@guilz-dev/sdlc-gh 0.1.0

package/scripts/run-e2e-bench.mjs

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+/**
+ * Run executable acceptance checks for E2E bench tasks.
+ *
+ * This is not yet a full agentic break/fix runner. It validates that each task
+ * has machine-checkable acceptance criteria and that the current fixture/sample
+ * state satisfies them, so the outer loop measures more than file existence.
+ */
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const ROOT = process.cwd();
+const manifestPath = join(ROOT, "evals/e2e-bench/manifest.json");
+const tasksDir = join(ROOT, "evals/e2e-bench/tasks");
+const nodeMajor = Number(process.versions.node.split(".")[0]);
+
+if (!existsSync(manifestPath)) {
+  console.error("Missing evals/e2e-bench/manifest.json");
+  process.exit(1);
+}
+
+function parseSimpleYaml(path) {
+  const out = {};
+  let currentListKey = null;
+  for (const rawLine of readFileSync(path, "utf8").split(/\r?\n/)) {
+    const line = rawLine.replace(/\t/g, "    ");
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+
+    const scalar = line.match(/^([A-Za-z0-9_-]+):\s*(.+)$/);
+    if (scalar) {
+      out[scalar[1]] = scalar[2].trim();
+      currentListKey = null;
+      continue;
+    }
+
+    const listStart = line.match(/^([A-Za-z0-9_-]+):\s*$/);
+    if (listStart) {
+      currentListKey = listStart[1];
+      out[currentListKey] = [];
+      continue;
+    }
+
+    const listItem = line.match(/^\s*-\s+(.+)$/);
+    if (listItem && currentListKey) {
+      out[currentListKey].push(listItem[1].trim());
+      continue;
+    }
+
+    throw new Error(`Unsupported task syntax in ${path}: ${rawLine}`);
+  }
+  return out;
+}
+
+function supportsRequirement(requirement) {
+  if (!requirement) return true;
+  const nodeReq = requirement.match(/^node>=(\d+)$/);
+  if (nodeReq) return nodeMajor >= Number(nodeReq[1]);
+  const cmdReq = requirement.match(/^cmd:(.+)$/);
+  if (cmdReq) {
+    try {
+      execSync(`command -v ${cmdReq[1]}`, {
+        stdio: "pipe",
+        encoding: "utf8",
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+function parseScopedSpec(spec) {
+  const parts = spec.split("::");
+  if (parts.length < 2) {
+    throw new Error(`Invalid verification spec: ${spec}`);
+  }
+  const scope = parts.shift();
+  const payload = parts.join("::");
+  let requirement = null;
+  let cwd = ".";
+  if (scope.includes("@")) {
+    [requirement, cwd] = scope.split("@", 2);
+  } else {
+    cwd = scope;
+  }
+  return {
+    requirement,
+    cwd: cwd === "." ? ROOT : resolve(ROOT, cwd),
+    payload,
+  };
+}
+
+function runCommandSpec(spec, taskId, counters) {
+  const { requirement, cwd, payload } = parseScopedSpec(spec);
+  if (!supportsRequirement(requirement)) {
+    counters.skipped++;
+    console.warn(`::warning::${taskId}: skipped "${payload}" (${requirement} not available)`);
+    return;
+  }
+  execSync(payload, {
+    cwd,
+    stdio: "pipe",
+    encoding: "utf8",
+  });
+  counters.executed++;
+}
+
+function runContainsSpec(spec, taskId, counters, negate = false) {
+  const [file, ...needleParts] = spec.split("::");
+  if (!file || needleParts.length === 0) {
+    throw new Error(`Invalid file assertion spec: ${spec}`);
+  }
+  const needle = needleParts.join("::");
+  const path = resolve(ROOT, file);
+  if (!existsSync(path)) {
+    throw new Error(`${taskId}: missing file for assertion: ${file}`);
+  }
+  const text = readFileSync(path, "utf8");
+  const matched = text.includes(needle);
+  if (negate ? matched : !matched) {
