCRIPTS, 'audit.mjs')
-const WATCH_CORE = join(SCRIPTS, 'watch-pr-delivery-core.mjs')
-const WATCH_WRAPPER = join(SCRIPTS, 'watch-pr-delivery.mjs')
-const STACK_CORE = join(SCRIPTS, 'stack-push-core.mjs')
-const STACK_WRAPPER = join(SCRIPTS, 'stack-push.mjs')
-const PRODUCTION_MODULES = [AUDIT_CORE, AUDIT_WRAPPER, WATCH_CORE, WATCH_WRAPPER, STACK_CORE, STACK_WRAPPER]
-
-const runNode = (args) => spawnSync(process.execPath, args, { encoding: 'utf8' })
-
-function importWrapper(wrapper, argv) {
-  const source = [
-    `process.argv = ['node', ${JSON.stringify(wrapper)}, ...${JSON.stringify(argv)}]`,
-    `const namespace = await import(${JSON.stringify(pathToFileURL(wrapper).href)})`,
-    "process.stderr.write(`WRAPPER_EXPORTS:${JSON.stringify(Object.keys(namespace))}`)",
-  ].join('\n')
-  return runNode(['--input-type=module', '--eval', source])
-}
-
-function assertSameRun(actual, expected, label) {
-  assert.equal(actual.status, expected.status, `${label}: exit status changed`)
-  assert.equal(actual.stdout, expected.stdout, `${label}: stdout changed`)
-  assert.equal(actual.stderr, expected.stderr, `${label}: stderr changed`)
-}
-
-test('importing either core is quiet and never launches a CLI', () => {
-  for (const core of [AUDIT_CORE, WATCH_CORE, STACK_CORE]) {
-    const result = runNode(['--input-type=module', '--eval', `await import(${JSON.stringify(pathToFileURL(core).href)})`])
-    assert.equal(result.status, 0, `${core}: ${result.stderr}`)
-    assert.equal(result.stdout, '', `${core} wrote CLI output during import`)
-    assert.equal(result.stderr, '', `${core} wrote CLI diagnostics during import`)
-  }
-})
-
-test('wrappers export nothing and invoke their core even when loaded through import()', () => {
-  const audit = importWrapper(AUDIT_WRAPPER, ['--file', TEMPLATE, '--json'])
-  assert.equal(audit.status, 0, audit.stderr)
-  assert.match(audit.stdout, /"verdict": "PASS"/)
-  assert.equal(audit.stderr, 'WRAPPER_EXPORTS:[]')
-
-  const watch = importWrapper(WATCH_WRAPPER, ['--help'])
-  assert.equal(watch.status, 0, watch.stderr)
-  assert.match(watch.stdout, /watch-pr-delivery --repo/)
-  assert.equal(watch.stderr, 'WRAPPER_EXPORTS:[]')
-
-  const stack = importWrapper(STACK_WRAPPER, ['--help'])
-  assert.equal(stack.status, 0, stack.stderr)
-  assert.match(stack.stdout, /stack-push --trunk/)
-  assert.equal(stack.stderr, 'WRAPPER_EXPORTS:[]')
-})
-
-test('direct, canonical-copy, and Claude-symlink wrapper launches preserve both CLI contracts', () => {
-  const home = mkdtempSync(join(tmpdir(), 'mergify-install-topology-'))
-  try {
-    const canonical = join(home, '.agents', 'skills', 'mergify')
-    const claude = join(home, '.claude', 'skills', 'mergify')
-    mkdirSync(dirname(canonical), { recursive: true })
-    mkdirSync(dirname(claude), { recursive: true })
-    cpSync(SKILL, canonical, { recursive: true })
-    symlinkSync(canonical, claude, 'dir')
-
-    const directAudit = runNode([AUDIT_WRAPPER, '--file', TEMPLATE, '--json'])
-    const directWatch = runNode([WATCH_WRAPPER, '--help'])
-    assert.equal(directAudit.status, 0, directAudit.stderr)
-    assert.equal(directWatch.status, 0, directWatch.stderr)
-
-    for (const [label, installedSkill] of [['canonical', canonical], ['claude-symlink', claude]]) {
-      assertSameRun(
-        runNode([join(installedSkill, 'scripts', 'audit.mjs'), '--file', TEMPLATE, '--json']),
-        directAudit,
-        `${label} audit`,
-      )
-      assertSameRun(
-        runNode([join(installedSkill, 'scripts', 'watch-pr-delivery.mjs'), '--help']),
-        directWatch,
-        `${label} watcher`,
-      )
-    }
-  } finally {
-    rmSync(home, { recursive: true, force: true })
-  }
-})
-
-test('Mergify production modules have no Engineering Workflow import or runtime dependency', () => {
-  for (const file of PRODUCTION_MODULES) {
-    const source = readFileSync(file, 'utf8')
-    assert.doesNotMatch(
-      source,
-      /engineering-runtime|engineering\/_lib|_lib\/main-module|isMainModule/,
-      `${file} reaches into Engineering Workflow`,
-    )
-  }
-})

package/skills/cicd/mergify/scripts/pr-620-mergify-comments.fixture.json

@@ -1,30 +0,0 @@
-[
-  {
-    "author": {
-      "login": "mergify"
-    },
-    "createdAt": "2026-07-28T10:31:42Z",
-    "body": "# Merge Protections\n\n🔴 **1 of 2 protections blocking** · waiting on 👀 reviews\n\n| | Protection | Waiting on |\n|:--:|:--|:--:|\n| 🔴 | **🚦 Auto-queue** | 👀 reviews |\n| 🟢 | skill-script-tests (or exempt) before merge | — |\n\n## 🔴 🚦 Auto-queue\n\n**Waiting for**\n\n- [ ] `#approved-reviews-by >= 1`\n\n<details><summary>This rule is failing.</summary>\n\nWhen all merge protections are satisfied and these conditions match, this pull request will be queued automatically.\n- [ ] `#approved-reviews-by >= 1`\n- [X] `#changes-requested-reviews-by = 0`\n- [X] `-draft`\n- [X] any of:\n  - [X] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>\n\n---\n\n<details><summary>Show 1 satisfied protection</summary>\n\n## 🟢 skill-script-tests (or exempt) before merge\n\nThe one CI gate, asserted as a required merge protection. Green when skill-script-tests succeeded, or when the PR touches no gated path (so the job was never created) — never absent, so the ruleset can require it without stranding a docs-only PR.\n- [X] any of:\n  - [X] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>"
