@abloh/cli 0.1.2 → 0.1.3-rc.1

package/dist/index.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import {
   writeFileSync as writeFileSync11,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   mkdtempSync as mkdtempSync10,
   readFileSync as readFileSync23,
   readlinkSync as readlinkSync4,
@@ -11089,6 +11089,7 @@ async function diagnoseBaselineFailures(input) {
 import {
   existsSync as existsSync9,
   lstatSync as lstatSync12,
+  mkdirSync as mkdirSync8,
   readFileSync as readFileSync18,
   readdirSync as readdirSync7,
   rmSync as rmSync9,
@@ -11182,8 +11183,9 @@ Overrides:
 
   --no-prepare           skip the automatic vitest coverage-provider staging
 
-Writes abloh.yml, or adds the environment block to one you already have \u2014 every line already in
-that file is left alone, including the tier. It refuses only when the file already configures
+Writes abloh.yml and .github/workflows/abloh-check.yml. An abloh.yml you already have gets the
+environment block appended and every line already in it left alone; a workflow you already have is
+never touched. It refuses only when the policy file already configures
 environment. It never modifies the repository otherwise \u2014 no dependency, manifest, lockfile, or
 source changes, and it never runs tests. For a Vitest repository without @vitest/coverage-v8 it
 stages that provider into Abloh's own cache (the one registry access; disable with --no-prepare).
@@ -11493,13 +11495,6 @@ function standardInstallCommand(packageManager, version, hasLockfile) {
 }
 function renderPolicyDefaults() {
   return [
-    "# DATA TIER \u2014 what leaves your CI.",
-    "#   0  counts and locations only. No model calls.",
-    "#   1  the review model runs here, under your credentials. Abloh receives structure only.",
-    "#   2  Abloh also stores the mutated source span of each finding, the model's",
-    "#      reasoning and any test it proves. Your code is retained by Abloh.",
-    "tier: 2",
-    "",
     "# THRESHOLD \u2014 the catch rate a run has to reach to pass. Abloh plants deliberate",
     "# changes in your diff and counts how many your tests notice; 70 means seven in ten.",
     "threshold: 70",
@@ -11554,6 +11549,45 @@ function renderPolicy(input) {
 function declaresTopLevelKey(document, key) {
   return new RegExp(String.raw`^${key}\s*:`, "mu").test(document);
 }
+var WORKFLOW_RELATIVE_PATH = ".github/workflows/abloh-check.yml";
+var PINNED_ACTION = "Vero-Technology/abloh-action@3f8f0058d1ed1fae11d33a109e7e598bd3450097";
+function renderWorkflow(input) {
+  const build = input.installCommand === null ? ["      # Your normal build and dependency steps go here."] : [
+    `      - run: ${input.installCommand}`,
+    ...input.installDirectory === "." ? [] : [`        working-directory: ${input.installDirectory}`]
+  ];
+  return [
+    "name: Abloh",
+    "on:",
+    "  pull_request:",
+    "",
+    "jobs:",
+    "  abloh:",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      contents: read",
+    "      id-token: write # short-lived identity for the Abloh model gateway",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          ref: ${{ github.event.pull_request.head.sha }}",
+    "          fetch-depth: 0 # Abloh diffs against the base ref",
+    "          persist-credentials: false",
+    ...build,
+    `      - uses: ${PINNED_ACTION}`,
+    "        with:",
+    "          base: ${{ github.event.pull_request.base.sha }}",
+    ""
+  ].join("\n");
+}
+function writeWorkflow(repoDir, input) {
+  const path = join21(repoDir, WORKFLOW_RELATIVE_PATH);
+  const legacy = join21(repoDir, ".github", "workflows", "abloh.yml");
+  if (existsSync9(path) || existsSync9(legacy)) return "exists";
+  mkdirSync8(dirname12(path), { recursive: true });
+  writeFileSync7(path, renderWorkflow(input), { encoding: "utf8", mode: 420, flag: "wx" });
+  return "created";
+}
 function writePolicy(policyPath, input) {
   if (!existsSync9(policyPath)) {
     writeFileSync7(policyPath, renderPolicy(input), { encoding: "utf8", mode: 420, flag: "wx" });
@@ -11646,9 +11680,19 @@ async function initRepository(options) {
       else writeFileSync7(policyPath, previous2, { encoding: "utf8", mode: 420 });
       throw error;
     }
+    const pythonWorkflow = writeWorkflow(repoDir, {
+      subdir: inferredSubdir,
+      runtimeImage: image2.ref,
+      testCommand: null,
+      installCommand: installCommand2,
+      installDirectory: installDirectory2,
+      identityFiles: identities2
+    });
     return {
       repoDir,
       policyPath,
+      workflowPath: join21(repoDir, WORKFLOW_RELATIVE_PATH),
+      workflowState: pythonWorkflow,
       subdir: inferredSubdir,
       language: "python",
       runner: "pytest",
@@ -11726,9 +11770,12 @@ async function initRepository(options) {
     else writeFileSync7(policyPath, previous, { encoding: "utf8", mode: 420 });
     throw error;
   }
+  const workflowState = writeWorkflow(repoDir, policyInput);
   return {
     repoDir,
     policyPath,
+    workflowPath: join21(repoDir, WORKFLOW_RELATIVE_PATH),
+    workflowState,
     subdir: target.subdir,
     language: "javascript",
     runner: target.runner,
@@ -11754,7 +11801,10 @@ function renderInitResult(result) {
       `Layer 0 coverage: @vitest/coverage-v8${provider.vitestVersion === null ? "" : `@${provider.vitestVersion}`} is not available \u2014 after the repository's dependency install, run \`abloh prepare\` (or add it as an exact dev dependency); without it Layer 0 reports cannot-attest.`
     ],
     `Proof image: ${result.runtimeImage} (${result.runtimeImageSource})`,
-    "Next: review and commit abloh.yml, then add the Abloh GitHub Action."
