@biffo/cli 0.142.1 → 0.142.2

package/_skeletons/plugin-template/.github/workflows/ci.yml

@@ -22,7 +22,7 @@ env:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: astral-sh/setup-uv@v5
@@ -34,7 +34,7 @@ jobs:
 
   typecheck:
     name: Type Check
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: astral-sh/setup-uv@v5
@@ -45,7 +45,7 @@ jobs:
 
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: astral-sh/setup-uv@v5
@@ -60,7 +60,7 @@ jobs:
 
   validate-manifest:
     name: Validate biffo.plugin.json
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: astral-sh/setup-uv@v5
@@ -100,7 +100,7 @@ jobs:
 
   security-secrets:
     name: Secret Scan
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     permissions:
       contents: read
       pull-requests: read
@@ -108,13 +108,40 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # gitleaks/gitleaks-action@v2 cannot pass here, for two independent
+      # reasons, and a generated plugin repo would be born permanently red:
+      #
+      #   1. On self-hosted runners the scan succeeds and the action then dies
+      #      uploading its SARIF — it assumes a GitHub-hosted $HOME layout, and
+      #      on the AWS fleet the workspace is not under $HOME.
+      #   2. It requires a paid GITLEAKS_LICENSE for organization-owned repos
+      #      (confirmed on tabsii-com/tabsii-platform and tabsii-com/tabsii-crm).
+      #
+      # Install the free, open-source CLI instead — the same approach this
+      # template's own root ci.yml uses. Keep the two in step (issue #649).
+      - name: Install gitleaks
+        run: |
+          curl -sSfL -o gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz -C /usr/local/bin gitleaks
+          gitleaks version
+      # --log-opts is load-bearing (issue #258). gitleaks defaults to `--all`,
+      # so with fetch-depth: 0 the scan reaches commits that exist only on
+      # unmerged branches — one bad commit on anyone's open branch then reddens
+      # every open PR, with nothing in the built ref responsible for it.
+      # Scoping to HEAD does not weaken detection: the full reachable history is
+      # still walked, so a secret committed then removed is still caught.
+      - name: gitleaks git history scan
+        run: gitleaks detect --redact -v --exit-code=2 --log-opts="--full-history HEAD"
+      # Second pass over the working tree. A generated repo's initial commit
+      # contains every skeleton file, so a secret in an unchanged file would
+      # pass the history scan and fail here. Running both closes the gap.
+      - name: gitleaks filesystem scan
+        run: gitleaks detect --no-git --redact -v --exit-code=2
 
   security-deps:
     name: Dependency Audit
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: astral-sh/setup-uv@v5

package/_skeletons/plugin-template/.github/workflows/release.yml

@@ -45,7 +45,7 @@ env:
 jobs:
   release:
     name: Build, Version & Publish
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
     environment:
       name: pypi
       url: https://pypi.org/project/biffo-plugin-example/

package/_skeletons/plugin-template/AGENTS.md

@@ -66,7 +66,24 @@ repo; only its product differs.
   before merge: `git log origin/<branch> -1`. A green PR page is not proof your
   latest local commit reached it.
 
-## 7. Security
+## 7. CI runners — two steps this repo cannot do for itself
+
+The workflows use `runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}`, so they
+work anywhere by default and route to a self-hosted fleet when one exists. Two
+things must be done **outside** this repo before its first run can succeed on a
+fleet:
+
+1. **Set the repo variable `RUNNER_LABEL`** to the fleet's label.
+2. **Grant the runner GitHub App access to this repo.** The scale-up webhook only
+   sees repos the App can see. Without the grant, jobs queue **indefinitely with
+   no error** — and nothing in the UI distinguishes that from a slow runner. The
+   first plugin repo to hit this sat queued for **1h 44m** before anyone noticed
+   (`keiranholloway/biffo-runners#2`).
+
+If a job is queued and nothing is happening, check the grant before anything
+else. It is the failure that looks exactly like patience.
+
+## 8. Security
 
 - **Never commit secrets** (keys, tokens, credentials, `.env` values).
 - **Never silently disable a security gate.** If one must be loosened, do it in

package/_skeletons/plugin-template/pyproject.toml

@@ -52,17 +52,43 @@ packages = ["src/example_plugin"]
 target-version = "py313"
 line-length = 100
 
