@biffo/cli 0.298.8 → 0.298.10

package/_skeletons/plugin-template/.github/workflows/ci.yml

@@ -85,6 +85,25 @@ jobs:
       # measure.
       - name: Error-branch coverage
         run: uv run python scripts/error_branch_coverage.py --check --coverage coverage.json
+      - name: Routing smoke test — self-test
+        if: ${{ !cancelled() }}
+        # scripts/routing-smoke-test.sh is distributed here too, verbatim,
+        # via shared-files.json's `files` — but a plugin repo has no
+        # deploy.yml and no CDN of its own to smoke-test the way the sibling
+        # skeleton's deploy.yml does post-deploy. Until #1710, that meant
+        # this file had NO caller anywhere in this skeleton's CI, despite
+        # shipping 8 real scenarios (good deploy, CDN no-op, prefix
+        # mismatch, bare-path-broken, unreachable/fail-closed, unset-prefix
+        # fail-closed, unset-base-url fail-closed, root-sibling unproven) —
+        # exactly the #1413 zero-caller shape, invisible to
+        # scripts/guard-self-test-wiring.sh because that audit only reaches
+        # this template repo's own root-level scripts/, never
+        # _skeletons/**. This is that caller, same reasoning as the
+        # Core-revision preflight self-test below: it proves the script
+        # itself still catches the three recorded CDN routing failures and
+        # fails CLOSED when it cannot tell, against a stubbed curl, even
+        # though nothing in this repo ever runs it for a REAL deployment.
+        run: sh scripts/routing-smoke-test.test.sh
       - name: Core-revision preflight — self-test
         if: ${{ !cancelled() }}
         # scripts/core-revision-preflight.sh (biffo-template#1604) is
@@ -100,6 +119,53 @@ jobs:
         # py-dependency-audit.sh already carry as inert-but-verified copies
         # in a Python-only or JS-only sibling.
         run: sh scripts/core-revision-preflight.test.sh
+      - name: Guard self-test wiring — this repo's own scripts/*.test.sh
+        if: ${{ !cancelled() }}
+        # Level-3 self-audit (biffo-template#1710): the template repo's own
+        # scripts/guard-self-test-wiring.sh globs its OWN root-level
+        # scripts/*.test.sh with `find -maxdepth 1`, so it structurally
+        # cannot reach a skeleton's copy of that discipline — which is
+        # exactly how routing-smoke-test.test.sh sat in this file with zero
+        # callers, undetected, until #1710. Rather than teach that script to
+        # walk into _skeletons/** (which would require editing it, and would
+        # still only cover the TEMPLATE repo, never a repo already
+        # scaffolded from this skeleton), this repo checks ITSELF, so a
+        # plugin generated from this skeleton fails closed from birth if a
+        # future *.test.sh guard is added here with no run: line anywhere.
+        # Residual: this step protects repos generated FROM this skeleton
+        # going forward; it does not give biffo-template's own CI a way to
+        # verify a skeleton's wiring before it is ever scaffolded out — that
+        # remains scripts/guard-self-test-wiring.sh's gap, tracked as the
+        # named residual on #1710.
+        run: |
+          set -eu
+          guards=$(find scripts -maxdepth 1 -type f -name '*.test.sh' | sort)
+          if [ -z "$guards" ]; then
+            echo "FAIL: found 0 scripts/*.test.sh — an empty discovery is not a vacuous pass." >&2
+            exit 1
+          fi
+          missing=0
+          for g in $guards; do
+            name=$(basename "$g")
+            found=0
+            for wf in .github/workflows/*.yml .github/workflows/*.yaml; do
+              [ -f "$wf" ] || continue
+              if grep -v '^[[:space:]]*#' "$wf" | grep -q "$name"; then
+                found=1
+              fi
+            done
+            if [ "$found" -eq 1 ]; then
+              echo "OK: $name has a caller in .github/workflows/"
+            else
+              echo "MISSING CALLER: $name has no run: line anywhere in .github/workflows/" >&2
+              missing=1
+            fi
+          done
+          if [ "$missing" -ne 0 ]; then
+            echo "FAIL: at least one scripts/*.test.sh guard has zero callers." >&2
+            exit 1
+          fi
+          echo "PASS: every scripts/*.test.sh guard in this repo has a caller."
       - uses: codecov/codecov-action@v5
         if: always()
         with:

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -259,6 +259,59 @@ jobs:
         # is missing, against a stubbed curl. Without this caller the script
         # is the #1413 zero-caller class the instant it lands.
         run: sh ../../scripts/core-revision-preflight.test.sh
+      - name: Guard self-test wiring — this repo's own scripts/*.test.sh
+        if: ${{ !cancelled() }}
+        working-directory: .
+        # Level-3 self-audit (biffo-template#1710): the template repo's own
+        # scripts/guard-self-test-wiring.sh globs its OWN root-level
+        # scripts/*.test.sh with `find -maxdepth 1`, so it structurally
+        # cannot reach a skeleton's copy of that discipline — which is
+        # exactly how the plugin skeleton's routing-smoke-test.test.sh sat
+        # unwired, undetected, until #1710 (this skeleton's own copy IS
+        # correctly wired above; this step is what keeps the NEXT one from
+        # repeating that). Explicit `working-directory: .` overrides this
+        # job's `defaults.run.working-directory: services/api`, because the
+        # scripts and workflows being audited live at the repo root, not
+        # under services/api. Rather than teach the template's script to
+        # walk into _skeletons/** (which would still only cover the
+        # TEMPLATE repo, never a repo already scaffolded from this
+        # skeleton), this repo checks ITSELF, so a sibling generated from
+        # this skeleton fails closed from birth if a future *.test.sh guard
+        # is added with no run: line anywhere. Residual: this step protects
+        # repos generated FROM this skeleton going forward; it does not
+        # give biffo-template's own CI a way to verify a skeleton's wiring
+        # before it is ever scaffolded out — that remains
+        # scripts/guard-self-test-wiring.sh's gap, tracked as the named
+        # residual on #1710.
+        run: |
+          set -eu
+          guards=$(find scripts -maxdepth 1 -type f -name '*.test.sh' | sort)
+          if [ -z "$guards" ]; then
+            echo "FAIL: found 0 scripts/*.test.sh — an empty discovery is not a vacuous pass." >&2
+            exit 1
+          fi
+          missing=0
+          for g in $guards; do
+            name=$(basename "$g")
+            found=0
+            for wf in .github/workflows/*.yml .github/workflows/*.yaml; do
+              [ -f "$wf" ] || continue
+              if grep -v '^[[:space:]]*#' "$wf" | grep -q "$name"; then
+                found=1
+              fi
+            done
+            if [ "$found" -eq 1 ]; then
+              echo "OK: $name has a caller in .github/workflows/"
+            else
+              echo "MISSING CALLER: $name has no run: line anywhere in .github/workflows/" >&2
+              missing=1
+            fi
+          done
+          if [ "$missing" -ne 0 ]; then
+            echo "FAIL: at least one scripts/*.test.sh guard has zero callers." >&2
+            exit 1
+          fi
+          echo "PASS: every scripts/*.test.sh guard in this repo has a caller."
 
   security-secrets:
     name: Secret Scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.298.8",
+  "version": "0.298.10",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -600,6 +600,49 @@ skip() {
 # inconclusive instead. So the check DOES run, and only a genuine
 # "the binary named in the script is not there" signature in its own output
 # is reclassified -- a real lint/type/format finding still reads as FAILED.
+#
+# ## Why the signature is pnpm's own diagnosis, not a generic shell phrase
+# (biffo-template#1712)
+#
+# The pattern used to also match a plain `sh: 1: <x>: not found$` / bare
+# `command not found` -- generic shell phrasing ANY subprocess a check shells
+# out to can print verbatim while the check itself fails for a real,
+# unrelated reason (a linter reporting on a missing optional plugin binary in
+# the same run where it also reports a genuine lint violation, say). Because
+# the grep runs over the check's WHOLE captured stdout+stderr, that unrelated
+# line was enough to reclassify a real FAILED as INCONCLUSIVE -- discarding
+# the actual finding (the FAILED branch is the only one that prints the
+# tail) and printing "run pnpm install" as the fix for a toolchain that was
+# never missing.
+#
+# It is tempting to narrow this to pnpm's OWN recursive-exec vocabulary --
+# `ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL` / `Command "<x>" not found` -- on the
+# theory that those strings are pnpm's, not a subprocess's. Measured directly
+# against the pnpm this repo actually pins (`packageManager` in
+# package.json, 9.15.9) that theory is false for the #1497 case this file
+# exists to catch: a plain `pnpm run format:check` in a fresh worktree with
+# no `node_modules` prints neither string. It prints `sh: 1: prettier: not
+# found` (the shell's own generic message, exactly the phrase this section
+# is otherwise removing) followed by a line pnpm itself always adds when a
+# script fails with no local `node_modules`:
+#
+#     WARN   Local package.json exists, but node_modules missing, did you mean to install?
+#
+# Confirmed by direct experiment, not by reading pnpm's source: this WARN
+# line appears whenever the invoked script exits non-zero AND node_modules
+# is absent -- regardless of *why* the script failed (a missing binary, or a
+# real assertion failure in a script that needed no installed binary at
+# all) -- and it never appears when node_modules is present, or when the
+# script succeeds. So within THIS elif (already gated on a non-zero exit) it
+# is the precise signal for "this failure happened in a directory this file
+# has already decided (see the `have_script` comment above) it will not
+# pre-flight-refuse to attempt" -- unlike `command not found`/`: not found$`,
+# it is pnpm's own text, never a phrase an unrelated subprocess can emit on
+# its own, so it cannot be tripped by noise elsewhere in the captured
+# output. `ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL` and pnpm's own
+# `Command "<x>" not found` are kept alongside it for the recursive-workspace
+# invocation shape neither this repo's checks nor a direct experiment could
+# exercise, but which the original #1497 report described.
 run_check_js() {
   name="$1"
   shift
@@ -612,7 +655,7 @@ run_check_js() {
     PASSED="$PASSED $name"
     LAST_CHECK_SECONDS=$(($(date +%s) - start))
     printf '  \033[32mOK\033[0m   %-16s %ss\n' "$name" "$LAST_CHECK_SECONDS"
-  elif grep -qE 'ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL|Command "[^"]*" not found|: not found$|command not found' \
+  elif grep -qE 'ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL|Command "[^"]*" not found|node_modules missing, did you mean to install' \
     "/tmp/biffo-verify.$$"; then
     INCONCLUSIVE="$INCONCLUSIVE $name"
     printf '  \033[33mINCONCLUSIVE\033[0m %-16s %ss - dependencies not installed\n' \