@davidvornholt/standards 0.10.1 → 0.10.2

package/README.md

@@ -16,7 +16,7 @@ standards github --apply
 
 `dependabot --write` regenerates the composed `.github/dependabot.yml` from the canonical `.github/dependabot.base.yml` and the optional repo-owned `.github/dependabot.local.yml`; `init` and `sync` do the same automatically. `dependabot --check` verifies the generated file still matches its sources, and `doctor`/`check` include the same verification. The overlay is deliberately lean and additive only: new update blocks for repo-specific ecosystems, top-level private registry definitions, and `ignore` or `registries` entries appended by repeating a canonical block's normalized target. Matching blocks cannot add labels, groups, cooldowns, pull-request limits, or other policy.
 
-`github --check` compares the live GitHub repository (merge settings and rulesets) against the merged declaration in `.github/settings.json` + `.github/settings.local.json`; `github --apply` converges the live repository to exactly the declared state. `check` runs the same comparison whenever `.github/settings.json` is present, and fails closed: declared state the token cannot see fails the gate with a message naming the token fix instead of passing unverified. `--apply` re-diffs the PATCH response, so a setting GitHub accepts with HTTP 200 but silently ignores (plan-unavailable features) is a reported failure, not a false success. A repository whose GitHub plan cannot enforce rulesets can declare that in the seam (see `rulesetEnforcement` below); both commands then skip rulesets and plan-gated repository settings, converge the rest, and print an unprotected-branch notice on every run.
+`github --check` compares the live GitHub repository (merge settings and rulesets) against the merged declaration in `.github/settings.json` + `.github/settings.local.json`; `github --apply` converges the live repository to exactly the declared state. `check` runs the same comparison whenever `.github/settings.json` is present, and fails closed: declared state the token cannot see fails the gate with a message naming the token fix instead of passing unverified. The canonical workflow sets `STANDARDS_SKIP_GITHUB_CHECK=true` only in its unprivileged quality step because its isolated `github-settings` job runs the live comparison with the admin-read token; this is a workflow-internal integration seam, not a general way to disable the local gate. The CLI prints an explicit diagnostic whenever that exact value skips either `check`'s live phase or `github --check`; `github --apply` is never skipped. `--apply` re-diffs the PATCH response, so a setting GitHub accepts with HTTP 200 but silently ignores (plan-unavailable features) is a reported failure, not a false success. A repository whose GitHub plan cannot enforce rulesets can declare that in the seam (see `rulesetEnforcement` below); both commands then skip rulesets and plan-gated repository settings, converge the rest, and print an unprotected-branch notice on every run.
 
 `structure` enforces the canonical monorepo structure contract: workspace scripts (`check-types`, `lint`, `lint:fix`, `test`), root gate scripts, filtered Turbo convenience aliases, internal `0.0.0`/`workspace:*` versioning, package `exports`, shared tsconfig inheritance, and browser a11y wiring. Only a workspace containing an explicit `*.a11y.ts` suite must provide a `test:a11y` script and direct `@axe-core/playwright` and `@playwright/test` dependencies. `check` includes `structure`, so these rules gate every consumer PR.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {

package/src/cli.ts

@@ -54,6 +54,7 @@ const DEFAULT_UPSTREAM = 'github:davidvornholt/standards';
 const HASH_PREVIEW_LENGTH = 12;
 
 const GITHUB_PREFIX = 'github:';
+const SKIP_GITHUB_CHECK_ENV = 'STANDARDS_SKIP_GITHUB_CHECK';
 
 // Never mirrored, even under a managed directory path: build output, VCS
 // metadata, and installed dependencies would otherwise pollute the lock when
@@ -964,13 +965,27 @@ const runCheckCommand = async (consumer: string): Promise<boolean> => {
   // closed: once .github/settings.json exists, an unreachable API or an
   // unreadable origin is a failure, not a skip.
   const githubIsConverged = existsSync(join(consumer, CANONICAL_SETTINGS_FILE))
-    ? await runGithubCheck(consumer)
+    ? await runGithubCheckGate(consumer)
     : true;
   return (
     driftIsClean && integrationIsValid && structureIsValid && githubIsConverged
   );
 };
 
+// The canonical workflow sets this only for its unprivileged quality job,
+// where a separate isolated job runs the same live check with the admin-read
+// token. Absent that exact workflow seam, local and explicit checks remain
+// fail-closed.
+const runGithubCheckGate = (consumer: string): Promise<boolean> => {
+  if (process.env[SKIP_GITHUB_CHECK_ENV] === 'true') {
+    console.log(
+      `standards github: live settings check skipped because ${SKIP_GITHUB_CHECK_ENV}=true; the canonical workflow's isolated github-settings job must own this check`,
+    );
+    return Promise.resolve(true);
+  }
+  return runGithubCheck(consumer);
+};
+
 // Consumer-owned sync policy, checked in next to the canonical (read-only)
 // standards-sync workflow it configures — versioned and reviewable, unlike
 // repository Actions variables. All fields are optional; a missing file means
@@ -1116,7 +1131,7 @@ const runGateCommand = (
   if (command === 'structure') {
     return runStructure(consumer, profile);
   }
-  return apply ? runGithubApply(consumer) : runGithubCheck(consumer);
+  return apply ? runGithubApply(consumer) : runGithubCheckGate(consumer);
 };
 
 const main = async (): Promise<void> => {