@appsforgood/next-supabase-kit 0.2.0 → 0.3.0

package/REPOSITORY_SETTINGS.md

@@ -17,13 +17,15 @@ Protect `main` with:
 - Do not allow deletions.
 - Restrict bypasses to maintainers only.
 
-Required status checks:
+Optional status checks, only after GitHub Actions entitlement is confirmed and the project deliberately chooses hosted CI as required:
 
 - `Verify package`
 - `Review dependency changes`
 - `Analyze JavaScript and TypeScript`
 - `Scorecard`
 
+With the default `githubActions.mode: "off"`, configure no required hosted status checks. GitHub billing, spending-limit, or pre-execution failures cannot be recovered inside workflow YAML and must not block commit/push or ordinary phase progression. Preserve equivalent local test, audit, dependency, and security evidence in the council session.
+
 ## Release Environment
 
 Create environment `npm-publish` with:

package/SUPPLY_CHAIN.md

@@ -37,8 +37,9 @@ The release workflow and `npm run publish:verify` both use `scripts/post-publish
 
 ## Repository Automation
 
-- CI verifies package behavior on push and pull request.
-- Dependency Review blocks pull requests that introduce moderate or worse known vulnerabilities.
+- Local `npm run release:check` is the default package verification and supply-chain gate.
+- Hosted CI may mirror package verification on push and pull request when Actions entitlement is deliberately enabled.
+- Dependency Review can block pull requests that introduce moderate or worse known vulnerabilities when hosted Actions is available; otherwise review `npm audit` and lockfile changes locally.
 - Dependabot proposes npm and GitHub Actions updates; workflow actions remain pinned to immutable commit SHAs with reviewed version comments.
 - CodeQL scans JavaScript/TypeScript code.
 - OpenSSF Scorecard publishes repository security posture as code-scanning evidence.

package/dist/index.js

@@ -182,11 +182,14 @@ import { join as join14, normalize } from "path";
 
