@elalfner/relevo 0.4.0 → 0.6.0

package/templates/agents/antigravity-step.yml

@@ -0,0 +1,70 @@
+# What `relevo-go.yml` and `relevo-queue.yml` run when `agent.build` in relevo.yml is `antigravity`. This file is not a
+# workflow: each block below replaces, in the shared workflow, the lines between the markers with the same name, and
+# nothing else of the workflow changes (a test checks it). Edit the shared workflow for anything that is not about the
+# agent. Written for ubuntu-latest (x86-64).
+#
+# What Antigravity CLI cannot do on its own, and what stands in for it (docs/security.md):
+#   turn and token limits  the run guard (scripts/agent-guard.mjs) reads the event stream and stops the agent; the numbers
+#                          are those of relevo.yml (limits.run_max_turns, limits.run_max_tokens)
+#   cost limit             none: the quota and the budget of the Google Cloud project that owns the key are the ceiling.
+#                          Use a key made for Relevo, in its own project, with a quota
+#   refused tools          the agent exits 0 when a tool is refused; the guard reads the refusal and fails the run
+#   closed tool list       the settings file written below: the web is denied and only listed commands are allowed. It is
+#                          a prefix list, not an operating-system boundary: `node` can run any script, as Bash can for Claude
+#   the key                GEMINI_API_KEY is an environment variable of the agent's own commands, so the agent can read it
+#   the binary             pinned by version and sha512 below; to update it, copy the url and the checksum from
+#                          https://antigravity-cli-auto-updater-974169037036.us-central1.run.app/manifests/linux_amd64.json
+
+# relevo:credential begin
+          # Without a model credential the cloud cannot build: the issue stays ready and a comment says to run it locally.
+          HAS_CREDENTIAL: ${{ secrets.GEMINI_API_KEY != '' }}
+# relevo:credential end
+
+# relevo:agent-step begin
+      # Antigravity CLI, at the version and with the checksum written here. The installer script of the vendor takes
+      # the latest version; this takes only the one that was tried.
+      - name: Install the Antigravity CLI
+        env:
+          AGY_VERSION: '1.4.4'
+          AGY_URL: https://storage.googleapis.com/antigravity-public/antigravity-cli/1.4.4-4783783166214144/linux-x64/cli_linux_x64.tar.gz
+          AGY_SHA512: 7ce149d350344c1046c7b59b6659bcc5d659f351bf3a07c6c085887d93427ceb89d927752e4ccd0844b53ffb91d33d6a49f72835ceb276c7cffdd13cfb8023b8
+        run: |
+          curl -fsSL -o "$RUNNER_TEMP/agy.tar.gz" "$AGY_URL"
+          echo "$AGY_SHA512  $RUNNER_TEMP/agy.tar.gz" | sha512sum --check --strict -
+          tar -xzf "$RUNNER_TEMP/agy.tar.gz" -C "$RUNNER_TEMP" antigravity
+          mkdir -p "$HOME/.local/bin"
+          install -m 0755 "$RUNNER_TEMP/antigravity" "$HOME/.local/bin/agy"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          [ "$("$HOME/.local/bin/agy" --version)" = "$AGY_VERSION" ] || { echo "::error::agy is not version $AGY_VERSION"; exit 1; }
+
+      # The Relevo plugin is rendered from the package unpacked in the step "Check the toolchain" and installed for the
+      # machine, so nothing is added to the working tree (the agent needs it clean). The settings of the run go to the
+      # user-level file of the CLI, outside the repository: a pull request cannot loosen them.
+      - name: Set up the Antigravity run
+        env:
+          PLATFORM: ${{ needs.decide.outputs.platform }}
+        run: |
+          for f in scripts/cli.mjs scripts/agent-guard.mjs; do
+            [ -f "$RUNNER_TEMP/relevo/$f" ] || { echo "::error::The Relevo package $RELEVO_VERSION lacks $f"; exit 1; }
+          done
+          node "$RUNNER_TEMP/relevo/scripts/cli.mjs" init --tools antigravity --scope machine --yes
+          node "$RUNNER_TEMP/relevo/scripts/agent-guard.mjs" settings --platform "$PLATFORM" --plugin-root "$RUNNER_TEMP/relevo" --out "$HOME/.gemini/antigravity-cli/settings.json"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # The issue text is data, never instructions: the skill tells the agent so. The decision the `decide` job already
+      # made travels with the prompt, encoded so that the issue title in it is never read as an instruction. Both
+      # values reach the shell as variables, never pasted into the script.
+      - id: agent
+        env:
+          OPENSPEC_TELEMETRY: '0'
+          GH_TOKEN: ${{ github.token }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          DECISION: ${{ needs.decide.outputs.decision_b64 }}
+        run: |
+          node "$RUNNER_TEMP/relevo/scripts/agent-guard.mjs" run \
+            --prompt "/relevo:go $ISSUE --decision $DECISION" \
+            --config relevo.yml --timeout-minutes 50 \
+            --summary "$RUNNER_TEMP/relevo-guard-summary.json" --github-output "$GITHUB_OUTPUT"
+# relevo:agent-step end

