@mcpg-dev/pulumi 0.1.0-beta.9 → 0.1.0-canary.727

package/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@aspect_rules_js//js:defs.bzl", "js_library")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+# This package's npm dependencies, linked the way node resolves them.
+npm_link_all_packages(name = "node_modules")
+
+# Every workspace package needs a `pkg` target: npm_link_all_packages resolves
+# a `workspace:*` dependency to one, and the root link covers the whole
+# workspace — so a package without it breaks the graph for everyone, not just
+# for itself.
+js_library(
+    name = "pkg",
+    srcs = glob(
+        ["**/*"],
+        allow_empty = True,
+        exclude = [
+            "node_modules/**",
+            "dist/**",
+            ".next/**",
+            "BUILD.bazel",
+        ],
+    ),
+    visibility = ["//visibility:public"],
+)

package/copy.bara.sky

@@ -0,0 +1,98 @@
+# GENERATED by tools/open-source/gen-copybara.mjs — DO NOT EDIT.
+# One-way mirror of the @mcpg-dev/pulumi npm package from the mcpg monorepo to
+# its own public repository. Contains NO version literals — regenerate
+# (`--write-npm`) only when the package's identity or layout changes.
+#
+# Licence: Apache-2.0. Repo: github.com/mcpg-dev/pulumi-mcpg.
+# History is SQUASHED and re-authored to the bot, so no internal commit
+# history, subjects, or contributor identities are exposed.
+
+# Reads "version" from the package's own package.json at MIRROR time: sets
+# the public release message and the PKG_VERSION label the destination
+# resolves in tag_name — so no version is baked into this file. Matched at
+# two-space indentation so a nested "version" (the CRD SDK's generated
+# provider block carries one) can never be mistaken for the package's.
+def _release_meta(ctx):
+    content = ctx.read_path(ctx.new_path("package.json"))
+    version = ""
+    for line in content.split("\n"):
+        if not line.startswith('  "version"'):
+            continue
+        rest = line.split(":", 1)
+        if len(rest) < 2:
+            continue
+        version = rest[1].strip().strip(",").strip('"')
+        break
+    if version == "":
+        fail("mirror: could not read top-level \"version\" from package.json")
+    ctx.set_message("Release v" + version + "\n")
+    ctx.add_label("PKG_VERSION", version, hidden = True)
+
+core.workflow(
+    name = "default",
+    mode = "SQUASH",
+
+    origin = git.origin(
+        url = "https://github.com/mcpg-dev/source-code.git",
+        ref = "main",
+    ),
+    # push the code to main AND create the v{version} tag the public repo's
+    # release.yml fires on to self-publish to npm.
+    destination = git.github_destination(
+        url  = "https://github.com/mcpg-dev/pulumi-mcpg.git",
+        push = "main",
+        tag_name = "v${PKG_VERSION}",
+        tag_msg  = "Release v${PKG_VERSION}",
+    ),
+
+    # The package subtree, minus internal artifacts: nx project.json,
+    # CHANGELOG.md (internal commits/PRs), AI-agent working rules, build
+    # output, and installed dependencies. Sources and tests DO travel — the
+    # tests use only node:test and node:assert, so they build and run in the
+    # public repo with nothing extra.
+    origin_files = glob(["iac/pulumi/components/**"], exclude = [
+        "iac/pulumi/components/copy.bara.sky", "iac/pulumi/components/project.json",
+        "iac/pulumi/components/BUILD.bazel", "iac/pulumi/components/**/BUILD.bazel",
+        "iac/pulumi/components/CHANGELOG.md", "iac/pulumi/components/**/AGENTS.md",
+        "iac/pulumi/components/bin/**", "iac/pulumi/components/node_modules/**",
+        "iac/pulumi/components/**/*.tsbuildinfo",
+        # Destination-managed names never travel from the origin (the
+        # destination excludes them, and Copybara refuses uncovered writes).
+        "iac/pulumi/components/.gitignore", "iac/pulumi/components/CONTRIBUTING.md",
+        "iac/pulumi/components/package-lock.json", "iac/pulumi/components/.github/**",
+        "iac/pulumi/components/**/DEFERRED.md", "iac/pulumi/components/**/TODO.md",
+        "iac/pulumi/components/**/NOTES.md", "iac/pulumi/components/**/ROADMAP.md",
+        "iac/pulumi/components/**/INTERNAL*.md",
+    ]),
+
+    # Repo-only scaffold (CI, release shim, CONTRIBUTING, .gitignore) is
+    # seeded at bootstrap and excluded here so the mirror never deletes or
+    # clobbers it. LICENSE is NOT excluded — the mirror manages it.
+    destination_files = glob(["**"], exclude = [
+        ".github/**", ".gitignore", "CONTRIBUTING.md", "package-lock.json",
+    ]),
+
+    # Re-author every commit to the bot — no real contributor identity leaks.
+    authoring = authoring.overwrite("mcpg-bot <oss-bot@mcpg.dev>"),
+
+    transformations = [
+        # 1) subdir -> repo root.
+        core.move("iac/pulumi/components", ""),
+
+        # 2) point "repository" at this package's own public repo. Left
+        #    naming the monorepo, a published package sends every reader
+        #    to a repository they cannot open.
+        core.transform([
+            core.replace(
+                before = "\"repository\": \"https://github.com/mcpg-dev/source-code\"",
+                after  = "\"repository\": \"https://github.com/mcpg-dev/pulumi-mcpg\"",
+                paths  = glob(["package.json"]),
+            ),
+        ], reversal = []),
+
+        # 3) release message + PKG_VERSION label from the mirrored
+        #    manifest — replaces the squashed history's message entirely: NO
+        #    commit list, NO authors, NO subjects.
+        _release_meta,
+    ],
+)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpg-dev/pulumi",
-  "version": "0.1.0-beta.9",
+  "version": "0.1.0-canary.727",
   "repository": "https://github.com/mcpg-dev/pulumi-mcpg",
   "description": "Opinionated Pulumi components for MCPG (operator, gateway, tenant, trust).",
   "license": "Apache-2.0",
@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@mcpg-dev/pulumi-crds": "0.1.0-beta.9",
+    "@mcpg-dev/pulumi-crds": "0.1.0-canary.727",
     "@pulumi/kubernetes": "4.31.1",
     "@pulumi/pulumi": "^3.142.0"
   },