+    throw new Error(
+      `${taskId}: ${negate ? "unexpected" : "missing"} content in ${file}: ${needle}`,
+    );
+  }
+  counters.executed++;
+}
+
+const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+const tasks = manifest.tasks || [];
+let failed = 0;
+let executedChecks = 0;
+let skippedChecks = 0;
+const classCounts = {};
+const stackCounts = {};
+
+for (const entry of tasks) {
+  const id = entry.id;
+  if (!id) {
+    console.error("::error::Manifest task missing id");
+    failed++;
+    continue;
+  }
+
+  try {
+    const taskPath = join(tasksDir, `${id}.yml`);
+    if (!existsSync(taskPath)) {
+      throw new Error(`Missing task file: evals/e2e-bench/tasks/${id}.yml`);
+    }
+
+    const task = parseSimpleYaml(taskPath);
+    for (const field of ["id", "class", "description", "acceptance"]) {
+      if (!task[field] || (Array.isArray(task[field]) && task[field].length === 0)) {
+        throw new Error(`${id}.yml missing ${field}`);
+      }
+    }
+    if (task.id !== entry.id) {
+      throw new Error(`${id}.yml id does not match manifest`);
+    }
+    if (entry.class && task.class !== entry.class) {
+      throw new Error(`${id}.yml class does not match manifest`);
+    }
+    if (entry.stack && task.stack !== entry.stack) {
+      throw new Error(`${id}.yml stack does not match manifest`);
+    }
+
+    classCounts[task.class] = (classCounts[task.class] || 0) + 1;
+    const stackKey = task.stack || entry.stack || "any";
+    stackCounts[stackKey] = (stackCounts[stackKey] || 0) + 1;
+
+    const counters = { executed: 0, skipped: 0 };
+    for (const spec of task.verification_commands || []) {
+      runCommandSpec(spec, id, counters);
+    }
+    for (const spec of task.verification_contains || []) {
+      runContainsSpec(spec, id, counters, false);
+    }
+    for (const spec of task.verification_not_contains || []) {
+      runContainsSpec(spec, id, counters, true);
+    }
+
+    if (counters.executed === 0 && counters.skipped === 0) {
+      throw new Error(`${id}.yml has no executable verification checks`);
+    }
+
+    executedChecks += counters.executed;
+    skippedChecks += counters.skipped;
+    console.log(
+      `E2E ${id}: ok (${counters.executed} check(s) executed${counters.skipped ? `, ${counters.skipped} skipped` : ""})`,
+    );
+  } catch (error) {
+    failed++;
+    console.error(`::error::${error.message}`);
+  }
+}
+
+if (failed > 0) {
+  console.error(`E2E bench failed: ${failed} task(s) invalid or non-compliant`);
+  process.exit(1);
+}
+
+const classSummary = Object.entries(classCounts)
+  .sort(([a], [b]) => a.localeCompare(b))
+  .map(([name, count]) => `${name}=${count}`)
+  .join(", ");
+const stackSummary = Object.entries(stackCounts)
+  .sort(([a], [b]) => a.localeCompare(b))
+  .map(([name, count]) => `${name}=${count}`)
+  .join(", ");
+
+console.log(`E2E by class: ${classSummary || "none"}`);
+console.log(`E2E by stack: ${stackSummary || "none"}`);
+console.log(
+  `E2E bench: ${tasks.length} task(s), ${executedChecks} executed, ${skippedChecks} skipped`,
+);

package/scripts/sdlc-gh-cli.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const WIZARD = join(PACKAGE_ROOT, "scripts/setup-wizard.mjs");
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+function printHelp() {
+  console.log(`sdlc-gh — GitHub Copilot agent harness installer
+
+Usage:
+  npx @guilz-dev/sdlc-gh [init] [wizard options]
+  npx @guilz-dev/sdlc-gh --help
+
+Runs the interactive setup wizard: bootstrap (if needed), GitHub labels/rulesets,
+and doctor --strict.
+
+Examples:
+  cd /path/to/your-product && npx @guilz-dev/sdlc-gh
+  npx @guilz-dev/sdlc-gh init --yes --stack ts --codeowners @acme/platform
+  npx @guilz-dev/sdlc-gh init --repo /path/to/repo --mode existing --skip-github
+
+Wizard options (forwarded):
+  --repo <path>              Target repository (default: git root or cwd)
+  --stack ts|python|go|...   Primary stack
+  --codeowners @org/team     CODEOWNERS owner
+  --github-repo owner/name   GitHub repository for setup-github
+  --mode new|existing        Bootstrap mode when harness is missing
+  --skip-github              Local files only
+  --with-eval-ruleset        Also apply harness-pr-eval-required ruleset
+  --yes                      Non-interactive
+  --dry-run                  Print plan only
+
+Requires Node.js 22+, bash, git, and \`gh\` (authenticated) for GitHub setup.
+macOS / Linux / WSL recommended (bootstrap uses bash).
+`);
+}
+
+function parseCliArgs(argv) {
+  if (argv.length === 0) {
+    return { command: "init", wizardArgs: [] };
+  }
+
+  const first = argv[0];
+  if (first === "--help" || first === "-h") {
+    return { command: "help", wizardArgs: [] };
+  }
+  if (first === "init") {
+    return { command: "init", wizardArgs: argv.slice(1) };
+  }
+  if (first.startsWith("-")) {
+    return { command: "init", wizardArgs: argv };
+  }
+
+  fail(`Unknown command: ${first}. Run \`npx @guilz-dev/sdlc-gh --help\`.`);
+}
+
+function main() {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0], 10);
+  if (nodeMajor < 22) {
+    fail(`Node.js 22+ required (current: ${process.versions.node}).`);
+  }
+
+  const { command, wizardArgs } = parseCliArgs(process.argv.slice(2));
+  if (command === "help") {
+    printHelp();
+    process.exit(0);
+  }
+
+  const result = spawnSync(
+    process.execPath,
+    [WIZARD, "--template-root", PACKAGE_ROOT, ...wizardArgs],
+    {
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        SDLCGH_TEMPLATE_ROOT: PACKAGE_ROOT,
+      },
+    },
+  );
+
+  process.exit(result.status ?? 1);
+}
+
+main();

package/scripts/select-eval-jobs.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+/** Select eval jobs based on changed files (arch §5.2.1) */
+import { execSync } from "node:child_process";
+import { appendFileSync } from "node:fs";
+
+const base = process.env.BASE_SHA || "origin/main";
+let files = [];
+try {
+  files = execSync(
+    `git diff --name-only ${base}...HEAD 2>/dev/null || git diff --name-only HEAD~1`,
+    { encoding: "utf8" },
+  )
+    .trim()
+    .split("\n")
+    .filter(Boolean);
+} catch {
+  console.warn("::warning::Could not determine changed files; defaulting to trajectory-conventions");
+}
+
+const jobs = new Set();
+
+if (files.some((f) => /^prompts\/.*\.prompt\.yml$/.test(f))) jobs.add("prompt-eval");
+if (files.some((f) => f.startsWith(".github/agents/"))) {
+  jobs.add("prompt-eval");
+  jobs.add("agent-policy");
+}
+if (files.some((f) => f.startsWith(".github/instructions/") || f === "AGENTS.md")) {
+  jobs.add("trajectory-conventions");
+}
+if (files.some((f) => f.startsWith(".github/skills/"))) jobs.add("trajectory-task");
+if (files.some((f) => f.startsWith("evals/"))) jobs.add("meta-eval");
+
+// Path-filtered workflow with no matching files (e.g. copilot-instructions only)
+if (jobs.size === 0) jobs.add("trajectory-conventions");
+
+const out = process.env.GITHUB_OUTPUT;
+if (out) {
+  appendFileSync(out, `jobs=${[...jobs].join(",")}\n`);
+} else {
+  console.log([...jobs].join(","));
+}

package/scripts/setup-github.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import readline from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { buildEvalRulesetPayload, buildRulesetPayload, loadLabels } from "./lib/github-config.mjs";
+import { resolveStackId } from "./lib/doctor-local.mjs";
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+function run(cmd, args, options = {}) {
+  const stdin = Object.prototype.hasOwnProperty.call(options, "input") ? "pipe" : "inherit";
+  const result = spawnSync(cmd, args, {
+    encoding: "utf8",
+    stdio: [stdin, "pipe", "pipe"],
+    ...options,
+  });
+  if (result.status !== 0) {
+    const stderr = result.stderr?.trim();
+    if (stderr) console.error(stderr);
+    process.exit(result.status ?? 1);
+  }
+  return result.stdout.trim();
+}
+
+function hasGh() {
+  return spawnSync("gh", ["--version"], { stdio: "ignore" }).status === 0;
+}
+
+function ensureGhAuth() {
+  const auth = spawnSync("gh", ["auth", "status"], { stdio: "ignore" });
+  if (auth.status !== 0) {
+    fail("gh is not authenticated. Run `gh auth login`, then retry. Manual fallback: import .github/ruleset.example.json and apply labels from .github/labels.yml.");
+  }
+}
+
+function parseArgs(argv) {
+  const args = { githubRepo: "", yes: false, dryRun: false, withEvalRuleset: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const value = argv[i];
+    if (value === "--github-repo") {
+      args.githubRepo = argv[i + 1] ?? "";
+      i += 1;
+    } else if (value === "--yes") {
+      args.yes = true;
+    } else if (value === "--dry-run") {
+      args.dryRun = true;
+    } else if (value === "--with-eval-ruleset") {
+      args.withEvalRuleset = true;
+    } else {
+      fail(`Unknown argument: ${value}`);
+    }
+  }
+  return args;
+}
+
+function resolveRepoRoot() {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return process.cwd();
+  }
+}
+
+function resolveGithubRepo(repoRoot, explicitRepo) {
+  if (explicitRepo) return explicitRepo;
+  const result = spawnSync("gh", ["repo", "view", "--json", "nameWithOwner"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.status !== 0) {
+    fail("Unable to determine GitHub repository. Re-run with `--github-repo owner/name`.");
+  }
+  const parsed = JSON.parse(result.stdout);
+  return parsed.nameWithOwner;
+}
+
+async function confirm(summary, yes) {
+  if (yes) return;
+  console.log(summary);
+  const rl = readline.createInterface({ input, output });
+  const answer = await rl.question("Proceed? [y/N]: ");
+  rl.close();
+  if (!/^(y|yes)$/i.test(answer)) {
+    console.log("Cancelled.");
+    process.exit(1);
+  }
+}
+
+function syncLabels(repoRoot, githubRepo, dryRun) {
+  const labels = loadLabels(join(repoRoot, ".github/labels.yml"));
+  for (const label of labels) {
+    const encodedName = encodeURIComponent(label.name);
+    const payload = JSON.stringify({
+      new_name: label.name,
+      color: label.color,
+      description: label.description,
+    });
+
+    if (dryRun) {
+      console.log(`[dry-run] label ${label.name}: PATCH/POST repos/${githubRepo}/labels`);
+      continue;
+    }
+
+    const probe = spawnSync("gh", ["api", `repos/${githubRepo}/labels/${encodedName}`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+
+    if (probe.status === 0) {
+      run("gh", [
+        "api",
+        "--method",
+        "PATCH",
+        `repos/${githubRepo}/labels/${encodedName}`,
+        "--input",
+        "-",
+      ], { input: payload });
+    } else {
+      run("gh", [
+        "api",
+        "--method",
+        "POST",
+        `repos/${githubRepo}/labels`,
+        "--input",
+        "-",
+      ], { input: JSON.stringify({ name: label.name, color: label.color, description: label.description }) });
+    }
+  }
+}
+
+function resolveExistingRulesetId(githubRepo, name) {
+  const output = run("gh", ["api", `repos/${githubRepo}/rulesets`]);
+  const rulesets = JSON.parse(output);
+  const match = rulesets.find((ruleset) => ruleset.name === name);
+  return match?.id ?? null;
+}
+
+function applyRuleset(repoRoot, githubRepo, dryRun, { templateName, buildPayload }) {
+  const templatePath = join(repoRoot, `.github/${templateName}`);
+  const payload = buildPayload(templatePath);
+  const rulesetId = dryRun ? null : resolveExistingRulesetId(githubRepo, payload.name);
+  const tempDir = mkdtempSync(join(tmpdir(), "sdlc-gh-ruleset-"));
+  const tempFile = join(tempDir, "ruleset.json");
+  writeFileSync(tempFile, JSON.stringify(payload, null, 2));
+
+  try {
+    if (dryRun) {
+      console.log(`[dry-run] ruleset "${payload.name}" for ${githubRepo}`);
+      console.log(readFileSync(tempFile, "utf8"));
+      return;
+    }
+
+    if (rulesetId) {
+      run("gh", [
+        "api",
+        "--method",
+        "PUT",
+        `repos/${githubRepo}/rulesets/${rulesetId}`,
+        "--input",
+        tempFile,
+      ]);
+    } else {
+      run("gh", [
+        "api",
+        "--method",
+        "POST",
+        `repos/${githubRepo}/rulesets`,
+        "--input",
+        tempFile,
+      ]);
+    }
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
+function applyMainRuleset(repoRoot, githubRepo, stackId, dryRun) {
+  applyRuleset(repoRoot, githubRepo, dryRun, {
+    templateName: "ruleset.example.json",
+    buildPayload: (templatePath) => buildRulesetPayload(templatePath, stackId),
+  });
+}
+
+function applyEvalRuleset(repoRoot, githubRepo, dryRun) {
+  applyRuleset(repoRoot, githubRepo, dryRun, {
+    templateName: "ruleset.harness-eval.example.json",
+    buildPayload: (templatePath) => buildEvalRulesetPayload(templatePath),
+  });
+}
+
+const args = parseArgs(process.argv.slice(2));
+const repoRoot = resolveRepoRoot();
+const stackFile = join(repoRoot, ".harness-stack");
+const stackFromFile = existsSync(stackFile) ? readFileSync(stackFile, "utf8").trim() : "";
+const stackId = resolveStackId(repoRoot);
+if (stackFromFile && !stackId) {
+  fail(`Invalid ${stackFile} value: ${stackFromFile}. Run setup-wizard/bootstrap to set a supported stack id.`);
+}
+if (!stackId) {
+  fail(
+    `Unable to resolve stack id. Set ${stackFile} or keep exactly one .github/workflows/product-ci-*.yml in this repository.`,
+  );
+}
+if (!stackFromFile) {
+  console.log(`Info: ${stackFile} is missing; inferred stack=${stackId} from product-ci workflow.`);
+}
+
+if (!hasGh()) {
+  fail("gh is required. Install it, run `gh auth login`, then retry. Manual fallback: import .github/ruleset.example.json and apply labels from .github/labels.yml.");
+}
+ensureGhAuth();
+
+const githubRepo = resolveGithubRepo(repoRoot, args.githubRepo);
+const actions = [
+  "sync labels via API",
+  "create/update main-protection ruleset",
+];
+if (args.withEvalRuleset) {
+  actions.push("create/update harness-pr-eval-required ruleset (optional)");
+}
+await confirm(
+  `GitHub setup summary\n  repo: ${repoRoot}\n  github repo: ${githubRepo}\n  stack: ${stackId}\n  actions: ${actions.join(", ")}`,
+  args.yes,
+);
+
+syncLabels(repoRoot, githubRepo, args.dryRun);
+applyMainRuleset(repoRoot, githubRepo, stackId, args.dryRun);
+if (args.withEvalRuleset) {
+  applyEvalRuleset(repoRoot, githubRepo, args.dryRun);
+}
+
+console.log(args.dryRun ? "Dry run complete." : "GitHub setup complete.");

package/scripts/setup-github.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+exec node "$SCRIPT_DIR/setup-github.mjs" "$@"