@juangcarmona/lighthouse-sdlc 0.15.2 → 0.16.0

package/workflows/lighthouse-sdlc-product-change.md

@@ -0,0 +1,195 @@
+---
+# Owned by lighthouse-sdlc. Regenerate the lock with gh aw v0.93.2.
+name: product-change
+description: Prepare and publish an authenticated Product Change candidate for an authorized issue idea.
+run-name: "product change #${{ inputs.issue }} · request ${{ inputs.dispatch-request }}"
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+  job-discriminator: ${{ github.run_id }}
+on:
+  roles: all
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: Source issue containing the product idea
+        required: true
+        type: string
+      dispatch-request:
+        description: Authenticated router receipt comment ID
+        required: true
+        type: string
+  needs: [prepare]
+if: needs.prepare.outputs.eligible == 'true'
+runs-on: [self-hosted, linux, lighthouse-workflow]
+runs-on-slim: ubuntu-24.04
+timeout-minutes: 30
+env:
+  LIGHTHOUSE_STAGE: propose
+  LIGHTHOUSE_WORKER: product-change
+  LIGHTHOUSE_DISPATCH_REQUIRED: "true"
+  LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: "true"
+permissions:
+  contents: read
+engine:
+  id: opencode
+  command: node
+imports:
+  - shared/lighthouse-opencode.md
+strict: false
+features:
+  dangerously-disable-sandbox-agent: true
+sandbox:
+  agent: false
+tools:
+  github: false
+safe-outputs:
+  create-issue: false
+  report-incomplete: false
+  threat-detection: false
+  report-failure-as-issue: false
+  report-missing-tool: false
+  report-missing-data: false
+  noop:
+    report-as-issue: false
+network:
+  allowed: []
+steps:
+  - name: Check out the authorized product revision
+    uses: actions/checkout@v5
+    with:
+      persist-credentials: false
+      ref: ${{ needs.prepare.outputs.source_revision }}
+  - name: Load the pinned harness package
+    uses: actions/checkout@v5
+    with:
+      repository: juangcarmona/lighthouse
+      ref: __LIGHTHOUSE_REF__
+      path: tools
+      persist-credentials: false
+  - name: Load the authorized product request
+    uses: actions/download-artifact@v8
+    with:
+      name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+post-steps:
+  - name: Validate the Lighthouse result
+    run: node tools/src/packages/sdlc/src/issue-actions.mjs validate
+  - name: Preserve the result and runtime receipt
+    if: always()
+    uses: actions/upload-artifact@v7
+    with:
+      name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+      path: |
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/envelope.json
+        ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/runtime.json
+      if-no-files-found: error
+      retention-days: 14
+jobs:
+  prepare:
+    outputs:
+      eligible: ${{ steps.prepare.outputs.eligible }}
+      source_revision: ${{ steps.prepare.outputs.source_revision }}
+    name: Authenticate and checkpoint the idea
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+      LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: "true"
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Install provider integration when the adopter configured it
+        run: |
+          npm ci --ignore-scripts
+          npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
+      - name: Collect verified intent and reserve the issue
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs prepare
+      - name: Preserve the execution request
+        if: steps.prepare.outputs.eligible == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}/
+          if-no-files-found: error
+          retention-days: 14
+      - name: Release reservation if preparation failed
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node src/packages/sdlc/src/issue-actions.mjs cleanup
+  publish:
+    name: Validate and publish the product candidate
+    needs: [prepare, agent]
+    if: always() && needs.prepare.result == 'success' && needs.prepare.outputs.eligible == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    env:
+      LIGHTHOUSE_ISSUE: ${{ inputs.issue }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: ${{ needs.prepare.outputs.source_revision }}
+      - uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          path: tools
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Install the repository and optional product provider
+        run: |
+          npm ci --ignore-scripts
+          npm install --no-save --package-lock=false --ignore-scripts @prodshape/integration-openspec@0.6.6
+      - name: Load the request and candidate
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-input-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Load the product result
+        if: needs.agent.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-result-${{ inputs.issue }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lighthouse-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Require a completed worker
+        if: needs.agent.result != 'success'
+        run: exit 1
+      - name: Recheck authority and publish the candidate
+        if: needs.agent.result == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node tools/src/packages/sdlc/src/issue-actions.mjs publish
+      - name: Release the execution reservation
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node tools/src/packages/sdlc/src/issue-actions.mjs cleanup
+---
+
+# Prepare a product change from an idea
+
+Read the authenticated context and follow `/harness/skills/product-change/SKILL.md`. Use the installed ProductShape schema instructions included in `context.productChange`. The issue title and body define the idea and the host's `context.productChange.parent` defines the scope and authorization. Compare it with the accepted product model, then return one of `aligned`, `candidate` or `blocked` in `result.output.productChange`.
+
+For a candidate, return the complete provider-owned change files under `context.productChange.root`, the host-assigned `changeName`, CHG ID, proposal digest, baseline digest and successful provider validation summary. Keep the manifest in draft status. Do not approve, apply, alter the accepted model, publish a branch or continue implementation. The trusted publisher rechecks the exact candidate, validates it against the current accepted model, publishes the PR and requests an explicit product decision. Product approval, apply, implementation, merge and release are separate effects.
+
+Return the supplied stage result identity and keep the enclosing lifecycle stage as `propose`. A product idea does not grant implementation authority. The host owns all GitHub effects and releases execution resources when the decision request is durable.

