@biffo/cli 0.173.4 → 0.174.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/_skeletons/plugin-template/scripts/verify.sh +34 -9
  2. package/_skeletons/sibling-template/scripts/verify.sh +34 -9
  3. package/package.json +1 -1
package/_skeletons/plugin-template/scripts/verify.sh CHANGED
@@ -76,6 +76,31 @@ SKIPPED=""
76
76
 
77
77
  PYTEST="${BIFFO_VERIFY_PYTEST:-}"
78
78
 
79
+ # Does THIS repo's CI run a check of this kind?
80
+ #
81
+ # ## Why every check is gated on this (#861)
82
+ #
83
+ # The standard has said "derived per repo from that repo's ci.yml, not decreed"
84
+ # since it was written. The gate did not do that: it ran a fixed list, and the
85
+ # list was tuned against biffo-template. Every consequence was the same shape,
86
+ # three times in one afternoon:
87
+ #
88
+ # - terraform-fmt over infra/ where CI checks only modules/
89
+ # - bandit over -r services where CI scans only template-owned paths
90
+ # - bandit at all in the plugin repos, whose CI has no bandit step and where
91
+ # the tool is not even installed
92
+ #
93
+ # A gate STRICTER than CI is not a safer gate. It blocks correct work, sends
94
+ # people to read failures CI would never raise, and is exactly what drives
95
+ # BIFFO_SKIP_VERIFY -- a counter-metric H4 pre-registered as refuting itself.
96
+ #
97
+ # With no ci.yml there is nothing to mirror, so everything applicable runs:
98
+ # best-effort beats silence in a repo that has no pipeline to disagree with.
99
+ ci_has() {
100
+ [ -f .github/workflows/ci.yml ] || return 0
101
+ grep -qE "$1" .github/workflows/ci.yml
102
+ }
103
+
79
104
  have_script() {
80
105
  [ -f "$2/package.json" ] || return 1
81
106
  # grep rather than node: --list must work on a machine with no toolchain at
@@ -186,9 +211,9 @@ if [ -n "$PY_DIRS" ]; then
186
211
  suffix=""
187
212
  [ "$d" != "." ] && suffix="(${d#./})"
188
213
  if [ "$d" = "." ]; then
189
- run_check "ruff-check$suffix" uv run ruff check .
190
- run_check "ruff-format$suffix" uv run ruff format --check .
191
- run_check "pyright$suffix" uv run pyright
214
+ ci_has "ruff check" && run_check "ruff-check$suffix" uv run ruff check .
215
+ ci_has "ruff format" && run_check "ruff-format$suffix" uv run ruff format --check .
216
+ ci_has "pyright" && run_check "pyright$suffix" uv run pyright
192
217
  # bandit is NOT excluded: it exits non-zero on findings and it is the
193
218
  # RUN step that fails in CI, not the artefact upload. See the exclusion
194
219
  # audit in verify-parity.test.ts (#855).
@@ -206,17 +231,17 @@ if [ -n "$PY_DIRS" ]; then
206
231
  [ -d services/_plugins ] && bandit_paths="$bandit_paths services/_plugins"
207
232
  [ -z "$bandit_paths" ] && [ -d src ] && bandit_paths="src"
208
233
  # shellcheck disable=SC2086
209
- [ -n "$bandit_paths" ] && run_check "bandit$suffix" uv run bandit -r $bandit_paths -ll -q
234
+ [ -n "$bandit_paths" ] && ci_has "bandit" && run_check "bandit$suffix" uv run bandit -r $bandit_paths -ll -q
210
235
  if [ -n "$PYTEST" ]; then
211
236
  run_check "pytest$suffix" uv run pytest -q
212
237
  else
213
238
  skip "pytest$suffix" "excluded - set BIFFO_VERIFY_PYTEST=1 where the suite is fast"
214
239
  fi
215
240
  else
216
- run_check "ruff-check$suffix" uv run --directory "$d" ruff check .
217
- run_check "ruff-format$suffix" uv run --directory "$d" ruff format --check .
218
- run_check "pyright$suffix" uv run --directory "$d" pyright
219
- run_check "bandit$suffix" uv run --directory "$d" bandit -r src -ll -q
241
+ ci_has "ruff check" && run_check "ruff-check$suffix" uv run --directory "$d" ruff check .
242
+ ci_has "ruff format" && run_check "ruff-format$suffix" uv run --directory "$d" ruff format --check .
243
+ ci_has "pyright" && run_check "pyright$suffix" uv run --directory "$d" pyright
244
+ ci_has "bandit" && run_check "bandit$suffix" uv run --directory "$d" bandit -r src -ll -q
220
245
  if [ -n "$PYTEST" ]; then
221
246
  run_check "pytest$suffix" uv run --directory "$d" pytest -q
222
247
  else
@@ -245,7 +270,7 @@ if [ -n "$LIST" ] || command -v terraform >/dev/null 2>&1; then
245
270
  [ -f biffo.sibling.json ] && [ -d infra ] && tf_dirs="$tf_dirs infra/"
246
271
  if [ -n "$tf_dirs" ]; then
247
272
  # shellcheck disable=SC2086
248
- run_check terraform-fmt terraform fmt -check -recursive $tf_dirs
273
+ ci_has "terraform fmt" && run_check terraform-fmt terraform fmt -check -recursive $tf_dirs
249
274
  else
250
275
  skip terraform-fmt "no terraform in this repo"
251
276
  fi
package/_skeletons/sibling-template/scripts/verify.sh CHANGED
@@ -76,6 +76,31 @@ SKIPPED=""
76
76
 
