@guilz-dev/sdlc-gh 0.1.0

package/.github/workflows/harness-ci.yml

@@ -0,0 +1,244 @@
+name: Harness CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  harness-static:
+    name: harness-static
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Validate harness assets
+        run: node scripts/validate-harness.mjs
+
+      - name: Install actionlint
+        run: |
+          bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          # gh-aw compiled *.lock.yml stubs are Phase 3 placeholders; lint active workflows only.
+          find .github/workflows -maxdepth 1 -name '*.yml' ! -name '*.lock.yml' -print0 \
+            | xargs -0 -r ./actionlint -color
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install zizmor
+        run: pip install zizmor
+
+      - name: Run zizmor
+        run: |
+          find .github/workflows -maxdepth 1 -name '*.yml' ! -name '*.lock.yml' -print0 \
+            | xargs -0 -r zizmor --offline --min-severity high
+
+      - name: Hooks scenario tests
+        run: node scripts/test-hooks-scenarios.mjs
+
+      - name: Issue-spec scenario tests
+        run: node scripts/test-issue-spec-scenarios.mjs
+
+      - name: Issue form label sync scenario tests
+        run: node scripts/test-issue-form-label-sync-scenarios.mjs
+
+      - name: Diff-size scenario tests
+        run: node scripts/test-diff-size-scenarios.mjs
+
+      - name: E2E manifest scenario tests
+        run: node scripts/test-e2e-manifest-scenarios.mjs
+
+      - name: GitHub setup scenario tests
+        run: node scripts/test-setup-github-scenarios.mjs
+
+      - name: Doctor scenario tests
+        run: node scripts/test-doctor-scenarios.mjs
+
+      - name: Telemetry artifact scenario tests
+        run: node scripts/test-telemetry-artifact-scenarios.mjs
+
+      - name: Harness review scenario tests
+        run: node scripts/test-harness-review-scenarios.mjs
+
+      - name: Harness review routing scenario tests
+        run: node scripts/test-harness-review-routing-scenarios.mjs
+
+      - name: gh-aw dogfood scenario tests
+        run: node scripts/test-gh-aw-dogfood-scenarios.mjs
+
+  issue-spec-check:
+    name: issue-spec-check
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Validate linked Issue CC-SD contract
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          GH_TOKEN: ${{ github.token }}
+        run: node scripts/check-issue-spec.mjs
+
+  open-pr-limit:
+    name: open-pr-limit
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check open PR limit
+        env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          GH_TOKEN: ${{ github.token }}
+        run: node scripts/check-open-pr-limit.mjs
+
+  diff-size:
+    name: diff-size
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Diff size and autonomy gate
+        env:
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          BASE_SHA: origin/${{ github.base_ref }}
+          # Template default: warn-only for L1. Opt in to hard-fail when ready (Phase 4):
+          # DIFF_SIZE_L1_HARD_FAIL: "1"
+        run: node scripts/check-diff-size.mjs
+
+  detect-projects:
+    name: detect-projects
+    needs: harness-static
+    runs-on: ubuntu-latest
+    outputs:
+      ts: ${{ steps.detect.outputs.ts }}
+      python: ${{ steps.detect.outputs.python }}
+      go: ${{ steps.detect.outputs.go }}
+      ruby: ${{ steps.detect.outputs.ruby }}
+      php: ${{ steps.detect.outputs.php }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: detect
+        shell: bash
+        run: |
+          if [[ -f sample/ts/package.json || -f package.json ]]; then
+            echo "ts=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ts=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -f sample/python/requirements-dev.txt || -f requirements-dev.txt ]]; then
+            echo "python=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "python=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -f sample/go/go.mod || -f go.mod ]]; then
+            echo "go=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "go=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -f sample/ruby/Gemfile || -f Gemfile ]]; then
+            echo "ruby=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ruby=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -f sample/php/composer.json || -f composer.json ]]; then
+            echo "php=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "php=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  product-ts:
+    name: product-ci-ts
+    needs: detect-projects
+    if: needs.detect-projects.outputs.ts == 'true'
+    uses: ./.github/workflows/product-ci-ts.yml
+
+  product-python:
+    name: product-ci-python
+    needs: detect-projects
+    if: needs.detect-projects.outputs.python == 'true'
+    uses: ./.github/workflows/product-ci-python.yml
+
+  product-go:
+    name: product-ci-go
+    needs: detect-projects
+    if: needs.detect-projects.outputs.go == 'true'
+    uses: ./.github/workflows/product-ci-go.yml
+
+  product-ruby:
+    name: product-ci-ruby
+    needs: detect-projects
+    if: needs.detect-projects.outputs.ruby == 'true'
+    uses: ./.github/workflows/product-ci-ruby.yml
+
+  product-php:
+    name: product-ci-php
+    needs: detect-projects
+    if: needs.detect-projects.outputs.php == 'true'
+    uses: ./.github/workflows/product-ci-php.yml
+
+  telemetry:
+    name: telemetry-artifact
+    runs-on: ubuntu-latest
+    if: always() && github.event_name == 'pull_request'
+    needs:
+      - harness-static
+      - issue-spec-check
+      - open-pr-limit
+      - diff-size
+      - detect-projects
+      - product-ts
+      - product-python
+      - product-go
+      - product-ruby
+      - product-php
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Emit harness CI telemetry artifact
+        env:
+          TELEMETRY_SOURCE: harness-ci
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_WORKFLOW: ${{ github.workflow }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          BASE_SHA: origin/${{ github.base_ref }}
+          JOB_RESULTS: ${{ toJSON(needs) }}
+          EXECUTION_MODE: ci
+          FINAL_OUTCOME: in_progress
+        run: node scripts/emit-telemetry-artifact.mjs
+
+      - name: Upload harness telemetry artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: harness-telemetry-${{ github.run_id }}
+          path: telemetry-artifacts/
+          if-no-files-found: error

package/.github/workflows/harness-sync.yml

@@ -0,0 +1,28 @@
+name: Harness sync
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_repo:
+        description: "owner/name of product repository (for future matrix sync)"
+        required: false
+  schedule:
+    - cron: "0 8 * * 1"
+
+jobs:
+  drift-report:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Generate harness drift manifest
+        run: node scripts/harness-drift-report.mjs
+
+      - name: Sync instructions
+        run: |
+          echo "Copy manifest SHAs to product repos via bootstrap or manual sync." >> "$GITHUB_STEP_SUMMARY"
+          echo "See docs/shared-config.md and docs/adoption.md." >> "$GITHUB_STEP_SUMMARY"

package/.github/workflows/l1-readiness-check.yml

@@ -0,0 +1,45 @@
+name: L1 readiness check
+
+on:
+  workflow_dispatch:
+    inputs:
+      strict:
+        description: Enable strict readiness gating (same semantics as check-l1-readiness --strict)
+        type: boolean
+        default: false
+      template:
+        description: Template repository mode (multiple product-ci workflows)
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  l1-readiness:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Run L1 readiness check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          args=(--github-repo "${{ github.repository }}" --json --summary)
+          if [[ "${{ inputs.strict }}" == "true" ]]; then
+            args+=(--strict)
+          fi
+          if [[ "${{ inputs.template }}" == "true" ]]; then
+            args+=(--template)
+          fi
+          node scripts/check-l1-readiness.mjs "${args[@]}" | tee l1-readiness.json
+          node --input-type=module -e "
+            import { readFileSync } from 'node:fs';
+            const report = JSON.parse(readFileSync('l1-readiness.json', 'utf8'));
+            process.exit(report.exitCode ?? (report.hasFail ? 1 : 0));
+          "

package/.github/workflows/labels-sync.yml

@@ -0,0 +1,24 @@
+name: Sync labels
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - ".github/labels.yml"
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Apply labels from labels.yml
+        uses: EndBug/label-sync@v2
+        with:
+          config-file: .github/labels.yml
+          delete-other-labels: false