@ankhorage/devtools 1.10.0 → 1.10.2

package/dist/owner/synchronizeRenovateOwnerAsync.js

@@ -3,6 +3,7 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { applyBunRuntimePolicy } from '../policy/applyBunRuntimePolicy.js';
 import { nodeRuntimePolicy } from '../policy/bunRuntimePolicy.js';
+import { renderRenovateWorkflowAsync } from '../tools/workflows/renderRenovateWorkflowAsync.js';
 import { renderWorkflowAsync } from '../tools/workflows/renderWorkflowAsync.js';
 export async function synchronizeRenovateOwnerAsync(operation, targetDirectory, options = {}) {
     const target = resolve(targetDirectory);
@@ -52,7 +53,7 @@ async function createManagedDefinitionsAsync(targetDirectory, policy) {
         },
         {
             relativePath: '.github/workflows/renovate.yml',
-            contents: await renderWorkflowAsync(new URL('../tools/workflows/files/renovate.yml', import.meta.url), workflowPolicy),
+            contents: await renderRenovateWorkflowAsync(new URL('../tools/workflows/files/renovate.yml', import.meta.url), targetDirectory, workflowPolicy),
         },
         {
             relativePath: 'README.md',

package/dist/tools/knip/index.d.ts

@@ -1,8 +1,8 @@
 /***
  * Build shared Knip configuration while preserving repository-specific discovery.
  *
- * `createKnipConfig` keeps Knip zero-config behavior by default and only emits settings that the
- * consumer explicitly provides. Repositories can add narrow entries, project globs, ignored files,
+ * `createKnipConfig` keeps Knip zero-config discovery while excluding executable files in
+ * Devtools-managed skills. Repositories can add narrow entries, project globs, ignored files,
  * binaries, dependencies, and workspace overrides without duplicating the shared Knip version.
  *
  * `createKnipMonorepoConfig` adds a root workspace plus conventional `packages/*` and `apps/*`
@@ -29,5 +29,7 @@ export interface DevtoolsKnipMonorepoConfigOptions {
     readonly workspaceGlobs?: string[];
     readonly workspaces?: Record<string, DevtoolsKnipWorkspaceConfigOptions>;
 }
+/*** Build shared Knip configuration with the Devtools-managed skill boundary excluded. */
 export declare function createKnipConfig(options?: DevtoolsKnipConfigOptions): KnipConfig;
+/*** Build shared monorepo Knip configuration with the same managed-skill boundary. */
 export declare function createKnipMonorepoConfig(options?: DevtoolsKnipMonorepoConfigOptions): KnipConfig;

package/dist/tools/knip/index.js

@@ -1,5 +1,8 @@
+import { MANAGED_SKILL_EXECUTABLE_GLOB } from '../skills/manifest.js';
 const DEFAULT_MONOREPO_WORKSPACE_GLOBS = ['packages/*', 'apps/*'];
+/*** Build shared Knip configuration with the Devtools-managed skill boundary excluded. */
 export function createKnipConfig(options = {}) {
+    const ignoreFiles = [...new Set([MANAGED_SKILL_EXECUTABLE_GLOB, ...(options.ignoreFiles ?? [])])];
     return {
         ...(options.entry === undefined ? {} : { entry: options.entry }),
         ...(options.project === undefined ? {} : { project: options.project }),
@@ -8,10 +11,11 @@ export function createKnipConfig(options = {}) {
         ...(options.ignoreDependencies === undefined
             ? {}
             : { ignoreDependencies: options.ignoreDependencies }),
-        ...(options.ignoreFiles === undefined ? {} : { ignoreFiles: options.ignoreFiles }),
+        ignoreFiles,
         ...(options.workspaces === undefined ? {} : { workspaces: options.workspaces }),
     };
 }
+/*** Build shared monorepo Knip configuration with the same managed-skill boundary. */
 export function createKnipMonorepoConfig(options = {}) {
     const explicitWorkspaces = options.workspaces ?? {};
     const workspaceGlobs = options.workspaceGlobs ?? [...DEFAULT_MONOREPO_WORKSPACE_GLOBS];

package/dist/tools/skills/manifest.d.ts

@@ -1,5 +1,6 @@
 export declare const MANIFEST_PATH = ".agents/.devtools-manifest.json";
 export declare const SKILLS_ROOT = ".agents/skills";
+export declare const MANAGED_SKILL_EXECUTABLE_GLOB = ".agents/skills/**/scripts/**";
 interface ManagedSkillManifestEntry {
     readonly files: Readonly<Record<string, string>>;
 }

package/dist/tools/skills/manifest.js

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 import { posix, relative, resolve } from 'node:path';
 export const MANIFEST_PATH = '.agents/.devtools-manifest.json';
 export const SKILLS_ROOT = '.agents/skills';
+export const MANAGED_SKILL_EXECUTABLE_GLOB = `${SKILLS_ROOT}/**/scripts/**`;
 const MANIFEST_SCHEMA_VERSION = 1;
 export function createManifestContents(contentsByPath, devtoolsVersion, skillNames) {
     const skills = Object.fromEntries(skillNames.map((skillName) => {