package/.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +0,0 @@
-blank_issues_enabled: true
-contact_links:
-  - name: Security report
-    url: mailto:security@mcpg.dev
-    about: Please report vulnerabilities privately by email, not as a public issue.
-  - name: Pull requests
-    url: https://github.com/mcpg-dev
-    about: PRs cannot be merged here — development happens upstream. File an issue instead.

package/.github/workflows/ci.yml

@@ -1,29 +0,0 @@
-# Per-push checks for the npm package. Publishing lives in release.yml.
-name: CI
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-jobs:
-  check:
-    name: install · build · typecheck · test
-    if: vars.OSS_CI_ENABLED == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
-        with:
-          node-version: 22
-      # Unlocked on purpose: no lockfile ships with the source, so the
-      # install resolves fresh.
-      - run: npm install --no-audit --no-fund
-      - run: npm run build
-      - name: Typecheck
-        run: |
-          set -euo pipefail
-          if jq -e '.scripts.typecheck' package.json >/dev/null; then npm run typecheck; fi
-      - name: Test
-        run: |
-          set -euo pipefail
-          if jq -e '.scripts.test' package.json >/dev/null; then npm test; fi

package/.github/workflows/release.yml

@@ -1,18 +0,0 @@
-# Thin shim: fires on the v{version} release tag and calls the shared
-# non-Rust release workflow with this repo's tier. Managed by the release
-# pipeline — changes made here are overwritten.
-name: Release
-on:
-  push:
-    tags: ["v*"]
-  workflow_dispatch:
-permissions:
-  contents: write
-  id-token: write
-  packages: write
-jobs:
-  release:
-    uses: mcpg-dev/.github/.github/workflows/release-nonrust.yml@v1
-    with:
-      tier: npm
-    secrets: inherit

package/CONTRIBUTING.md

@@ -1,24 +0,0 @@
-# Contributing
-
-Development of this project happens upstream; this repository publishes
-each release as a tagged snapshot.
-
-## What this means
-
-- **Pull requests cannot be merged here.** The contents are replaced
-  wholesale at every release, so a PR opened against this repository has
-  nothing durable to land on. PRs are closed automatically with a link to
-  this page.
-- **Issues are very welcome.** Bug reports, feature requests, and questions
-  filed here are read and triaged. Please include the release version you
-  are using and a minimal reproduction.
-- **Security reports:** please email **security@mcpg.dev** rather than
-  opening a public issue.
-
-## Versions
-
-Releases are git tags (`v{version}`); each tagged commit is a complete
-snapshot of this project at that release. Dependency updates arrive with
-the next release; this repository runs no Dependabot/Renovate.
-
-Thanks for using MCPG.