+    result.workflowState === "created" ? `Created ${result.workflowPath}` : `Left ${result.workflowPath} alone \u2014 a workflow is already there`,
+    /* Both files, named, because "commit abloh.yml" was the whole instruction when the workflow
+       was the customer's to write and is now half of it. */
+    "Next: review and commit both files. Abloh runs on the pull request that adds them."
   ].join("\n") + "\n";
 }
 
@@ -11957,7 +12007,7 @@ import {
   fsyncSync as fsyncSync2,
   fstatSync as fstatSync5,
   lstatSync as lstatSync13,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync8,
   openSync as openSync6,
   readFileSync as readFileSync20,
@@ -12242,7 +12292,7 @@ function prepareAtomicCopy(source, destination, nonce) {
   if (identityOf(source).kind !== "file") {
     throw new Error(`staged artifact must be a regular file: ${source}`);
   }
-  mkdirSync8(dirname13(destination), { recursive: true });
+  mkdirSync9(dirname13(destination), { recursive: true });
   assertNoSymlinkComponents(dirname13(destination), destination);
   if (existsSync11(destination)) {
     const info = lstatSync13(destination);
@@ -12265,7 +12315,7 @@ function prepareAtomicCopy(source, destination, nonce) {
   return temporary;
 }
 function copyDirectory(source, destination) {
-  mkdirSync8(destination, { mode: 448 });
+  mkdirSync9(destination, { mode: 448 });
   for (const entry of readdirSync8(source, { withFileTypes: true })) {
     const from = join23(source, entry.name);
     const to = join23(destination, entry.name);
@@ -12287,7 +12337,7 @@ function prepareAtomicDirectory(source, destination, nonce) {
   if (identityOf(source).kind !== "directory") {
     throw new Error(`staged artifact must be a directory: ${source}`);
   }
-  mkdirSync8(dirname13(destination), { recursive: true });
+  mkdirSync9(dirname13(destination), { recursive: true });
   assertNoSymlinkComponents(dirname13(destination), destination);
   const temporary = join23(
     dirname13(destination),
@@ -12551,7 +12601,7 @@ function acquirePublicationLock(controlDestination, allowedDestinations) {
   const acquired = [];
   try {
     for (const lockPath of paths.locks) {
-      mkdirSync8(dirname13(lockPath), { recursive: true });
+      mkdirSync9(dirname13(lockPath), { recursive: true });
       const fd = openSync6(
         lockPath,
         constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY | constants3.O_NOFOLLOW,
@@ -12724,7 +12774,7 @@ async function createArtifactOutputTransaction(input) {
         controlDestination: destinations.json,
         allowedDestinations
       });
-      mkdirSync8(dirname13(destinations.json), { recursive: true });
+      mkdirSync9(dirname13(destinations.json), { recursive: true });
       assertNoSymlinkComponents(repoDir, destinations.json);
       publicationMetadata = acquirePublicationLock(destinations.json, allowedDestinations);
       input.publicationTestHooks?.afterCrashPoint?.({ phase: "locks-acquired" });
@@ -12736,7 +12786,7 @@ async function createArtifactOutputTransaction(input) {
         if (operations.some((operation) => operation.destination === destination)) {
           throw new Error(`staged artifacts collide at ${destination}`);
         }
-        mkdirSync8(dirname13(destination), { recursive: true });
+        mkdirSync9(dirname13(destination), { recursive: true });
         assertNoSymlinkComponents(repoDir, destination);
         const parent = parentIdentity(destination);
         const existingIdentity = existsSync11(destination) ? identityOf(destination) : void 0;
@@ -13602,7 +13652,7 @@ function writeArtifacts(report, opts) {
     const patchRevertText = `${JSON.stringify(report.patchRevertLocal, null, 2)}
 `;
     patchRevertDigest = sha256Hex(patchRevertText);
-    mkdirSync9(dirname15(patchRevertOut), { recursive: true });
+    mkdirSync10(dirname15(patchRevertOut), { recursive: true });
     writeFileSync11(patchRevertOut, patchRevertText, { mode: 384 });
   }