package/dist/tools/workflows/index.js

@@ -1,9 +1,10 @@
 import { bunRuntimePolicy, nodeRuntimePolicy } from '../../policy/bunRuntimePolicy.js';
+import { renderRenovateWorkflowAsync } from './renderRenovateWorkflowAsync.js';
 import { renderWorkflowAsync } from './renderWorkflowAsync.js';
 export const workflowManagedFiles = [
     createWorkflowDefinition('.github/workflows/ci.yml', './files/ci.yml'),
     createWorkflowDefinition('.github/workflows/release.yml', './files/release.yml'),
-    createWorkflowDefinition('.github/workflows/renovate.yml', './files/renovate.yml'),
+    createRenovateWorkflowDefinition(),
 ];
 function createWorkflowDefinition(relativePath, sourcePath) {
     const sourceUrl = new URL(sourcePath, import.meta.url);
@@ -15,3 +16,14 @@ function createWorkflowDefinition(relativePath, sourcePath) {
         }),
     };
 }
+/*** Creates the managed workflow whose immutable digest remains Renovate-owned. */
+function createRenovateWorkflowDefinition() {
+    const sourceUrl = new URL('./files/renovate.yml', import.meta.url);
+    return {
+        relativePath: '.github/workflows/renovate.yml',
+        render: async (targetDirectory) => await renderRenovateWorkflowAsync(sourceUrl, targetDirectory, {
+            bunVersion: bunRuntimePolicy.version,
+            nodeVersion: nodeRuntimePolicy.setupVersion,
+        }),
+    };
+}

package/dist/tools/workflows/renderRenovateWorkflowAsync.d.ts

@@ -0,0 +1,3 @@
+import { type WorkflowPolicy } from './renderWorkflowAsync.js';
+/*** Renders the canonical workflow while retaining Renovate's exact trusted digest. */
+export declare function renderRenovateWorkflowAsync(sourceUrl: URL, targetDirectory: string, policy: WorkflowPolicy): Promise<string>;

package/dist/tools/workflows/renderRenovateWorkflowAsync.js

@@ -0,0 +1,39 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { renderWorkflowAsync } from './renderWorkflowAsync.js';
+/*** Renders the canonical workflow while retaining Renovate's exact trusted digest. */
+export async function renderRenovateWorkflowAsync(sourceUrl, targetDirectory, policy) {
+    const template = await renderWorkflowAsync(sourceUrl, policy);
+    readSingleRenovateWorkflowDigest(template, 'Devtools workflow template');
+    const target = await readOptionalWorkflowAsync(resolve(targetDirectory, RENOVATE_WORKFLOW_RELATIVE_PATH));
+    if (target === null)
+        return template;
+    const digest = readSingleRenovateWorkflowDigest(target, 'target workflow');
+    return template.replace(RENOVATE_WORKFLOW_REFERENCE_PATTERN, (_reference, prefix, _templateDigest, suffix) => `${prefix}${digest}${suffix}`);
+}
+/*** Reads one exact immutable digest from the canonical Renovate workflow reference. */
+function readSingleRenovateWorkflowDigest(contents, source) {
+    const matches = [...contents.matchAll(RENOVATE_WORKFLOW_REFERENCE_PATTERN)];
+    const digest = matches.length === 1 ? matches[0]?.[2] : undefined;
+    if (digest === undefined) {
+        throw new Error(`Expected exactly one immutable Renovate digest in the ${source}.`);
+    }
+    return digest;
+}
+/*** Reads an existing managed workflow without treating first-time creation as an error. */
+async function readOptionalWorkflowAsync(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+/*** Narrows filesystem failures to Node errors with stable codes. */
+function isNodeError(error) {
+    return error instanceof Error && 'code' in error;
+}
+const RENOVATE_WORKFLOW_REFERENCE_PATTERN = /^([ \t]*uses:[ \t]+ankhorage\/renovate\/\.github\/workflows\/changeset\.yml@)([0-9a-f]{40})([ \t]*)$/gmu;
+const RENOVATE_WORKFLOW_RELATIVE_PATH = '.github/workflows/renovate.yml';

package/dist/tools/workflows/renderWorkflowAsync.d.ts

@@ -1,4 +1,6 @@
-export declare function renderWorkflowAsync(sourceUrl: URL, policy: {
+export interface WorkflowPolicy {
     readonly bunVersion: string;
     readonly nodeVersion: string;
-}): Promise<string>;
+}
+/*** Renders one workflow template with the canonical runtime and Changesets policy. */
+export declare function renderWorkflowAsync(sourceUrl: URL, policy: WorkflowPolicy): Promise<string>;

package/dist/tools/workflows/renderWorkflowAsync.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { changesetsPolicy } from '../../policy/changesetsPolicy.js';
+/*** Renders one workflow template with the canonical runtime and Changesets policy. */
 export async function renderWorkflowAsync(sourceUrl, policy) {
     const template = await readFile(sourceUrl, 'utf8');
     return template

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Shared development tools and repository standards for Ankhorage",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",