@hivehub/rulebook 1.2.0

package/templates/workflows/python-publish.yml

@@ -0,0 +1,91 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g., v1.0.0)'
+        required: true
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # For trusted publishing
+    
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        ref: ${{ github.event.inputs.tag || github.ref }}
+    
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+        cache: 'pip'
+    
+    - name: Install build dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install build twine check-manifest
+    
+    - name: Install package dependencies
+      run: |
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+        if [ -f pyproject.toml ]; then pip install .[dev]; fi
+    
+    - name: Verify version matches tag
+      run: |
+        TAG="${{ github.event.inputs.tag || github.ref_name }}"
+        TAG_VERSION="${TAG#v}"
+        if [ -f pyproject.toml ]; then
+          VERSION=$(python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])" 2>/dev/null || \
+                    python -c "import toml; print(toml.load('pyproject.toml')['project']['version'])")
+        elif [ -f setup.py ]; then
+          VERSION=$(python setup.py --version)
+        fi
+        if [ "$VERSION" != "$TAG_VERSION" ]; then
+          echo "Error: Package version ($VERSION) does not match tag ($TAG_VERSION)"
+          exit 1
+        fi
+        echo "Version check passed: $VERSION"
+    
+    - name: Check manifest
+      run: check-manifest
+    
+    - name: Run tests
+      run: pytest
+    
+    - name: Run linters
+      run: |
+        ruff check .
+        black --check .
+        mypy .
+    
+    - name: Build package
+      run: python -m build
+    
+    - name: Check package
+      run: twine check dist/*
+    
+    - name: Publish to Test PyPI
+      if: github.event_name == 'workflow_dispatch'
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        skip-existing: true
+    
+    - name: Publish to PyPI
+      if: github.event_name == 'release'
+      uses: pypa/gh-action-pypi-publish@release/v1
+      # Uses trusted publishing, no token needed if configured in PyPI
+    
+    - name: Verify publication
+      run: |
+        sleep 10
+        VERSION=$(python setup.py --version 2>/dev/null || python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
+        pip index versions $(python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['name'])") || true
+        echo "Published version $VERSION to PyPI"
+

package/templates/workflows/python-test.yml

@@ -0,0 +1,59 @@
+name: Python Tests
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        python-version: [ '3.11', '3.12' ]
+
+    steps:
+    - uses: actions/checkout@v5
+    
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+        # MONOREPO: Uncomment and adjust path if in monorepo subdirectory
+        # cache: 'pip'
+        # cache-dependency-path: 'subdirectory/requirements.txt'
+        # Note: Cache may fail in monorepo - disable if you get path resolution errors
+    
+    - name: Install dependencies
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: |
+        python -m pip install --upgrade pip
+        pip install pytest pytest-cov
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+        if [ -f pyproject.toml ]; then pip install .; fi
+      shell: bash
+    
+    - name: Run tests
+      # MONOREPO: Add working-directory and adjust --cov path if in subdirectory
+      # working-directory: ./subdirectory
+      run: pytest --cov=. --cov-report=xml --cov-report=term
+    
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v4
+      if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+      with:
+        files: ./coverage.xml
+        flags: unittests
+        fail_ci_if_error: false
+    
+    - name: Security audit
+      run: |
+        echo "Running security audit..."
+        python -m pip install pip-audit
+        pip-audit || true
+        echo "Checking for outdated packages..."
+        pip list --outdated || true
+