   const rationalesText = JSON.stringify(buildRationalesFile(report.findings), null, 2) + "\n";
@@ -13610,7 +13660,7 @@ function writeArtifacts(report, opts) {
   let rawReportDigest = null;
   if (report.rawReportText != null) {
     rawReportDigest = sha256Hex(report.rawReportText);
-    mkdirSync9(dirname15(rawReportOut), { recursive: true });
+    mkdirSync10(dirname15(rawReportOut), { recursive: true });
     writeFileSync11(rawReportOut, report.rawReportText);
   } else {
     rmSync12(rawReportOut, { force: true });
@@ -13627,7 +13677,7 @@ function writeArtifacts(report, opts) {
       const redactedText = `${JSON.stringify(redacted, null, 2)}
 `;
       redactedReportDigest = sha256Hex(redactedText);
-      mkdirSync9(dirname15(redactedReportOut), { recursive: true });
+      mkdirSync10(dirname15(redactedReportOut), { recursive: true });
       writeFileSync11(redactedReportOut, redactedText, { mode: 384 });
     } else {
       rmSync12(redactedReportOut, { force: true });
@@ -13638,7 +13688,7 @@ function writeArtifacts(report, opts) {
   let rawCoverageDigest = null;
   if (report.rawCoverageText != null) {
     rawCoverageDigest = sha256Hex(report.rawCoverageText);
-    mkdirSync9(dirname15(rawCoverageOut), { recursive: true });
+    mkdirSync10(dirname15(rawCoverageOut), { recursive: true });
     writeFileSync11(rawCoverageOut, report.rawCoverageText);
   } else {
     rmSync12(rawCoverageOut, { force: true });
@@ -13647,17 +13697,17 @@ function writeArtifacts(report, opts) {
   if (report.rawCarrierReports && report.rawCarrierReports.length > 0) {
     const text = JSON.stringify({ schema: "attest-raw-carrier-reports/v2", reports: report.rawCarrierReports }, null, 2) + "\n";
     rawCarrierDigest = sha256Hex(text);
-    mkdirSync9(dirname15(rawCarrierOut), { recursive: true });
+    mkdirSync10(dirname15(rawCarrierOut), { recursive: true });
     writeFileSync11(rawCarrierOut, text);
   } else {
     rmSync12(rawCarrierOut, { force: true });
   }
   const artifact = buildArtifact(report, rationalesDigest, rawReportDigest, rawCoverageDigest, rawCarrierDigest, patchRevertDigest, redactedReportDigest);
-  mkdirSync9(dirname15(rationalesOut), { recursive: true });
+  mkdirSync10(dirname15(rationalesOut), { recursive: true });
   writeFileSync11(rationalesOut, rationalesText);
-  mkdirSync9(dirname15(jsonOut), { recursive: true });
+  mkdirSync10(dirname15(jsonOut), { recursive: true });
   writeFileSync11(jsonOut, JSON.stringify(artifact, null, 2) + "\n");
-  mkdirSync9(dirname15(mdOut), { recursive: true });
+  mkdirSync10(dirname15(mdOut), { recursive: true });
   writeFileSync11(mdOut, renderMarkdown(report, rawReportDigest, rawCoverageDigest));
   log(`staged ${logical.json} and ${logical.md}`);
   log(`rationales (local only): ${logical.rationales} \u2014 sha256 ${rationalesDigest.slice(0, 16)}\u2026 recorded in artifact`);
@@ -15462,7 +15512,7 @@ Replace each link with a tracked regular file, or point it to a tracked regular
             null,
             2
           ) + "\n";
-          mkdirSync9(dirname15(fixProofsOut), { recursive: true });
+          mkdirSync10(dirname15(fixProofsOut), { recursive: true });
           writeFileSync11(fixProofsOut, fixProofsText);
           if (fixLoopBlock.state === "completed") fixLoopBlock = { ...fixLoopBlock, proofsDigest: sha256Hex(fixProofsText) };
           log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloh/cli",
-  "version": "0.1.2",
+  "version": "0.1.3-rc.1",
   "description": "Abloh CLI: the `abloh run` command. The package will publish under the @abloh scope.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -26,11 +26,11 @@
   "dependencies": {
     "semver": "7.8.5",
     "yaml": "^2.5.0",
+    "@abloh/sandbox": "0.1.2",
     "@abloh/core": "0.1.2",
     "@abloh/engine-python": "0.1.2",
-    "@abloh/engine-stryker": "0.1.2",
     "@abloh/triage": "0.1.2",
-    "@abloh/sandbox": "0.1.2"
+    "@abloh/engine-stryker": "0.1.3-rc.1"
   },
   "devDependencies": {
     "@types/semver": "7.7.1",