+# Match the select an instance actually enforces once this plugin is vendored
+# into services/<name>/ — the instance applies it with no third-party carve-out,
+# so a skeleton that is *stricter* makes an author write annotations nobody asked
+# for, and one that is looser lets a plugin pass its own CI and fail the tree it
+# lands in. Keep in step with the template root and biffo-plugin-ideation
+# (issue #650).
+#
+# ANN is deliberately absent for that reason. It is also actively wrong in one
+# place: ANN401 rejects the `Any` in a Pydantic mode="before" validator, which
+# is the one signature where `Any` is genuinely correct.
 [tool.ruff.lint]
-select = ["E", "F", "I", "N", "W", "B", "S", "UP", "ANN"]
+select = ["E", "F", "I", "N", "W", "B", "S", "UP"]
 ignore = [
   "S101", # allow assert in tests
 ]
 
+# FastAPI's dependency-injection defaults are the framework's idiomatic
+# call-in-default pattern, not the B008 mutable-default bug. Without this a
+# plugin cannot write `x = Depends(...)` — the mandatory idiom for any plugin
+# exposing routes — and B008 reddens its CI on the first endpoint it adds.
+[tool.ruff.lint.flake8-bugbear]
+extend-immutable-calls = [
+  "fastapi.Depends",
+  "fastapi.Query",
+  "fastapi.Path",
+  "fastapi.Body",
+  "fastapi.Header",
+  "fastapi.Cookie",
+  "fastapi.Form",
+  "fastapi.File",
+]
+
 [tool.ruff.lint.per-file-ignores]
-# S101: assert is the normal pytest idiom. ANN: test functions don't need
-# return-type annotations. S106: fakes.py's mock BiffoAPIClient(token=...)
-# is a fixed test fixture value, not a real credential.
-"tests/**/*.py" = ["S101", "ANN", "S106"]
+# S101: assert is the normal pytest idiom. S106: fakes.py's mock
+# BiffoAPIClient(token=...) is a fixed test fixture value, not a real
+# credential. (ANN is no longer selected, so it needs no per-file ignore.)
+"tests/**/*.py" = ["S101", "S106"]
 
 [tool.ruff.format]
 quote-style = "double"

package/_skeletons/plugin-template/tests/conftest.py

@@ -1,14 +1,22 @@
-"""Make `example_plugin` and the test-local `fakes` module importable.
+"""Make `example_plugin` and its test-local fakes module importable.
 
 This template is a standalone repo (not part of the biffo-template
 monorepo's uv workspace — see README's "Standalone repo" note), so
 `example_plugin` is installed normally via the project's own
 [build-system]/hatchling config when `uv sync` runs. This conftest only
 needs to put `tests/` itself on sys.path so `tests/test_example_plugin.py`
-can `import fakes` as a plain sibling module (pytest's rootdir insertion
+can import its fakes as a plain sibling module (pytest's rootdir insertion
 already covers this in most configurations, but the explicit path insert
 keeps this working from any cwd, matching the RBAC reference plugin's
 `services/rbac/tests/conftest.py` pattern in the biffo-template monorepo).
+
+The fakes module is named after the plugin (`example_plugin_fakes.py`, which
+scaffolding rewrites per plugin) rather than a bare `fakes.py`. Without
+`__init__.py` here, pytest's prepend import mode imports test modules by bare
+basename, so two vendored plugins both shipping `fakes.py` would fight over the
+top-level module name and one would silently import the other's — which is
+exactly what happened when a second plugin was installed (issue #688). Guarded
+by `cli/src/lib/plugin-skeleton-second-occupant.test.ts`.
 """
 
 import sys

package/_skeletons/plugin-template/tests/test_example_plugin.py

@@ -9,7 +9,7 @@ monorepo.
 from __future__ import annotations
 
 from biffo_plugin_sdk import BiffoEvent
-from fakes import FakeCoreApi
+from example_plugin_fakes import FakeCoreApi
 
 from example_plugin.plugin import _DEFAULT_WIDGET, ExamplePlugin
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.142.1",
+  "version": "0.142.2",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",