@afokapu/atdd-bun 0.10.71 → 0.10.73

package/integrity.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.10.71",
+  "version": "0.10.73",
   "files": {
     "HOOK_AUDIT.md": "5329d840db37671b1918f688ead26865473b87db73dbc75f7c8b2a8bbe8d6d43",
     "PLANNER_PORT.md": "fb5935bac8b7ac18994de21e43ace3a5ef8cd55f85b0e3349fca261280054f11",
@@ -1257,11 +1257,11 @@
     "planner-schemas/wmbt.schema.json": "7a3a5693bfcf01340667c2be4a3c48e74f34b1af7e8dc13372c0de06b7f4fe12",
     "relationships.yaml": "5860a308ebc3ee7fa8172fc2c6633984000ab3003f0ae4b6fa28db48879eda22",
     "src/agent.ts": "6d6c6e75908af8fbab13432f0001b0374bb25cf3dee46ba218dfd67e0090cb56",
-    "src/ci.ts": "c4bc0a92e30da3db384e5bc968c45dae7b9de567dcee0e6493eb45cbd8f85652",
+    "src/ci.ts": "2a5e5052c4b99eb5c7282c7db2af3846ad6f3ca7d1eaefe924441116f765f37b",
     "src/cli.ts": "995e41b3cb44c04f65f4d599f0fc51b93b17b7558b7c7dcfabed64de3d455250",
     "src/docs-capability.ts": "bdeeb414649049b1cd4fa8008cada3a576318be51c43bec91bfa46a8e250c270",
     "src/enforce.ts": "7e6b3a1fc7c90f8e1836ab3e4655778fb569a63be5e7c199de44024fc003e6be",
-    "src/hooks.ts": "f97ce9df6abaa73bfee04aeeb24b9425d928c32f9ebb47d79d4d0f85c71a73c4",
+    "src/hooks.ts": "03eadd10e97cb4c369b89668b86be6d3e7f50b1402c1e1293d822c414581a30c",
     "src/index.ts": "4081f8b08d1d3ee9e15a9964143e53d9cfb94a5616ab3e58a180d24cc16dc381",
     "src/integrity.ts": "f5ad22759eec675454df82cdcf791b1f081951f08ca5084ebdcb8cd82aa1ecef",
     "src/journey-docs.ts": "994d229376244c84212cff951032823068a76565dd2fd427b9d44e341bd14853",
@@ -1279,6 +1279,6 @@
     "templates/agents/atdd-bun.integrity.test.ts": "dec6f6e5f65a08d9512fc703b367c163f8c9da1f6aa7fd466835c1ec30348a41",
     "templates/docs/site.css": "482b3427e3a3cb02a85dc85cfbeac80592dfd53abf42fc92d6ea7071f22afc95",
     "templates/github/atdd-bun-release.yml": "d9547e9e6ef3ae010d53d55314f6a54567f88bd900f7e50d994cd308601d2684",
-    "templates/github/atdd-bun.yml": "e67121bc42481906ceb298dd87c9ec70bce55dd59b31a79c1010e53053eec272"
+    "templates/github/atdd-bun.yml": "53d77e2d0dc8fa7f8700ac1d4d5c7522f960b423e894d78e1d8bfc63d68b95c7"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afokapu/atdd-bun",
-  "version": "0.10.71",
+  "version": "0.10.73",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/afokapu/atdd-bun.git"