package/templates/deploy-supabase.yml

@@ -0,0 +1,75 @@
+name: Deploy Supabase Migrations
+
+# Automatically applies migrations to Supabase Cloud after Relevo pull requests are merged.
+# - Push to base branch ('dev'): deploys to Staging.
+# - Push to release branch ('main'): deploys to Production (under GitHub Environment protection).
+
+on:
+  push:
+    branches:
+      - dev   # Relevo base branch (Staging)
+      - main  # Relevo release branch (Production)
+    paths:
+      - 'supabase/migrations/**'
+      - 'supabase/functions/**'
+      - 'supabase/config.toml'
+  workflow_dispatch:
+
+jobs:
+  deploy-staging:
+    name: Deploy to Staging
+    if: github.ref_name == 'dev'
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Supabase CLI
+        uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      - name: Link and Push Migrations to Staging
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase link --project-ref ${{ secrets.SUPABASE_PROJECT_ID_STAGING }}
+          supabase db push
+
+      - name: Deploy Edge Functions (if present)
+        if: hashFiles('supabase/functions/**') != ''
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase functions deploy
+
+  deploy-production:
+    name: Deploy to Production
+    if: github.ref_name == 'main'
+    runs-on: ubuntu-latest
+    # Configure the 'production' environment in GitHub Settings > Environments with required reviewers
+    # so human approval is mandatory before this job executes.
+    environment: production
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Supabase CLI
+        uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      - name: Link and Push Migrations to Production
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase link --project-ref ${{ secrets.SUPABASE_PROJECT_ID_PROD }}
+          supabase db push
+
+      - name: Deploy Edge Functions (if present)
+        if: hashFiles('supabase/functions/**') != ''
+        env:
+          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+        run: |
+          supabase functions deploy

package/templates/workflows/relevo-digest.yml

@@ -9,7 +9,7 @@ name: relevo-digest
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.4.0'
+  RELEVO_VERSION: '0.6.0'
 
 on:
   schedule:

package/templates/workflows/relevo-go.yml

@@ -15,7 +15,7 @@ name: relevo-go
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.4.0'
+  RELEVO_VERSION: '0.6.0'
 
 on:
   issues:
@@ -82,8 +82,10 @@ jobs:
           GH_LINKS_TOKEN: ${{ secrets.RELEVO_LINKS_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          # relevo:credential begin
           # Without a model credential the cloud cannot build: the issue stays ready and a comment says to run it locally.
           HAS_CREDENTIAL: ${{ secrets.ANTHROPIC_API_KEY != '' || secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+          # relevo:credential end
         run: node .relevo-plugin/scripts/go-plan.mjs --repo "$GITHUB_REPOSITORY" --only "$ISSUE" --apply --claim --credential "$HAS_CREDENTIAL" --github-output "$GITHUB_OUTPUT"
 
       # See the same step in `build`. A failure before the issue is claimed (the plugin cannot be cloned, the
@@ -194,6 +196,7 @@ jobs:
           echo "::error::The runner has no $missing, so nothing was built"
           exit 1
 
+      # relevo:agent-step begin
       - id: agent
         uses: anthropics/claude-code-action@v1
         env:
@@ -233,6 +236,7 @@ jobs:
             --max-budget-usd 5
             --allowedTools "Bash,Read,Write,Edit,Glob,Grep,Task"
             --disallowedTools "WebFetch,WebSearch,Bash(curl:*),Bash(wget:*)"
+      # relevo:agent-step end
 
       # The scripts of the next two steps come from the plugin package. It is unpacked into the workspace only now, after the agent has
       # finished, because the agent's preflight needs a clean working tree and a checkout inside it would not be.

package/templates/workflows/relevo-queue.yml

@@ -10,7 +10,7 @@ name: relevo-queue
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.4.0'
+  RELEVO_VERSION: '0.6.0'
 
 on:
   issues:
@@ -62,8 +62,10 @@ jobs:
           # name, never to write, and an empty value is fine (public repositories are read without it).
           GH_LINKS_TOKEN: ${{ secrets.RELEVO_LINKS_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
+          # relevo:credential begin
           # Without a model credential nothing is dispatched.
           HAS_CREDENTIAL: ${{ secrets.ANTHROPIC_API_KEY != '' || secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+          # relevo:credential end
         run: |
           result=$(node .relevo-plugin/scripts/requeue.mjs --repo "$GITHUB_REPOSITORY" --credential "$HAS_CREDENTIAL")
           echo "$result"

package/templates/workflows/relevo-review.yml

@@ -10,7 +10,7 @@ name: relevo-review
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.4.0'
+  RELEVO_VERSION: '0.6.0'
 
 on:
   pull_request_review:

package/templates/workflows/relevo-sla.yml

@@ -8,7 +8,7 @@ name: relevo-sla
 # The version of @elalfner/relevo whose scripts this workflow runs. The plugin's templates carry the version they
 # were released with, and `/relevo:init` reports this file as different when it is older; change it by hand to update.
 env:
-  RELEVO_VERSION: '0.4.0'
+  RELEVO_VERSION: '0.6.0'
 
 on:
   schedule: