@grimoire-rs/indexer 0.2.2 → 0.3.1

package/templates/github-validate.yml

@@ -1,51 +0,0 @@
-# Contribution gate for pull requests against this index.
-#
-# Exit 0 = eligible for auto-merge, non-zero = manual review required. To
-# enforce it, require the status check named `validate / validate` in branch
-# protection — NOT `validate`. A thin caller reports its check run as
-# `<job key here> / <job key in the called workflow>`, and both happen to be
-# `validate`; rename `jobs.validate` below and the required context moves
-# with it. Requiring a context that never reports blocks every PR forever,
-# and looks exactly like the gate rejecting the contribution.
-#
-# `pull_request_target` is deliberate and safe HERE, and only because of
-# what the called workflow does: it runs grim-indexer from npm against the
-# trusted base checkout, and reads the PR head as data in a separate
-# directory without ever executing, importing, or installing from it. The
-# gate needs a forge token to resolve numeric namespace-owner ids, which an
-# unprivileged `pull_request` job does not have.
-#
-# Do not switch this to run contributor code, and do not widen
-# `permissions:` here.
-#
-# This gate covers third-party contributions. It does NOT cover an announce
-# your own CI makes (the `--with-skills` layout, where this repo publishes
-# into its own index): GitHub runs no workflows on a PR opened with
-# `secrets.GITHUB_TOKEN`, so `grim publish --announce` from CI lands an
-# effectively ungated PR — review it by hand. That PR also needs "Allow
-# GitHub Actions to create and approve pull requests" (Settings → Actions)
-# turned on, off by default; without it grim only pushes the branch and
-# reports `outcome: "branch-pushed"`. Enabling it lets any workflow in this
-# repo approve PRs too, so weigh it against your branch protection.
-#
-# Deliberately a thin caller: the job logic lives in a reusable workflow
-# grim-indexer owns, so upgrades arrive by bumping the pinned ref below
-# instead of re-scaffolding this repo over your edits.
-name: validate
-
-on:
-  pull_request_target:
-    paths:
-      - "index/**"
-      - "index-policy.json"
-
-permissions: {}
-
-jobs:
-  validate:
-    uses: grimoire-rs/indexer/.github/workflows/index-validate.yml@{{ref}}
-    permissions:
-      contents: read
-      pull-requests: read
-    with:
-      grim-indexer-version: "{{version}}"

package/templates/gitlab-ci.yml

@@ -1,13 +0,0 @@
-# Builds this index for GitLab Pages and gates merge requests.
-#
-# Deliberately a thin caller: the job logic lives in a file grim-indexer
-# owns, so upgrades arrive by bumping the pinned ref in the URL below
-# instead of re-scaffolding this repo over your edits.
-#
-# If your GitLab instance blocks remote includes, vendor the file locally
-# and switch to `- local: "ci/grim-indexer.yml"`.
-include:
-  - remote: "https://raw.githubusercontent.com/grimoire-rs/indexer/{{ref}}/templates/reusable/gitlab-index-ci.yml"
-
-variables:
-  GRIM_INDEXER_VERSION: "{{version}}"