package/src/ci.ts

@@ -6,6 +6,17 @@ import { policy } from "./hooks";
 const root = resolve(import.meta.dir, "..");
 const template = join(root, "templates/github/atdd-bun.yml");
 const version = (await Bun.file(join(root, "package.json")).json() as { version: string }).version;
+/** A repository that depends on Playwright needs its browser binary on the runner, or `bun test` fails with a missing
+ * executable. The step is emitted only for a direct dependency; an unreadable package.json yields no step. */
+async function usesPlaywright(repo: string) {
+  const path = join(repo, "package.json");
+  if (!existsSync(path)) return false;
+  try {
+    const manifest = JSON.parse(await readFile(path, "utf8")) as { dependencies?: unknown; devDependencies?: unknown } | null;
+    return [manifest?.dependencies, manifest?.devDependencies].some(group => group !== null && typeof group === "object" && ["@playwright/test", "playwright"].some(name => Object.hasOwn(group, name)));
+  } catch { return false; }
+}
+const playwrightStep = "      - run: ./node_modules/.bin/playwright install --with-deps chromium\n";
 /** The workflow for this repository: pushes to its protected branches run the post-merge checks, so a repository
  * whose base branch is not main or master is covered too. The integrity check compares against this same rendering.
  * Each branch is written as a JSON string, a YAML scalar a branch name can never break out of. */
@@ -16,7 +27,7 @@ export async function renderWorkflow(repo = process.cwd()) {
     const config = Bun.YAML.parse(await readFile(configPath, "utf8"));
     rejectNew = Boolean(config && typeof config === "object" && !Array.isArray(config) && (config as { ratchet?: { mode?: unknown } }).ratchet?.mode === "reject-new");
   } catch { /* policy(repo) below gives its existing parse diagnostic */ }
-  return (await readFile(template, "utf8")).replace("{{VERSION}}", version).replace("{{PROTECTED_BRANCHES}}", (await policy(repo)).protected_branches.map(branch => JSON.stringify(branch)).join(", ")).replace("{{ENFORCEMENT}}", rejectNew ? 'bun run atdd-bun all --ratchet --base "$ATDD_BASE_REF" --ratchet-activate-profiles' : "bun run atdd-bun all");
+  return (await readFile(template, "utf8")).replace("{{PLAYWRIGHT}}\n", await usesPlaywright(repo) ? playwrightStep : "").replace("{{VERSION}}", version).replace("{{PROTECTED_BRANCHES}}", (await policy(repo)).protected_branches.map(branch => JSON.stringify(branch)).join(", ")).replace("{{ENFORCEMENT}}", rejectNew ? 'bun run atdd-bun all --ratchet --base "$ATDD_BASE_REF" --ratchet-activate-profiles' : "bun run atdd-bun all");
 }
 const githubPackagesRegistry = /^\s*@[\w.-]+:registry\s*=\s*https:\/\/npm\.pkg\.github\.com\/?\s*$/im;
 const githubPackagesAuth = /^\s*\/\/npm\.pkg\.github\.com\/:_authToken\s*=\s*(.*?)\s*$/gim;

package/src/hooks.ts

@@ -114,13 +114,13 @@ async function strictPushGate(root: string, candidate: string, range: string) {
   try {
     await checkoutCommit(root, candidateRoot, candidate, "strict pre-push candidate");
     const changed = await files(candidateRoot, ["diff", "--name-only", range]);
-    return validation(candidateRoot, changed, true);
+    return await validation(candidateRoot, changed, true);
   } catch (error) { return bad(`strict pre-push gate failed closed: ${String(error)}`); }
   finally { await git(root, ["worktree", "remove", "--force", candidateRoot]); await rm(candidateRoot, { recursive: true, force: true }); }
 }
 