package/templates/workflows/rust-lint.yml

@@ -0,0 +1,54 @@
+name: Rust Lint
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Install minimal nightly (for fmt)
+      uses: dtolnay/rust-toolchain@nightly
+      with:
+        components: rustfmt
+    
+    - name: Install minimal stable
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        components: rustfmt, clippy
+    
+    - uses: actions/checkout@v5
+    
+    - uses: Swatinem/rust-cache@v2
+      # MONOREPO: Uncomment and set workspaces if in subdirectory
+      # with:
+      #   workspaces: 'subdirectory'
+      #   key: clippy
+    
+    - name: Check code formatting
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: cargo fmt --all -- --check  # Use stable rustfmt (nightly not required for edition 2024)
+    
+    - name: Check cargo clippy warnings
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: cargo clippy --workspace -- -D warnings
+    
+    - name: Check cargo clippy warnings for all targets
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: cargo clippy --workspace --all-targets -- -D warnings
+    
+    - name: Check cargo clippy warnings for all targets and features
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+

package/templates/workflows/rust-publish.yml

@@ -0,0 +1,66 @@
+name: Publish to crates.io
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g., v1.0.0)'
+        required: true
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        ref: ${{ github.event.inputs.tag || github.ref }}
+    
+    - name: Setup Rust
+      uses: dtolnay/rust-toolchain@stable
+    
+    - name: Cache Rust dependencies
+      uses: Swatinem/rust-cache@v2
+    
+    - name: Verify version matches tag
+      run: |
+        TAG="${{ github.event.inputs.tag || github.ref_name }}"
+        VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+        TAG_VERSION="${TAG#v}"
+        if [ "$VERSION" != "$TAG_VERSION" ]; then
+          echo "Error: Cargo.toml version ($VERSION) does not match tag ($TAG_VERSION)"
+          exit 1
+        fi
+        echo "Version check passed: $VERSION"
+    
+    - name: Run tests
+      run: cargo test --all-features
+    
+    - name: Run clippy
+      run: cargo clippy --all-features -- -D warnings
+    
+    - name: Build release
+      run: cargo build --release --all-features
+    
+    - name: Verify package contents
+      run: cargo package --list
+    
+    - name: Publish to crates.io (dry-run)
+      run: cargo publish --dry-run --allow-dirty
+    
+    - name: Publish to crates.io
+      run: cargo publish --token ${{ secrets.CARGO_TOKEN }}
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_TOKEN }}
+    
+    - name: Wait for crates.io to update
+      run: sleep 30
+    
+    - name: Verify published version
+      run: |
+        VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
+        PACKAGE=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[0].name')
+        echo "Published $PACKAGE@$VERSION to crates.io"
+

package/templates/workflows/rust-test.yml

@@ -0,0 +1,75 @@
+name: Rust Tests
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust-tests:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+
+    steps:
+    - name: Install minimal stable
+      uses: dtolnay/rust-toolchain@stable
+    
+    - uses: actions/checkout@v5
+    
+    - uses: Swatinem/rust-cache@v2
+      # MONOREPO: Uncomment and set workspaces if in subdirectory
+      # with:
+      #   workspaces: 'subdirectory'
+    
+    - name: Install mold (Linux only)
+      if: runner.os == 'Linux'
+      uses: rui314/setup-mold@v1
+    
+    - name: Configure mold linker (Linux only)
+      if: runner.os == 'Linux'
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: |
+        mkdir -p .cargo
+        echo "[target.x86_64-unknown-linux-gnu]" >> .cargo/config.toml
+        echo "linker = \"clang\"" >> .cargo/config.toml
+        echo "rustflags = [\"-C\", \"link-arg=-fuse-ld=/usr/local/bin/mold\"]" >> .cargo/config.toml
+    
+    - name: Install nextest
+      uses: taiki-e/install-action@nextest
+    
+    - name: Build
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: cargo build --tests --workspace
+    
+    - name: Run tests
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: cargo nextest run --workspace || cargo test --workspace
+    
+    - name: Upload test report
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: junit-${{ matrix.os }}.xml
+        path: target/nextest/default/junit.xml
+        if-no-files-found: ignore
+    
+    - name: Security audit (optional)
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: |
+        echo "Security audit skipped (cargo-audit not pre-installed)"
+        echo "To enable: Install cargo-audit in a separate workflow step"
+        echo "  - cargo install cargo-audit --locked"
+        echo "  - cargo audit"
+      continue-on-error: true
+      shell: bash
+