package/templates/reusable/gitlab-index-ci.yml

@@ -1,125 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-# Copyright 2026 The Grimoire Authors
-#
-# GitLab counterpart of the two reusable GitHub workflows: scaffolded index
-# repos pull this in with `include: remote:` so a fix here reaches them
-# without a re-scaffold. Override any variable below in the including
-# `.gitlab-ci.yml`.
-#
-# A private GitLab instance may refuse to fetch a remote include. The
-# fallback is to vendor this file into the index repo and switch the
-# include to `local:`.
-variables:
-  GRIM_INDEXER_VERSION: "latest"
-  GRIM_INDEXER_NODE_IMAGE: "node:22-alpine"
-  GRIM_INDEXER_OUT_DIR: "public"
-  # Refresh READMEs, changelogs, logos and version lists from the registry
-  # before building. Set to "false" for a pointers-only site that never
-  # leaves the runner.
-  GRIM_INDEXER_ENRICH: "true"
-  # grim release the enrichment step reads the registry with: "latest" or a tag.
-  GRIM_VERSION: "latest"
-
-stages:
-  - test
-  - deploy
-
-# Contribution gate. Exit 0 = eligible for auto-merge, non-zero = manual
-# review required, so this job's status IS the gate.
-#
-# The gate must judge the change against the COMMITTED policy, not the
-# policy the merge request proposes — otherwise a contributor allowlists
-# their own registry host in the same MR. So the target branch is checked
-# out into a sibling worktree and passed as `--root`, with the MR head
-# passed as `--pr-tree` and read as data only.
-#
-# RESIDUAL, and it is not fixable from this file: on GitLab the merge
-# request supplies its own `.gitlab-ci.yml`, so a contributor can delete
-# this job outright. Enforce it instance-side — a compliance pipeline, a
-# required merge check, or protected-branch approval rules — or treat the
-# GitLab gate as advisory.
-grim-indexer:validate:
-  stage: test
-  image: $GRIM_INDEXER_NODE_IMAGE
-  variables:
-    GIT_DEPTH: 0
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-  # The job image is picked for `npx`, and `node:*-alpine` ships no git —
-  # but this job diffs the merge request against its target branch, so git
-  # is not optional. GitLab's runner clones with a separate helper image, so
-  # nothing else puts git in here. Install it for whichever package manager
-  # the (overridable) image has.
-  #
-  # The trailing check is the load-bearing part: the gate's contract is
-  # "exit 0 = eligible for auto-merge", so a missing or failed-to-install
-  # tool must fail the job, never silently skip validation.
-  before_script:
-    - |
-      set -eu
-      if ! command -v git >/dev/null 2>&1; then
-        if command -v apk >/dev/null 2>&1; then
-          apk add --no-cache git
-        elif command -v apt-get >/dev/null 2>&1; then
-          apt-get update -qq && apt-get install -y -qq --no-install-recommends git
-        fi
-      fi
-      command -v git >/dev/null 2>&1 || {
-        echo "grim-indexer: the gate needs git, and ${GRIM_INDEXER_NODE_IMAGE} has none" >&2
-        exit 1
-      }
-  script:
-    - |
-      set -eu
-      git fetch --quiet origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
-      git worktree add --detach ../base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
-      # Every changed path, with no pathspec and no diff filter: rejecting an
-      # out-of-bounds path is the gate's first job, and it ownership-checks a
-      # deletion before allowing it. Narrowing to `-- index` would let an MR
-      # that adds a valid entry and edits this very file pass; dropping `D`
-      # would let one that deletes a stranger's entry pass.
-      git diff --name-only "$CI_MERGE_REQUEST_DIFF_BASE_SHA" HEAD > changed.txt
-      xargs -a changed.txt npx --yes "@grimoire-rs/indexer@$GRIM_INDEXER_VERSION" validate \
-        --forge gitlab --root ../base --pr-tree .
-
-# GitLab Pages serves whatever the `pages` job leaves in `public/`.
-pages:
-  stage: deploy
-  image: $GRIM_INDEXER_NODE_IMAGE
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-  # The index stores pointers; README, changelog, logo and version list all
-  # live in the registry, and grim is what reads a registry. Best-effort by
-  # design — a registry outage degrades the site to pointers-only rather than
-  # blocking a deploy, so the failure is logged and the build continues.
-  #
-  # Nothing is committed and no token is involved: the sidecars live only in
-  # this job's workspace, which is why this needs no CI variables at all.
-  script:
-    - |
-      set -eu
-      if [ "$GRIM_INDEXER_ENRICH" = "true" ]; then
-        if command -v apk >/dev/null 2>&1; then
-          apk add --no-cache curl tar
-        elif command -v apt-get >/dev/null 2>&1; then
-          apt-get update -qq && apt-get install -y -qq --no-install-recommends curl tar ca-certificates
-        fi
-        # Alpine is musl; everything else here is glibc.
-        if [ -f /etc/alpine-release ]; then libc=musl; else libc=gnu; fi
-        case "$GRIM_VERSION" in
-          latest) base=https://github.com/grimoire-rs/grimoire/releases/latest/download ;;
-          *) base="https://github.com/grimoire-rs/grimoire/releases/download/$GRIM_VERSION" ;;
-        esac
-        tarball="grimoire-$(uname -m)-unknown-linux-$libc.tar.gz"
-        tmp="$(mktemp -d)"
-        ( cd "$tmp" \
-          && curl -fsSL --proto '=https' --tlsv1.2 -O "$base/$tarball" -O "$base/$tarball.sha256" \
-          && sha256sum -c "$tarball.sha256" \
-          && tar -xzf "$tarball" -C /usr/local/bin --strip-components=1 "${tarball%.tar.gz}/grim" ) \
-          && npx --yes "@grimoire-rs/indexer@$GRIM_INDEXER_VERSION" enrich \
-          || echo "warning: enrich failed — building without READMEs, logos and version lists"
-      fi
-    - npx --yes "@grimoire-rs/indexer@$GRIM_INDEXER_VERSION" build --out-dir "$GRIM_INDEXER_OUT_DIR"
-  artifacts:
-    paths:
-      - $GRIM_INDEXER_OUT_DIR