-  },
-  {
-    "author": {
-      "login": "mergify"
-    },
-    "createdAt": "2026-07-28T11:02:07Z",
-    "body": "<!---\nDO NOT EDIT\n-*- Mergify Payload -*-\n{\"version\": 1, \"state\": \"dequeued\", \"queue_rule_name\": \"default\", \"queued_at\": \"2026-07-28T11:02:06.211243+00:00\", \"estimated_time_of_merge\": null, \"speculative_check_pr\": null, \"required_conditions\": []}\n-*- Mergify Payload End -*-\n-->\n\n# Merge Queue Status\n\n- ✅ **Entered queue** — `2026-07-28 11:02 UTC` · Rule: `default` · triggered by @exoulster with the [`@mergifyio queue` command](https://github.com/1aboveio/ai/pull/620#issuecomment-5103273321)\n- ❌ **Checks failed** · on draft #624\n- 🚫 **Left the queue** — `2026-07-28 11:04 UTC` · at `e6a855b3c80d22c47661b3a47cadba7ad58a862e`\n\nThis pull request spent **2 minutes 33 seconds** in the queue, including **1 minute 14 seconds** running CI.\n\n<details>\n<summary><strong>Waiting for</strong></summary>\n\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests`\n  - [ ] `-files ~= ^skills/`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests`\n  - [ ] `-files ~= ^skills/`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests-queue`\n  - [ ] `-files ~= ^skills/`\n\n</details>\n<details>\n<summary>All conditions</summary>\n\n- [ ] all of [🛡 Merge Protections rule `skill-script-tests (or exempt) before merge`]:\n  - [ ] any of:\n    - [ ] `check-success = skill-script-tests`\n    - [ ] all of:\n      - [ ] `-files ~= ^skills/`\n      - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [ ] any of:\n  - [ ] `check-success = skill-script-tests-queue`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>\n\n## Reason\n\nThe merge conditions cannot be satisfied due to failing checks\n\n- `skill-script-tests-queue`\n\nFailing checks:\n- 🟠 [skill-script-tests](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382376) ([job log](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382376))\n- ❌ [skill-script-tests-queue](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382413) ([job log](https://github.com/1aboveio/ai/actions/runs/30353228583/job/90255382413))\n\n## Hint\n\nYou may have to fix your CI before adding the pull request to the queue again.\nIf you update this pull request, to fix the CI, it will automatically be requeued once the queue conditions match again.\nIf you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a `@mergifyio queue` comment.\n\nRequeued — the merge queue status continues in [this comment ↓](https://github.com/1aboveio/ai/pull/620#issuecomment-5103476982)."
-  },
-  {
-    "author": {
-      "login": "mergify"
-    },
-    "createdAt": "2026-07-28T11:20:58Z",
-    "body": "<!---\nDO NOT EDIT\n-*- Mergify Payload -*-\n{\"version\": 1, \"state\": \"merged\", \"queue_rule_name\": \"default\", \"queued_at\": \"2026-07-28T11:20:56.782765+00:00\", \"estimated_time_of_merge\": null, \"speculative_check_pr\": null, \"required_conditions\": []}\n-*- Mergify Payload End -*-\n-->\n\n# Merge Queue Status\n\n- ✅ **Entered queue** — `2026-07-28 11:20 UTC` · Rule: `default` · triggered by @exoulster with the [`@mergifyio queue` command](https://github.com/1aboveio/ai/pull/620#issuecomment-5103472242)\n- ✅ **Checks passed** · on draft #627\n- ✅ **Merged** — `2026-07-28 11:25 UTC` · at `e6a855b3c80d22c47661b3a47cadba7ad58a862e` · merge\n\nThis pull request spent **4 minutes 29 seconds** in the queue, including **3 minutes 1 second** running CI.\n\n<details>\n<summary>Required conditions to merge</summary>\n\n- [X] all of [🛡 Merge Protections rule `skill-script-tests (or exempt) before merge`]:\n  - [X] any of:\n    - [X] `check-success = skill-script-tests`\n    - [ ] all of:\n      - [ ] `-files ~= ^skills/`\n      - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [X] any of:\n  - [X] `check-success = skill-script-tests`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n- [X] any of:\n  - [X] `check-success = skill-script-tests-queue`\n  - [ ] all of:\n    - [ ] `-files ~= ^skills/`\n    - [X] `-files ~= ^\\.github/workflows/skill-gates\\.yml$`\n\n</details>"
-  },
-  {
-    "author": {
-      "login": "mergify"
-    },
-    "createdAt": "2026-07-28T11:21:32Z",
-    "body": "> queue\n\n#### ☑️ Command `queue` ignored because it is already running from a previous command.\n\n\n\n"
-  }
-]