package/templates/workflows/solidity-lint.yml

@@ -0,0 +1,41 @@
+name: Solidity Lint
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v5
+    
+    # IMPORTANT: For cache to work, you MUST commit package-lock.json
+    # Remove package-lock.json from .gitignore if needed
+    
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        cache: 'npm'
+    
+    - name: Install dependencies
+      run: npm ci
+    
+    - name: Check code formatting
+      run: npx prettier --check 'contracts/**/*.sol' 'test/**/*.js'
+      # or: forge fmt --check (for Foundry)
+    
+    - name: Run Solhint
+      run: npx solhint 'contracts/**/*.sol'
+    
+    - name: Run Slither security analysis
+      uses: crytic/slither-action@v0.3.0
+      with:
+        target: '.'
+        fail-on: medium
+
+

package/templates/workflows/solidity-test.yml

@@ -0,0 +1,47 @@
+name: Solidity Tests
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    
+    steps:
+    - uses: actions/checkout@v5
+    
+    # IMPORTANT: For cache to work, you MUST commit package-lock.json
+    # Remove package-lock.json from .gitignore if needed
+    
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        cache: 'npm'
+    
+    - name: Install dependencies
+      run: npm ci
+    
+    - name: Compile contracts
+      run: npx hardhat compile
+      # or: forge build (for Foundry)
+    
+    - name: Run tests
+      run: npx hardhat test
+      # or: forge test -vvv (for Foundry)
+    
+    - name: Generate coverage report
+      run: npx hardhat coverage
+      # or: forge coverage (for Foundry)
+    
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v4
+      with:
+        files: ./coverage/lcov.info
+        flags: unittests
+        fail_ci_if_error: false
+
+

package/templates/workflows/swift-lint.yml

@@ -0,0 +1,32 @@
+name: Swift Lint
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  lint:
+    runs-on: macos-latest
+    
+    steps:
+    - uses: actions/checkout@v5
+    
+    - name: Select Xcode version
+      run: sudo xcode-select -s /Applications/Xcode_15.2.app
+    
+    - name: Install SwiftLint
+      run: brew install swiftlint
+    
+    - name: Run SwiftLint
+      run: swiftlint lint --strict
+    
+    - name: Check formatting
+      run: |
+        brew install swift-format
+        swift-format lint --recursive Sources Tests
+    
+    - name: Build with warnings as errors
+      run: swift build -Xswiftc -warnings-as-errors
+

package/templates/workflows/swift-publish.yml

@@ -0,0 +1,58 @@
+name: Publish Swift Package
+
+# Note: Swift packages are published via Git tags.
+# This workflow validates the package before tagging.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g., 1.0.0)'
+        required: true
+
+jobs:
+  validate:
+    runs-on: macos-latest
+    
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        ref: ${{ github.event.inputs.tag || github.ref }}
+    
+    - name: Select Xcode version
+      run: sudo xcode-select -s /Applications/Xcode_15.2.app
+    
+    - name: Swift version
+      run: swift --version
+    
+    - name: Run SwiftLint
+      run: |
+        brew install swiftlint
+        swiftlint lint --strict
+    
+    - name: Build
+      run: swift build -Xswiftc -warnings-as-errors
+    
+    - name: Run tests
+      run: swift test
+    
+    - name: Generate documentation
+      run: |
+        swift package generate-documentation
+        echo "Documentation generated"
+    
+    - name: Verify package
+      run: |
+        swift package resolve
+        swift package show-dependencies
+    
+    - name: Package validated
+      run: |
+        TAG="${{ github.event.inputs.tag || github.ref_name }}"
+        echo "✅ Package validation successful"
+        echo "Package available at: https://github.com/${{ github.repository }}"
+        echo "Add to Package.swift:"
+        echo ".package(url: \"https://github.com/${{ github.repository }}.git\", from: \"$TAG\")"
+