 /** A brand-new remote branch is ratcheted against the one protected remote-tracking tip that is an exact ancestor of the candidate. */
-async function newBranchBase(root: string, candidate: string, protectedBranches: string[], remote: string | undefined): Promise<{ base: string } | { error: string }> {
+async function protectedAncestors(root: string, candidate: string, protectedBranches: string[], remote: string | undefined): Promise<{ ancestors: string[] } | { error: string }> {
   const listed = await git(root, ["for-each-ref", "--format=%(refname) %(objectname)", "refs/remotes/"]);
   if (listed.code) return { error: `could not list protected branch tips for the new remote branch: ${listed.err || listed.out}` };
   const remotes = (await git(root, ["remote"])).out.split("\n").filter(Boolean), pushRemote = remote && remotes.includes(remote) ? remote : undefined;
@@ -130,9 +130,24 @@ async function newBranchBase(root: string, candidate: string, protectedBranches:
   });
   const ancestors = new Set<string>();
   for (const tip of new Set(tips)) if ((await git(root, ["merge-base", "--is-ancestor", tip, candidate])).code === 0) ancestors.add(tip);
-  if (!ancestors.size) return { error: "ratchet new remote branch requires a protected branch tip that is an exact ancestor of the pushed candidate; none found" };
-  if (ancestors.size > 1) return { error: `ratchet new remote branch base is ambiguous: ${ancestors.size} protected branch tips qualify with different commits` };
-  return { base: [...ancestors][0]! };
+  return { ancestors: [...ancestors] };
+}
+
+async function newBranchBase(root: string, candidate: string, protectedBranches: string[], remote: string | undefined): Promise<{ base: string } | { error: string }> {
+  const found = await protectedAncestors(root, candidate, protectedBranches, remote);
+  if ("error" in found) return found;
+  if (!found.ancestors.length) return { error: "ratchet new remote branch requires a protected branch tip that is an exact ancestor of the pushed candidate; none found" };
+  if (found.ancestors.length > 1) return { error: `ratchet new remote branch base is ambiguous: ${found.ancestors.length} protected branch tips qualify with different commits` };
+  return { base: found.ancestors[0]! };
+}
+
+/** For an existing remote branch the protected ancestor tip also counts as carried: CI judges against the protected base. */
+async function existingBranchProtectedBase(root: string, candidate: string, remoteBase: string, protectedBranches: string[], remote: string | undefined): Promise<{ base: string | null } | { error: string }> {
+  const found = await protectedAncestors(root, candidate, protectedBranches, remote);
+  if ("error" in found) return found;
+  if (found.ancestors.length > 1) return { error: `ratchet existing remote branch protected base is ambiguous: ${found.ancestors.length} protected branch tips qualify with different commits` };
+  const tip = found.ancestors[0];
+  return { base: tip && tip !== remoteBase.toLowerCase() ? tip : null };
 }
 