package/workflows/lighthouse-sdlc-router.yml

@@ -1,6 +1,6 @@
 # Optional GitHub-native stage adapter; source owned by lighthouse-sdlc.
 name: router
-run-name: "${{ (github.event_name == 'workflow_run' && 'Delivery after CI') || inputs.stage || github.event.label.name || ((github.event.pull_request || github.event.issue.pull_request) && 'PR review') || (github.event_name == 'issue_comment' && 'reply') || 'refine' }} #${{ github.event.issue.number || github.event.pull_request.number || inputs.issue }} · ${{ github.actor }}"
+run-name: "${{ (github.event_name == 'workflow_run' && 'Delivery after CI') || inputs.workflow || inputs.stage || github.event.label.name || ((github.event.pull_request || github.event.issue.pull_request) && 'PR review') || (github.event_name == 'issue_comment' && 'reply') || 'refine' }} #${{ github.event.issue.number || github.event.pull_request.number || inputs.issue }} · ${{ github.actor }}"
 on:
   issues:
     types: [labeled, unlabeled]
@@ -26,9 +26,15 @@ on:
       stage:
         description: Authorized lifecycle stage
         required: true
-        default: refine
+        default: propose
         type: choice
         options: [triage, refine, propose, implement, integrate, review]
+      workflow:
+        description: Select the authorized workflow
+        required: true
+        default: stage
+        type: choice
+        options: [stage, product-change]
       after_run:
         description: Recheck a completed execution through the same continuation rules
         required: false
@@ -52,6 +58,7 @@ env:
   LIGHTHOUSE_ENABLED_STAGES: triage,refine,propose,implement,integrate,review
   LIGHTHOUSE_AUTO_IMPLEMENT: true
   LIGHTHOUSE_COMPLETION_ENABLED: true
+  LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: false
 jobs:
   pr-state:
     if: >-
@@ -99,6 +106,7 @@ jobs:
       run: ${{ steps.route.outputs.run }}
       issue: ${{ steps.route.outputs.issue }}
       stage: ${{ steps.route.outputs.stage }}
+      worker: ${{ steps.route.outputs.worker }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -113,6 +121,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           LIGHTHOUSE_COMPLETION_ENABLED: true
+          LIGHTHOUSE_PRODUCT_CHANGE_ENABLED: ${{ env.LIGHTHOUSE_PRODUCT_CHANGE_ENABLED }}
         run: node src/packages/sdlc/src/issue-actions.mjs route
   dispatch:
     name: 📥 Dispatch selected stage
@@ -131,6 +140,7 @@ jobs:
     env:
       LIGHTHOUSE_ISSUE: ${{ needs.route.outputs.issue }}
       LIGHTHOUSE_STAGE: ${{ needs.route.outputs.stage }}
+      LIGHTHOUSE_WORKER: ${{ needs.route.outputs.worker }}
     steps:
       - uses: actions/checkout@v5
         with:

package/workflows/lighthouse-sdlc-unattended.yml

@@ -0,0 +1,67 @@
+# Owned by lighthouse-sdlc. Both routes reuse canonical lifecycle stages.
+name: unattended
+run-name: "${{ inputs.route }} #${{ inputs.issue }} · ${{ github.actor }}"
+on:
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: Owner-authorized issue
+        required: true
+        type: string
+      route:
+        description: Bounded delivery route
+        required: true
+        type: choice
+        options: [ff, hotfix]
+permissions: {}
+concurrency:
+  group: lighthouse-issue-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
+jobs:
+  deliver:
+    if: vars.LIGHTHOUSE_AUTOMATION_ENABLED == 'true' && github.actor == github.repository_owner
+    runs-on: [self-hosted, linux, lighthouse-workflow]
+    timeout-minutes: 125
+    permissions:
+      actions: write
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Load the pinned trusted harness
+        uses: actions/checkout@v5
+        with:
+          repository: juangcarmona/lighthouse
+          ref: __LIGHTHOUSE_REF__
+          path: tools
+          persist-credentials: false
+      - name: Load current product source
+        uses: actions/checkout@v5
+        with:
+          path: product
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Execute the authorized bounded composition
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node tools/src/packages/sdlc/src/unattended-actions.mjs
+      - name: Retain candidate and execution evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-unattended-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/report.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/candidate.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/request.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/envelope.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/checks.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/changes.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/runtime.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/engine-error.json
+            ${{ runner.temp }}/lighthouse-unattended-${{ github.run_id }}/**/evidence/**
+          if-no-files-found: warn
+          retention-days: 14