@arjunkhera/atlas 0.4.36 → 0.4.37

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.36",
+  "version": "0.4.37",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/lib/pull-request.mjs

@@ -23,7 +23,7 @@ export const TOOLING_LABEL = 'atlas-helper';
 
 // The only files the tooling writer may write: the check, its workflow, and
 // the pull request template when the repo has none.
-export const TOOLING_PATHS = Object.freeze([CHECK_PATH, WORKFLOW_PATH, '.github/workflows/atlas-jobs.yml', '.github/workflows/atlas-upkeep.yml', '.github/pull_request_template.md']);
+export const TOOLING_PATHS = Object.freeze([CHECK_PATH, WORKFLOW_PATH, '.github/workflows/atlas-jobs.yml', '.github/workflows/atlas-upkeep.yml', '.github/workflows/atlas-procedures.yml', '.github/pull_request_template.md']);
 // The only files the tooling writer may remove: the workflow of check versions
 // 1 to 5, which the gate workflow replaces (roadmap R7).
 export const TOOLING_REMOVALS = Object.freeze([OLD_WORKFLOW_PATH]);

package/door/lib/tooling.mjs

@@ -47,8 +47,14 @@ export const PACKAGE_JOBS_SOURCE = 'door/templates/atlas-jobs.yml';
 // master and has no pin, so the writer keeps it and Atlas runs one upkeep job.
 export const UPKEEP_PATH = '.github/workflows/atlas-upkeep.yml';
 export const PACKAGE_UPKEEP_SOURCE = 'door/templates/atlas-upkeep.yml';
+// The tagged procedure steps on each pull request that changes a skill
+// (roadmap R40). The same pin rule holds. The Atlas repo runs these steps in
+// its own package gates job, so the writer never writes this file there.
+export const PROCEDURES_PATH = '.github/workflows/atlas-procedures.yml';
+export const PACKAGE_PROCEDURES_SOURCE = 'door/templates/atlas-procedures.yml';
 // The workflows the writer pins, in the order of its rows.
-const PINNED = Object.freeze([[JOBS_PATH, PACKAGE_JOBS_SOURCE], [UPKEEP_PATH, PACKAGE_UPKEEP_SOURCE]]);
+const PINNED = Object.freeze([[JOBS_PATH, PACKAGE_JOBS_SOURCE], [UPKEEP_PATH, PACKAGE_UPKEEP_SOURCE], [PROCEDURES_PATH, PACKAGE_PROCEDURES_SOURCE]]);
+const pinnedFor = (root, packageRoot) => (isPackageRepo(root, packageRoot) ? PINNED.filter(([path]) => path !== PROCEDURES_PATH) : PINNED);
 const VERSION_SLOT = '__ATLAS_VERSION__';
 function packagedPinned(packageRoot, source) {
   const full = join(packageRoot, source);
@@ -56,6 +62,7 @@ function packagedPinned(packageRoot, source) {
 }
 export const packagedJobsWorkflow = (packageRoot) => packagedPinned(packageRoot, PACKAGE_JOBS_SOURCE);
 export const packagedUpkeepWorkflow = (packageRoot) => packagedPinned(packageRoot, PACKAGE_UPKEEP_SOURCE);
+export const packagedProceduresWorkflow = (packageRoot) => packagedPinned(packageRoot, PACKAGE_PROCEDURES_SOURCE);
 const pinOf = (text) => /@arjunkhera\/atlas@(\d+)\.(\d+)\.(\d+)\b/.exec(text)?.slice(1).map(Number) ?? null;
 const older = (a, b) => { for (let i = 0; i < 3; i += 1) if (a[i] !== b[i]) return a[i] < b[i]; return false; };
 // written, refreshed, unchanged or kept: what the writer does with one pinned workflow.
@@ -69,7 +76,7 @@ function pinnedState(root, packageRoot, path, source) {
   const have = pinOf(was);
   return have && older(have, pinOf(wanted)) ? 'refreshed' : 'kept';
 }
-const pinnedNeedWrite = (root, packageRoot) => PINNED.some(([path, source]) => ['written', 'refreshed'].includes(pinnedState(root, packageRoot, path, source)));
+const pinnedNeedWrite = (root, packageRoot) => pinnedFor(root, packageRoot).some(([path, source]) => ['written', 'refreshed'].includes(pinnedState(root, packageRoot, path, source)));
 