77
77
  PYTEST="${BIFFO_VERIFY_PYTEST:-}"
78
78
 
79
+ # Does THIS repo's CI run a check of this kind?
80
+ #
81
+ # ## Why every check is gated on this (#861)
82
+ #
83
+ # The standard has said "derived per repo from that repo's ci.yml, not decreed"
84
+ # since it was written. The gate did not do that: it ran a fixed list, and the
85
+ # list was tuned against biffo-template. Every consequence was the same shape,
86
+ # three times in one afternoon:
87
+ #
88
+ # - terraform-fmt over infra/ where CI checks only modules/
89
+ # - bandit over -r services where CI scans only template-owned paths
90
+ # - bandit at all in the plugin repos, whose CI has no bandit step and where
91
+ # the tool is not even installed
92
+ #
93
+ # A gate STRICTER than CI is not a safer gate. It blocks correct work, sends
94
+ # people to read failures CI would never raise, and is exactly what drives
95
+ # BIFFO_SKIP_VERIFY -- a counter-metric H4 pre-registered as refuting itself.
96
+ #
97
+ # With no ci.yml there is nothing to mirror, so everything applicable runs:
98
+ # best-effort beats silence in a repo that has no pipeline to disagree with.
99
+ ci_has() {
100
+ [ -f .github/workflows/ci.yml ] || return 0
101
+ grep -qE "$1" .github/workflows/ci.yml
102
+ }
103
+
79
104
  have_script() {
80
105
  [ -f "$2/package.json" ] || return 1
81
106
  # grep rather than node: --list must work on a machine with no toolchain at
@@ -186,9 +211,9 @@ if [ -n "$PY_DIRS" ]; then
186
211
  suffix=""
187
212
  [ "$d" != "." ] && suffix="(${d#./})"
188
213
  if [ "$d" = "." ]; then
189
- run_check "ruff-check$suffix" uv run ruff check .
190
- run_check "ruff-format$suffix" uv run ruff format --check .
191
- run_check "pyright$suffix" uv run pyright
214
+ ci_has "ruff check" && run_check "ruff-check$suffix" uv run ruff check .
215
+ ci_has "ruff format" && run_check "ruff-format$suffix" uv run ruff format --check .
216
+ ci_has "pyright" && run_check "pyright$suffix" uv run pyright
192
217
  # bandit is NOT excluded: it exits non-zero on findings and it is the
193
218
  # RUN step that fails in CI, not the artefact upload. See the exclusion
194
219
  # audit in verify-parity.test.ts (#855).
@@ -206,17 +231,17 @@ if [ -n "$PY_DIRS" ]; then
206
231
  [ -d services/_plugins ] && bandit_paths="$bandit_paths services/_plugins"
207
232
  [ -z "$bandit_paths" ] && [ -d src ] && bandit_paths="src"
208
233
  # shellcheck disable=SC2086
209
- [ -n "$bandit_paths" ] && run_check "bandit$suffix" uv run bandit -r $bandit_paths -ll -q
234
+ [ -n "$bandit_paths" ] && ci_has "bandit" && run_check "bandit$suffix" uv run bandit -r $bandit_paths -ll -q
210
235
  if [ -n "$PYTEST" ]; then
211
236
  run_check "pytest$suffix" uv run pytest -q
212
237
  else
213
238
  skip "pytest$suffix" "excluded - set BIFFO_VERIFY_PYTEST=1 where the suite is fast"
214
239
  fi
215
240
  else
216
- run_check "ruff-check$suffix" uv run --directory "$d" ruff check .
217
- run_check "ruff-format$suffix" uv run --directory "$d" ruff format --check .
218
- run_check "pyright$suffix" uv run --directory "$d" pyright
219
- run_check "bandit$suffix" uv run --directory "$d" bandit -r src -ll -q
241
+ ci_has "ruff check" && run_check "ruff-check$suffix" uv run --directory "$d" ruff check .
242
+ ci_has "ruff format" && run_check "ruff-format$suffix" uv run --directory "$d" ruff format --check .
243
+ ci_has "pyright" && run_check "pyright$suffix" uv run --directory "$d" pyright
244
+ ci_has "bandit" && run_check "bandit$suffix" uv run --directory "$d" bandit -r src -ll -q
220
245
  if [ -n "$PYTEST" ]; then
221
246
  run_check "pytest$suffix" uv run --directory "$d" pytest -q
222
247
  else
@@ -245,7 +270,7 @@ if [ -n "$LIST" ] || command -v terraform >/dev/null 2>&1; then
245
270
  [ -f biffo.sibling.json ] && [ -d infra ] && tf_dirs="$tf_dirs infra/"
246
271
  if [ -n "$tf_dirs" ]; then
247
272
  # shellcheck disable=SC2086
248
- run_check terraform-fmt terraform fmt -check -recursive $tf_dirs
273
+ ci_has "terraform fmt" && run_check terraform-fmt terraform fmt -check -recursive $tf_dirs
249
274
  else
250
275
  skip terraform-fmt "no terraform in this repo"
251
276
  fi
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@biffo/cli",
3
- "version": "0.173.4",
3
+ "version": "0.174.0",
4
4
  "description": "Biffo project scaffolding CLI",
5
5
  "license": "MIT",
6
6
  "type": "module",