 // src/config/defaults.ts
 var PACKAGE_NAME = "@appsforgood/next-supabase-kit";
-var PACKAGE_VERSION = "0.2.0";
+var PACKAGE_VERSION = "0.3.0";
 var DEFAULT_CONFIG = {
   stack: "next-supabase",
   projectType: "saas",
   docsMode: "advisory",
+  githubActions: {
+    mode: "off"
+  },
   agentCouncil: {
     required: true,
     rosterPath: ".agent-kit/agent-roster.json",
@@ -1726,7 +1729,7 @@ function ideSurfaceToActivateTarget(ideSurface) {
 // src/install/managed-assets.ts
 import { readFileSync as readFileSync8 } from "fs";
 import { join as join10 } from "path";
-function listManagedAssets(packageRoot, stack) {
+function listManagedAssets(packageRoot, stack, options = {}) {
   const assets = [];
   const templateRoot = join10(packageRoot, "templates", stack);
   for (const target of ROOT_DOCS) {
@@ -1741,8 +1744,10 @@ function listManagedAssets(packageRoot, stack) {
     { target: DEFAULT_ORCHESTRATOR_TARGET, sourcePath: join10(packageRoot, DEFAULT_ORCHESTRATOR_SOURCE), category: "orchestrator" },
     { target: DEFAULT_RUNTIME_IGNORE_TARGET, sourcePath: join10(packageRoot, DEFAULT_RUNTIME_IGNORE_SOURCE), category: "orchestrator" }
   );
-  for (const template of CI_TEMPLATE_FILES) {
-    assets.push({ target: template.target, sourcePath: join10(packageRoot, template.source), category: "ci" });
+  if (options.includeCi) {
+    for (const template of CI_TEMPLATE_FILES) {
+      assets.push({ target: template.target, sourcePath: join10(packageRoot, template.source), category: "ci" });
+    }
   }
   for (const folder of LIBRARY_FOLDERS) {
     for (const relativePath of listFilesRecursive(join10(packageRoot, folder))) {
@@ -1768,7 +1773,9 @@ function initProject(options) {
   const stack = options.stack ?? DEFAULT_CONFIG.stack;
   const packageRoot = findPackageRoot();
   const templateRoot = join11(packageRoot, "templates", stack);
-  const managedAssets = listManagedAssets(packageRoot, stack);
+  const existingGithubActionsMode = readGithubActionsMode(cwd);
+  const githubActionsMode = options.githubActions || existingGithubActionsMode === "advisory" ? "advisory" : "off";
+  const managedAssets = listManagedAssets(packageRoot, stack, { includeCi: githubActionsMode !== "off" });
   if (!existsSync10(templateRoot)) {
     throw new Error(`Unsupported stack profile: ${stack}`);
   }
@@ -1863,20 +1870,26 @@ function initProject(options) {
   };
   writeText(join11(cwd, ".agent-kit", "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
-  writeText(join11(cwd, ".agent-kit", "config.json"), `${JSON.stringify(DEFAULT_CONFIG, null, 2)}
+  const config = {
+    ...DEFAULT_CONFIG,
+    githubActions: { mode: githubActionsMode }
+  };
+  writeText(join11(cwd, ".agent-kit", "config.json"), `${JSON.stringify(config, null, 2)}
 `);
   const overridesPath = join11(cwd, ".agent-kit", "overrides.json");
   if (!existsSync10(overridesPath)) writeText(overridesPath, `${JSON.stringify({ templates: {} }, null, 2)}
 `);
-  for (const template of CI_TEMPLATE_FILES) {
-    const ciCopy = copyTextWithConflict(join11(packageRoot, template.source), cwd, template.target, {
-      force: Boolean(options.force),
-      conflictRoot: join11(cwd, ".agent-kit", "conflicts")
-    });
-    if (ciCopy.action === "created") result.copied.push(ciCopy.target);
-    if (ciCopy.action === "unchanged") result.unchanged.push(ciCopy.target);
-    if (ciCopy.action === "overwritten") result.overwritten.push(ciCopy.target);
-    if (ciCopy.action === "conflict") result.conflicts.push(`${ciCopy.target} -> ${ciCopy.conflictPath}`);
+  if (githubActionsMode !== "off") {
+    for (const template of CI_TEMPLATE_FILES) {
+      const ciCopy = copyTextWithConflict(join11(packageRoot, template.source), cwd, template.target, {
+        force: Boolean(options.force),
+        conflictRoot: join11(cwd, ".agent-kit", "conflicts")
+      });
+      if (ciCopy.action === "created") result.copied.push(ciCopy.target);
+      if (ciCopy.action === "unchanged") result.unchanged.push(ciCopy.target);
+      if (ciCopy.action === "overwritten") result.overwritten.push(ciCopy.target);
+      if (ciCopy.action === "conflict") result.conflicts.push(`${ciCopy.target} -> ${ciCopy.conflictPath}`);
+    }
   }
   const context2 = initProjectContext(cwd);
   result.contextPath = context2.contextPath;
@@ -1899,6 +1912,23 @@ function readManifest(cwd) {
   if (!existsSync10(manifestPath)) return null;
   return JSON.parse(readFileSync9(manifestPath, "utf8"));
 }
+function readGithubActionsMode(cwd) {
+  const configPath = join11(cwd, ".agent-kit", "config.json");
+  if (!existsSync10(configPath)) {
+    const manifest = readManifest(cwd);
+    return manifest?.assetHashes?.[".github/workflows/agent-kit-audit.yml"] ? "advisory" : "off";
+  }
+  try {
+    const config = JSON.parse(readFileSync9(configPath, "utf8"));
+    const mode = config.githubActions?.mode;
+    if (mode === "off" || mode === "advisory") return mode;
+    const manifest = readManifest(cwd);
+    return manifest?.assetHashes?.[".github/workflows/agent-kit-audit.yml"] ? "advisory" : "off";
+  } catch {
+    const manifest = readManifest(cwd);
+    return manifest?.assetHashes?.[".github/workflows/agent-kit-audit.yml"] ? "advisory" : "off";
+  }
+}
 
