@makerx/yoke 0.9.0 → 0.10.0

package/README.md

@@ -23,7 +23,7 @@ yoke sync --user   # ~/.claude/skills
 
 - `/pr` raises a PR with a short What/Why/(How) description.
 - `/review [number]` reviews a PR with Claude and Codex, combines their findings and offers to post them. [Configure](src/features/review/README.md#settings).
-- `/review-ci` adds a workflow that reviews each PR in CI and helps set its secrets. [Details](src/features/review/README.md#ci).
+- `/review-ci` adds a workflow that reviews each PR in CI and helps set its variable and secret. [Details](src/features/review/README.md#ci).
 
 ## CLI
 

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.9.0",
+  version: "0.10.0",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -627,10 +627,10 @@ function buildOverride({ harness, model }, provider) {
 // src/features/review/ci.ts
 var reviewWorkflowRef = "MakerXStudio/yoke/.github/workflows/review.yml@main";
 var callerWorkflowPath = join3(".github", "workflows", "review-pr.yml");
-var baseUrlSecret = "REVIEW_CI_BASE_URL";
+var baseUrlVariable = "REVIEW_CI_BASE_URL";
 var apiKeySecret = "REVIEW_CI_API_KEY";
 function workflowSecrets({ entra }) {
-  return entra ? [baseUrlSecret] : [baseUrlSecret, apiKeySecret];
+  return entra ? [] : [apiKeySecret];
 }
 function entraInputs({ azureClientId, azureTenantId, environment }, provider, errors) {
   const clientId = azureClientId?.trim();
@@ -686,6 +686,7 @@ function yamlValue(value) {
   return /^[\w./:@-]+$/.test(value) && !/^([-+.\d_eE]+|0[xo][\da-f]+|true|false|yes|no|on|off|y|n|null|~)$/i.test(value) ? value : JSON.stringify(value);
 }
 function renderCallerWorkflow(workflow) {
+  const secrets = workflowSecrets(workflow);
   return [
     "name: Review PR",
     "",
@@ -703,19 +704,20 @@ function renderCallerWorkflow(workflow) {
     `    uses: ${reviewWorkflowRef}`,
     "    with:",
     ...workflow.inputs.map(([name, value]) => `      ${name}: ${yamlValue(value)}`),
-    "    secrets:",
-    ...workflowSecrets(workflow).map((secret2) => `      ${secret2}: \${{ secrets.${secret2} }}`),
+    `      base-url: \${{ vars.${baseUrlVariable} }}`,
+    ...secrets.length > 0 ? ["    secrets:", ...secrets.map((secret2) => `      ${secret2}: \${{ secrets.${secret2} }}`)] : [],
     ""
   ].join("\n");
 }
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'\\''`)}'`;
 }
-function secretCommands(settings, workflow) {
+function setupCommands(settings, workflow) {
   const baseUrl = settings[`${workflow.provider}.baseUrl`];
-  return workflowSecrets(workflow).map(
-    (secret2) => secret2 === baseUrlSecret && baseUrl ? `gh secret set ${secret2} --body ${shellQuote(baseUrl)}` : `gh secret set ${secret2}`
-  );
+  return [
+    `gh variable set ${baseUrlVariable}${baseUrl ? ` --body ${shellQuote(baseUrl)}` : ""}`,
+    ...workflowSecrets(workflow).map((secret2) => `gh secret set ${secret2}`)
+  ];
 }
 var githubOidcIssuer = "https://token.actions.githubusercontent.com";
 var entraTokenExchangeAudience = "api://AzureADTokenExchange";
@@ -780,12 +782,12 @@ function entraSetup({ clientId, environment }, repo) {
 }
 function reviewCiReport(outcome, settings, workflow, repo) {
   const action = outcome === "wrote" ? "wrote" : "kept";
-  const secrets = workflowSecrets(workflow);
+  const reads = [`variable ${baseUrlVariable}`, ...workflowSecrets(workflow).map((secret2) => `secret ${secret2}`)];
   return [
     `${action} ${callerWorkflowPath}`,
     "",
-    `The workflow reads ${secrets.join(" and ")}. Set ${secrets.length > 1 ? "them" : "it"} on the repo (or the org) with:`,
-    ...secretCommands(settings, workflow).map((command) => `  ${command}`),
+    `The workflow reads ${reads.join(" and ")}. Set ${reads.length > 1 ? "them" : "it"} on the repo (or the org) with:`,
+    ...setupCommands(settings, workflow).map((command) => `  ${command}`),
     ...workflow.entra ? entraSetup(workflow.entra, repo()) : [],
     "",
     "Commit and push the workflow; each PR opened from this repo then gets a review."
@@ -938,7 +940,7 @@ This change adds or edits a workflow that calls \`MakerXStudio/yoke/.github/work
 