 async function ratchetPushGate(root: string, remoteBase: string, candidate: string, protectedBranches: string[], remote: string | undefined): Promise<{ ok: boolean; message: string } | null> {
@@ -140,7 +155,7 @@ async function ratchetPushGate(root: string, remoteBase: string, candidate: stri
   if (!/^[0-9a-f]{40}$/i.test(candidate)) return bad("ratchet reject-new requires an exact local candidate commit");
   const resolvedCandidate = await git(root, ["rev-parse", "--verify", `${candidate}^{commit}`]);
   if (resolvedCandidate.code || resolvedCandidate.out.toLowerCase() !== candidate.toLowerCase()) return bad(`ratchet candidate ${candidate} is unavailable or not a full exact commit`);
-  const baseRoot = await mkdtemp(join(tmpdir(), "atdd-ratchet-push-base-")), candidateRoot = await mkdtemp(join(tmpdir(), "atdd-ratchet-push-candidate-"));
+  const baseRoot = await mkdtemp(join(tmpdir(), "atdd-ratchet-push-base-")), protectedRoot = await mkdtemp(join(tmpdir(), "atdd-ratchet-push-protected-")), candidateRoot = await mkdtemp(join(tmpdir(), "atdd-ratchet-push-candidate-"));
   try {
     await checkoutCommit(root, candidateRoot, candidate, "ratchet candidate");
     const candidateConfig = await configAt(candidateRoot);
@@ -148,6 +163,8 @@ async function ratchetPushGate(root: string, remoteBase: string, candidate: stri
     try { policy = parseRatchetPolicy(candidateConfig); }
     catch (error) { return bad(`ratchet pushed candidate policy is invalid: ${String(error)}`); }
     if (!policy || policy.mode !== "reject-new") return null;
+    let protectedBase: string | null = null;
+    if (!/^0+$/.test(remoteBase)) { const found = await existingBranchProtectedBase(root, candidate, remoteBase, protectedBranches, remote); if ("error" in found) return bad(found.error); protectedBase = found.base; }
     if (/^0+$/.test(remoteBase)) { const found = await newBranchBase(root, candidate, protectedBranches, remote); if ("error" in found) return bad(found.error); base = found.base; }
     if (!/^[0-9a-f]{40}$/i.test(base)) return bad("ratchet reject-new requires an exact non-zero remote commit base");
     const resolvedBase = await git(root, ["rev-parse", "--verify", `${base}^{commit}`]);
@@ -169,17 +186,27 @@ async function ratchetPushGate(root: string, remoteBase: string, candidate: stri
     const unchanged = baseProfiles.join(",") === candidateProfiles.join(",") && (!basePolicyProfiles || basePolicyProfiles.join(",") === baseProfiles.join(",")) && contextDigest(baseConfig, baseProfiles) === contextDigest(candidateConfig, candidateProfiles);
     if (policyProfiles.join(",") !== candidateProfiles.join(",") || (!activation && !unchanged)) return bad("ratchet remote base and pushed candidate profile/context differ");
     const normalize = (findings: Awaited<ReturnType<typeof enforce>>, directory: string) => findings.map(finding => ({ ...finding, file: canonicalFindingPath(directory, finding.file) }));
-    const [baseFindings, candidateFindings] = await Promise.all([
+    let protectedUsed: string | null = null;
+    if (protectedBase) {
+      await checkoutCommit(root, protectedRoot, protectedBase, "ratchet protected base");
+      const protectedConfig = await configAt(protectedRoot);
+      // Only a protected tip judged under the same profile/context as the candidate is comparable; otherwise the remote tip alone decides.
+      if (contextDigest(protectedConfig, candidateProfiles) === contextDigest(candidateConfig, candidateProfiles)) protectedUsed = protectedBase;
+    }
+    const [baseFindings, candidateFindings, protectedFindings] = await Promise.all([
       enforce({ root: baseRoot, profiles: candidateProfiles as any }),
       enforce({ root: candidateRoot, profiles: candidateProfiles as any }),
+      protectedUsed ? enforce({ root: protectedRoot, profiles: candidateProfiles as any }) : Promise.resolve([]),
     ]);
-    const delta = compareFindings(normalize(baseFindings, baseRoot), normalize(candidateFindings, candidateRoot));
-    return { ok: delta.new.length === 0, message: JSON.stringify({ schema: "atdd-bun.ratchet-report/v1", mode: policy.mode, base, candidate, profiles: candidateProfiles, context: contextDigest(candidateConfig, candidateProfiles), ...delta }) };
+    const carriedBase = [...normalize(baseFindings, baseRoot), ...normalize(protectedFindings, protectedRoot)];
+    const delta = compareFindings(carriedBase, normalize(candidateFindings, candidateRoot));
+    return { ok: delta.new.length === 0, message: JSON.stringify({ schema: "atdd-bun.ratchet-report/v1", mode: policy.mode, base, ...(protectedUsed ? { protected_base: protectedUsed } : {}), candidate, profiles: candidateProfiles, context: contextDigest(candidateConfig, candidateProfiles), ...delta }) };
   } catch (error) { return bad(`ratchet pre-push gate failed closed: ${String(error)}`); }
   finally {
     await git(root, ["worktree", "remove", "--force", baseRoot]);
+    await git(root, ["worktree", "remove", "--force", protectedRoot]);
     await git(root, ["worktree", "remove", "--force", candidateRoot]);
-    await Promise.all([rm(baseRoot, { recursive: true, force: true }), rm(candidateRoot, { recursive: true, force: true })]);
+    await Promise.all([rm(baseRoot, { recursive: true, force: true }), rm(protectedRoot, { recursive: true, force: true }), rm(candidateRoot, { recursive: true, force: true })]);
   }
 }
 

package/templates/github/atdd-bun.yml

@@ -29,6 +29,7 @@ jobs:
       - run: bun install --frozen-lockfile
         env:
           NODE_AUTH_TOKEN: ${{ github.token }}
+{{PLAYWRIGHT}}
       - run: bun run atdd-bun integrity
       - run: {{ENFORCEMENT}}
       - run: bun test