 // src/install/audit-rules/project-reality.ts
 import { execFileSync } from "child_process";
@@ -4237,10 +4267,11 @@ function diffStatus(plan) {
   if (plan.action === "unchanged") return "unchanged";
   return "changed";
 }
-function diffProject(cwd, stack = "next-supabase") {
+function diffProject(cwd, stack = "next-supabase", options = {}) {
   const packageRoot = findPackageRoot();
   const manifest = readManifest(cwd);
-  const assets = listManagedAssets(packageRoot, stack);
+  const includeCi = options.githubActions ?? readGithubActionsMode(cwd) !== "off";
+  const assets = listManagedAssets(packageRoot, stack, { includeCi });
   const plans = assets.map((asset) => ({
     asset,
     plan: planFileUpdate({
@@ -4325,7 +4356,7 @@ function updateProject(options) {
   const stack = manifest.stack ?? "next-supabase";
   const templateRoot = join17(packageRoot, "templates", stack);
   if (!existsSync17(templateRoot)) throw new Error(`Unsupported stack profile in manifest: ${stack}`);
-  const assets = listManagedAssets(packageRoot, stack);
+  const assets = listManagedAssets(packageRoot, stack, { includeCi: readGithubActionsMode(cwd) !== "off" });
   const plans = assets.map(
     (asset) => planFileUpdate({
       target: asset.target,
@@ -7891,10 +7922,10 @@ async function runSetupServer(options) {
     process.once("SIGTERM", shutdown);
   });
 }
-program.command("init").description("Install agent-kit docs and library files into a project.").option("--stack <stack>", "Stack profile to install.", "next-supabase").option("--force", "Overwrite existing docs instead of writing conflicts.").option("--activate <targets...>", "Promote IDE/runtime adapters: cursor, claude, codex, copilot, antigravity, or all.").option("--guided", "Also create local project context files (interactive on a terminal, scan-based otherwise).").option("--dry-run", "Preview what init would create or conflict on without writing files.").option("--json", "Print machine-readable JSON output.").option("--setup", "Start the setup wizard after install.").option("--no-setup", "Skip the post-install setup wizard prompt.").option("--open", "Open the setup wizard in your default browser.").action(async (options) => {
+program.command("init").description("Install agent-kit docs and library files into a project.").option("--stack <stack>", "Stack profile to install.", "next-supabase").option("--force", "Overwrite existing docs instead of writing conflicts.").option("--activate <targets...>", "Promote IDE/runtime adapters: cursor, claude, codex, copilot, antigravity, or all.").option("--github-actions", "Install the optional advisory GitHub Actions audit workflow (off by default).").option("--guided", "Also create local project context files (interactive on a terminal, scan-based otherwise).").option("--dry-run", "Preview what init would create or conflict on without writing files.").option("--json", "Print machine-readable JSON output.").option("--setup", "Start the setup wizard after install.").option("--no-setup", "Skip the post-install setup wizard prompt.").option("--open", "Open the setup wizard in your default browser.").action(async (options) => {
   const cwd = process.cwd();
   if (options.dryRun) {
-    const preview = diffProject(cwd, options.stack);
+    const preview = diffProject(cwd, options.stack, options.githubActions ? { githubActions: true } : {});
     if (options.json) {
       printJson({ dryRun: true, preview: preview.preview, missing: preview.missing, changed: preview.changed, unchanged: preview.unchanged });
       return;
@@ -7911,6 +7942,7 @@ program.command("init").description("Install agent-kit docs and library files in
     cwd,
     stack: options.stack,
     force: Boolean(options.force),
+    githubActions: Boolean(options.githubActions),
     ...options.activate ? { activate: options.activate } : {}
   });
   const context2 = options.guided ? initProjectContext(cwd) : null;