 // The pull request template (roadmap R8). The writer puts it into a repo that
 // has none, and never replaces a template the repo keeps.
@@ -154,7 +161,7 @@ export function write(root, packageRoot, { dryRun = false, replaceUnknown = fals
     if (!dryRun) rmSync(join(root, OLD_WORKFLOW_PATH));
     rows.push({ path: OLD_WORKFLOW_PATH, state: 'removed', sha256: null, was: sha256(was) });
   }
-  for (const [path, source] of workflowOnly ? [] : PINNED) {
+  for (const [path, source] of workflowOnly ? [] : pinnedFor(root, packageRoot)) {
     const state = pinnedState(root, packageRoot, path, source);
     if (state === null) continue;
     const contents = packagedPinned(packageRoot, source);
@@ -190,7 +197,7 @@ export function changes(root, packageRoot, { replaceUnknown = false, workflowOnl
   if (rows.every((row) => row.state === 'unchanged' || row.state === 'kept')) {
     throw new ToolingRefusal('this repo is already current: its Atlas files match the package, so there is nothing to open.', { current: true });
   }
-  const wanted = { ...packagedFiles(packageRoot), [JOBS_PATH]: packagedJobsWorkflow(packageRoot), [UPKEEP_PATH]: packagedUpkeepWorkflow(packageRoot), [PR_TEMPLATE_PATH]: packagedTemplate(packageRoot) };
+  const wanted = { ...packagedFiles(packageRoot), [JOBS_PATH]: packagedJobsWorkflow(packageRoot), [UPKEEP_PATH]: packagedUpkeepWorkflow(packageRoot), [PROCEDURES_PATH]: packagedProceduresWorkflow(packageRoot), [PR_TEMPLATE_PATH]: packagedTemplate(packageRoot) };
   return rows
     .filter((row) => row.state !== 'unchanged' && row.state !== 'kept')
     .map((row) => (row.state === 'removed' ? {
@@ -206,8 +213,8 @@ export function changes(root, packageRoot, { replaceUnknown = false, workflowOnl
           ? `copied byte for byte from ${PACKAGE_CHECK_SOURCE}, check version ${CHECK_VERSION}, in Atlas ${version}`
           : row.path === PR_TEMPLATE_PATH
             ? `copied from ${PACKAGE_TEMPLATE_SOURCE}, Atlas ${version}; the repo had no pull request template`
-            : row.path === JOBS_PATH || row.path === UPKEEP_PATH
-              ? `written from ${row.path === JOBS_PATH ? PACKAGE_JOBS_SOURCE : PACKAGE_UPKEEP_SOURCE}, with its pin set to Atlas ${version}`
+            : PINNED.some(([path]) => path === row.path)
+              ? `written from ${PINNED.find(([path]) => path === row.path)[1]}, with its pin set to Atlas ${version}`
               : `written from the WORKFLOW_TEMPLATE constant in ${PACKAGE_CHECK_SOURCE}, Atlas ${version}`,
       },
     }));

package/door/templates/atlas-procedures.yml

@@ -0,0 +1,53 @@
+name: atlas-procedures
+# The Atlas procedure steps (roadmap R40). `atlas tooling` wrote this file from
+# the Atlas package; do not edit it by hand.
+#
+# A procedure is a skill that atlas.yaml names under `procedures:`. A step a
+# clean machine can run sits in a fenced block tagged `atlas-run`. This job
+# runs those blocks for each procedure that a pull request changes: the
+# procedure folder, or a path its `sources:` names. A block tagged
+# `needs=secret/<name>`, `needs=device/<name>` or `needs=network/<name>` is
+# listed "not run here".
+#
+# The path filter starts the job only when a skill or atlas.yaml changes, so
+# most pull requests start nothing. A change to a path that a procedure names
+# in `sources:` alone does not start it; the upkeep check lists that procedure
+# instead. The steps run the code of the pull request, so the job holds a
+# token that can only read and no repo secret, also for a pull request from a
+# fork. npx runs outside the checkout, so an .npmrc in the pull request cannot
+# pick the registry of Atlas itself.
+on:
+  pull_request:
+    paths:
+      - ".claude/skills/**"
+      - "atlas.yaml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: atlas-procedures-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  procedures:
+    name: procedures · tagged steps
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # actions/checkout v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      # actions/setup-node v7.0.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: "22.22.0"
+      - name: Run the tagged steps of each procedure this pull request changes
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          npx --yes --ignore-scripts @arjunkhera/atlas@__ATLAS_VERSION__ upkeep procedures --root "$GITHUB_WORKSPACE" --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.36",
+  "version": "0.4.37",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",