@grimoire-rs/indexer 0.1.2 → 0.1.3

package/README.md

@@ -53,9 +53,13 @@ is deliberately no component-override API yet — publishing one would
 freeze a prop contract per slot, and that is not a promise worth making
 this early.
 
-> **Do not use `0.1.0`.** npm silently stripped its `bin` entry at publish
-> time, so that version installs without an executable. Use `0.1.1` or
-> later.
+> **Use `0.1.3` or later.** `0.1.0` installs without an executable — npm
+> silently stripped its `bin` entry at publish time. `0.1.1` and `0.1.2`
+> scaffold CI that points at reusable workflows those tags do not contain,
+> so the first push to a scaffolded index fails before any job runs. An
+> index already scaffolded against `0.1.1`/`0.1.2` is fixed by bumping the
+> `@v0.1.x` refs in `.github/workflows/{pages,validate}.yml` — no
+> re-scaffold needed.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grimoire-rs/indexer",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "CLI + Astro integration for running your own grim package index",
   "type": "module",
   "license": "Apache-2.0",

package/templates/reusable/index-pages.yml

@@ -1,80 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-# Copyright 2026 The Grimoire Authors
-#
-# Reusable workflow: build a grimoire index repo and publish it to GitHub
-# Pages. Scaffolded index repos call this by ref rather than inlining the
-# job logic, so a fix here reaches every downstream index without anyone
-# re-running `grim-indexer init` over their edits. Renovate's built-in
-# `github-actions` manager bumps the pinned ref in each caller.
-#
-# Copy this file to `.github/workflows/index-pages.yml` in this repo — a
-# reusable workflow must live directly in `.github/workflows/`, GitHub does
-# not resolve subdirectories.
-name: grim-indexer pages
-
-on:
-  workflow_call:
-    inputs:
-      node-version:
-        description: Node.js version used to run grim-indexer.
-        type: string
-        required: false
-        default: "22"
-      grim-indexer-version:
-        description: npm version or range of grim-indexer to run.
-        type: string
-        required: false
-        default: latest
-      out-dir:
-        description: Directory `grim-indexer build` writes the site into.
-        type: string
-        required: false
-        default: dist
-
-permissions: {}
-
-concurrency:
-  group: grim-indexer-pages
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ inputs.node-version }}
-
-      # Inputs reach the shell through env vars, never through `run:`
-      # interpolation — a caller-supplied value must not be able to close
-      # the quoting and append a command.
-      - name: Build index
-        env:
-          VERSION: ${{ inputs.grim-indexer-version }}
-          OUT_DIR: ${{ inputs.out-dir }}
-        run: npx --yes "@grimoire-rs/indexer@${VERSION}" build --out-dir "${OUT_DIR}"
-
-      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-
-      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-        with:
-          path: ${{ inputs.out-dir }}
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      pages: write
-      id-token: write
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

package/templates/reusable/index-validate.yml

@@ -1,88 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-# Copyright 2026 The Grimoire Authors
-#
-# Reusable workflow: the contribution gate for an index repo.
-#
-# Runs from the TRUSTED base checkout under `pull_request_target`, because
-# the gate needs a forge token to resolve numeric namespace-owner ids. The
-# PR head is checked out into a SEPARATE directory and consumed as DATA
-# ONLY — nothing in it is executed, imported, installed, or interpolated
-# into a command. `@grimoire-rs/indexer` itself comes from npm, never from the PR.
-#
-# Do not add a `run:` step that touches `pr-tree/`, and never add
-# `npm ci`/`npm install` — that would execute contributor code with a
-# write-capable token.
-#
-# The gate contract is the exit code of `grim-indexer validate`:
-#   0        -> eligible for auto-merge
-#   non-zero -> manual review required
-# so this job's success/failure IS the gate. Branch protection on the
-# calling repo turns that into a merge decision.
-#
-# Copy this file to `.github/workflows/index-validate.yml` in this repo — a
-# reusable workflow must live directly in `.github/workflows/`, GitHub does
-# not resolve subdirectories.
-name: grim-indexer validate
-
-on:
-  workflow_call:
-    inputs:
-      node-version:
-        description: Node.js version used to run grim-indexer.
-        type: string
-        required: false
-        default: "22"
-      grim-indexer-version:
-        description: npm version or range of grim-indexer to run.
-        type: string
-        required: false
-        default: latest
-
-permissions: {}
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-    steps:
-      # Trusted: the committed state the PR proposes to change.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      # Untrusted: PR head, as data. `persist-credentials: false` keeps a
-      # token out of the tree the contributor controls.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: pr-tree
-          persist-credentials: false
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ inputs.node-version }}
-
-      # Changed paths come from the API, not from a diff of the untrusted
-      # tree. `jq -r` output is written to a file and passed via `xargs -a`
-      # so a crafted filename can never reach the shell as syntax.
-      - name: Collect changed paths
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-          gh api --paginate "repos/${REPO}/pulls/${PR}/files" \
-            --jq '.[] | select(.status != "removed") | .filename' \
-            | grep -E '^index/' > changed.txt || : > changed.txt
-
-      - name: Validate contribution
-        env:
-          VERSION: ${{ inputs.grim-indexer-version }}
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          xargs -a changed.txt npx --yes "@grimoire-rs/indexer@${VERSION}" validate \
-            --forge github --root . --pr-tree pr-tree