package/templates/workflows/swift-test.yml

@@ -0,0 +1,44 @@
+name: Swift Tests
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  test:
+    runs-on: macos-latest
+    
+    strategy:
+      matrix:
+        swift-version: [ '5.10' ]
+    
+    steps:
+    - uses: actions/checkout@v5
+    
+    - name: Select Xcode version
+      run: sudo xcode-select -s /Applications/Xcode_15.2.app
+    
+    - name: Swift version
+      run: swift --version
+    
+    - name: Build
+      run: swift build -v
+    
+    - name: Run tests
+      run: swift test -v --enable-code-coverage
+    
+    - name: Generate coverage report
+      run: |
+        xcrun llvm-cov export -format="lcov" \
+          .build/debug/YourPackagePackageTests.xctest/Contents/MacOS/YourPackagePackageTests \
+          -instr-profile .build/debug/codecov/default.profdata > coverage.lcov
+    
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v4
+      with:
+        files: ./coverage.lcov
+        flags: unittests
+        fail_ci_if_error: false
+

package/templates/workflows/typescript-lint.yml

@@ -0,0 +1,61 @@
+name: TypeScript Lint
+
+on:
+  push:
+    branches: [ master, main, develop ]
+  pull_request:
+    branches: [ '**' ]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v5
+    
+    # IMPORTANT: For cache to work, you MUST commit package-lock.json
+    # Remove package-lock.json from .gitignore if needed
+    
+    # For pnpm projects, add this step before setup-node:
+    # - name: Install pnpm
+    #   uses: pnpm/action-setup@v3
+    #   with:
+    #     version: 8
+    
+    - name: Setup Node.js
+      uses: actions/setup-node@v5
+      with:
+        node-version: '20.x'
+        # MONOREPO: Uncomment and adjust path if in monorepo subdirectory
+        # cache: 'npm'  # Change to 'pnpm' or 'yarn' as needed
+        # cache-dependency-path: 'subdirectory/package-lock.json'
+        # Note: Cache may fail in monorepo - disable if you get path resolution errors
+    
+    - name: Install dependencies
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: npm ci  # For pnpm: pnpm install --frozen-lockfile | For yarn: yarn install --frozen-lockfile
+    
+    - name: Type check
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: npx tsc --noEmit  # Or: npm run type-check
+    
+    - name: Run ESLint
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: npm run lint  # For pnpm: pnpm run lint | For yarn: yarn lint
+    
+    - name: Check code formatting
+      # MONOREPO: Add working-directory if in subdirectory
+      # working-directory: ./subdirectory
+      run: npm run format -- --check || echo "Format check skipped"
+      continue-on-error: true  # Don't fail if format check not configured
+    
+    - name: Security audit
+      run: |
+        echo "Running security audit..."
+        npm audit --production --audit-level=moderate || true
+        echo "Checking for outdated dependencies..."
+        npm outdated || true
+

package/templates/workflows/typescript-publish.yml

@@ -0,0 +1,60 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g., v1.0.0)'
+        required: true
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # For npm provenance
+    
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        ref: ${{ github.event.inputs.tag || github.ref }}
+    
+    # IMPORTANT: For cache to work, you MUST commit package-lock.json
+    # Remove package-lock.json from .gitignore if needed
+    
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        registry-url: 'https://registry.npmjs.org'
+        cache: 'npm'
+    
+    - name: Install dependencies
+      run: npm ci
+    
+    - name: Run tests
+      run: npm test
+    
+    - name: Build
+      run: npm run build
+    
+    - name: Verify package contents
+      run: |
+        npm pack --dry-run
+        echo "Package contents verified"
+    
+    - name: Publish to npm
+      run: npm publish --provenance --access public
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    
+    - name: Create GitHub Release Notes
+      if: github.event_name == 'release'
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const package = require('./package.json');
+          console.log(`Published ${package.name}@${package.version} to npm`);
+