 Real defects in it are still findings, such as:
 
-- Passing every secret with \`secrets: inherit\` instead of only \`REVIEW_CI_BASE_URL\` and \`REVIEW_CI_API_KEY\`.
+- Passing every secret with \`secrets: inherit\` instead of only \`REVIEW_CI_API_KEY\` (plus \`REVIEW_CI_BASE_URL\` from callers that still pass the URL as a secret).
 - An input the reusable workflow does not declare.
 - No \`permissions:\` block limiting the token to \`contents: read\` and \`pull-requests: write\`, plus \`id-token: write\` with \`azure-client-id\`. The reusable workflow sets no permissions of its own, so the caller's block is the only limit on the token its agents run with.
 `;
@@ -1179,8 +1181,8 @@ async function reportFailure(pr2, reason, ui, deps) {
 
 // src/features/review/slots.ts
 var slotNames = ["reviewer1", "reviewer2", "synthesis"];
-function notSet(key, secret2, placeholder, env) {
-  return isCi(env) ? `Secret ${secret2} is not set` : `${key} is not set; ${howToSet(key, placeholder)}`;
+function notSet(key, ciName, placeholder, env) {
+  return isCi(env) ? `${ciName} is not set` : `${key} is not set; ${howToSet(key, placeholder)}`;
 }
 function readProvider(settings, kind, env = process.env) {
   const baseUrlKey = `${kind}.baseUrl`;
@@ -1191,8 +1193,8 @@ function readProvider(settings, kind, env = process.env) {
   if (baseUrl && token) return { kind, baseUrl, token };
   if (baseUrl && apiKey) return { kind, baseUrl, apiKey };
   return [
-    baseUrl ? null : notSet(baseUrlKey, baseUrlSecret, "<url>", env),
-    apiKey || token ? null : notSet(apiKeyKey, apiKeySecret, "<key>", env)
+    baseUrl ? null : notSet(baseUrlKey, `Variable ${baseUrlVariable}`, "<url>", env),
+    apiKey || token ? null : notSet(apiKeyKey, `Secret ${apiKeySecret}`, "<key>", env)
   ].filter((error) => error !== null);
 }
 function readSpec(settings, slot, errors) {
@@ -2183,7 +2185,7 @@ If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 // src/features/review/ciSkill.ts
 var reviewCiSkill = {
   name: "review-ci",
-  description: "Add yoke's adversarial PR review workflow to this repo and set the secrets it needs.",
+  description: "Add yoke's adversarial PR review workflow to this repo and set the variable and secret it needs.",
   disableModelInvocation: true,
   userLevel: true,
   body: `
@@ -2191,13 +2193,13 @@ Run \`yoke review-ci $ARGUMENTS\`. If it reports that a model is required, run \
 
 With \`--provider foundry\`, if the Foundry resource has local (API key) auth disabled or the user prefers Entra, rerun with \`--azure-client-id\` and \`--azure-tenant-id\` of the Entra app the job signs in as, plus \`--environment\` if the job should run in a GitHub environment. Ask the user for these values; don't guess them.
 
-Then set the secrets it printed. Run \`gh secret list\` first; if a secret is missing, ask whether it is already set at the org level before setting it on the repo.
-- \`REVIEW_CI_BASE_URL\` is not secret: confirm the URL with the user and run the printed command.
+Then set the variable and secret it printed. Run \`gh variable list\` and \`gh secret list\` first; if one is missing, ask whether it is already set at the org level before setting it on the repo.
+- \`REVIEW_CI_BASE_URL\` is a variable, not a secret: confirm the URL with the user and run the printed \`gh variable set\` command.
 - \`REVIEW_CI_API_KEY\` must never enter this conversation: ask the user to run \`gh secret set REVIEW_CI_API_KEY\` in their own terminal, outside this session, and paste the key at its prompt. With Entra auth there is no API key to set.
 
 With Entra auth, show the user the federated credential it printed (issuer, audience, subject) and the \`az ad app federated-credential create\` command, and ask whether to run it or whether they will add the credential in the Azure portal. The app also needs the Cognitive Services User role on the Foundry resource, and the environment, if given, must exist on the repo.
 
-Finish by running \`gh secret list\` and telling the user to commit and push the workflow file.
+Finish by running \`gh variable list\` and \`gh secret list\` and telling the user to commit and push the workflow file.
 
 If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerx/yoke",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   "license": "MIT",
   "author": "MakerX",