@mokoconsulting/mcp-mokosuite 1.0.0 → 1.1.0-dev.372

package/.mokogit/workflows/pr-check.yml

@@ -7,7 +7,7 @@
 # INGROUP: MokoCLI.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/pr-check.yml
-# VERSION: 09.23.00
+# VERSION: 09.24.00
 # BRIEF: PR gate — branch policy + code validation before merge
 
 name: "Universal: PR Check"
@@ -23,6 +23,11 @@ permissions:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
+concurrency:
+  # storm-reduction: collapse superseded validation runs on the same ref
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # ── Branch Policy ──────────────────────────────────────────────────────
   branch-policy:
@@ -145,7 +150,7 @@ jobs:
     steps:
       - name: Remind to update the wiki
         env:
-          TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
           SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
           REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
@@ -160,16 +165,23 @@ jobs:
             echo ""
             echo "_Non-blocking reminder._"
           } >> "$GITHUB_STEP_SUMMARY"
-          # Post a single PR comment (idempotent via hidden marker); best-effort, never fails.
-          API="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
+          # Sticky PR comment: create-or-UPDATE a single comment keyed by a hidden
+          # marker (no duplicate reminders across pushes). Best-effort, never fails.
+          LIST="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
+          EDIT="${SERVER}/api/v1/repos/${REPO}/issues/comments"
+          MARKER="<!-- wiki-reminder -->"
+          BODY="$(printf '%s\n\n%s' "${MARKER}" "**Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_")"
           if [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; then
-            existing="$(curl -sf -H "Authorization: token ${TOKEN}" "$API" 2>/dev/null | grep -c 'wiki-reminder' || true)"
-            if [ "${existing:-0}" -eq 0 ]; then
-              curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -X POST "$API" \
-                -d '{"body":"<!-- wiki-reminder -->\n\n**Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_"}' >/dev/null 2>&1 || true
+            CID="$(curl -sf -H "Authorization: token ${TOKEN}" "${LIST}?limit=100" 2>/dev/null \
+                   | python3 -c "import sys,json; c=[x for x in json.load(sys.stdin) if '${MARKER}' in (x.get('body') or '')]; print(c[-1]['id'] if c else '')" 2>/dev/null || true)"
+            PAYLOAD="$(python3 -c "import json,sys; print(json.dumps({'body': sys.stdin.read()}))" <<<"${BODY}")"
+            if [ -n "${CID}" ]; then
+              curl -sf -X PATCH -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "${PAYLOAD}" "${EDIT}/${CID}" >/dev/null 2>&1 || true
+            else
+              curl -sf -X POST  -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "${PAYLOAD}" "${LIST}" >/dev/null 2>&1 || true
             fi
           fi
-          echo "Wiki reminder emitted (non-blocking)."
+          echo "Wiki reminder emitted (non-blocking, sticky)."
 
   validate:
     name: Validate PR
@@ -194,6 +206,28 @@ jobs:
           fi
           echo "No conflict markers found"
 
+      - name: Reject tracked updates.xml
+        run: |
+          # updates.xml is generated and served by the MokoGIT update server
+          # (derived from the published stream releases). It must never be
+          # committed to the repo. Fail the PR if a tracked copy appears.
+          HITS=$(git ls-files | grep -iE '(^|/)updates\.xml$' || true)
+          if [ -n "$HITS" ]; then
+            echo "::error::updates.xml must not be committed — it is generated by the MokoGIT update server."
+            printf '%s\n' "$HITS" | while IFS= read -r f; do
+              [ -n "$f" ] && echo "::error file=${f}::Remove ${f} (served by the update server, not stored in-repo)"
+            done
+            {
+              echo "## Blocked: tracked updates.xml"
+              echo "The MokoGIT update server generates this file. Remove it from the repo:"
+              echo '```'
+              printf '%s\n' "$HITS"
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+          echo "No tracked updates.xml — OK"
+
       - name: Detect platform
         id: platform
         run: |
@@ -237,11 +271,11 @@ jobs:
               echo "::error file=${file}::Missing JEXEC guard: ${file}"
               ERRORS=$((ERRORS + 1))
             fi
-          done < <(find . -name "*.php" -path "*/src/*" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          done < <(find . -name "*.php" \( -path "*/src/*" -o -path "*/source/*" \) -not -path "./.git/*" -not -path "./vendor/*" -print0)
           if [ "$ERRORS" -gt 0 ]; then
             echo "::error::${ERRORS} PHP file(s) missing defined('_JEXEC') or die guard"
             echo "## JEXEC Guard Check: Failed" >> $GITHUB_STEP_SUMMARY
-            echo "${ERRORS} file(s) in src/ are missing the Joomla execution guard." >> $GITHUB_STEP_SUMMARY
+            echo "${ERRORS} file(s) in src/ or source/ are missing the Joomla execution guard." >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
           echo "JEXEC guard: OK"
@@ -250,7 +284,7 @@ jobs:
         if: steps.platform.outputs.platform == 'joomla'
         run: |
           MISSING=0
-          SOURCE_DIR="src"
+          SOURCE_DIR="src"; [ -d source ] && SOURCE_DIR="source"
           [ ! -d "$SOURCE_DIR" ] && exit 0
           while IFS= read -r dir; do
             if [ ! -f "${dir}/index.html" ]; then
@@ -348,27 +382,16 @@ jobs:
               ;;
           esac
 
-      - name: Check update stream format
-        run: |
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          case "$PLATFORM" in
-            joomla)
-              if [ -f "updates.xml" ]; then
-                if command -v php &> /dev/null; then
-                  php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('updates.xml'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::updates.xml is malformed"; exit 1; }
-                fi
-                echo "updates.xml valid"
-              fi
-              ;;
-          esac
-
       - name: Validate Joomla language files
         if: steps.platform.outputs.platform == 'joomla'
         run: |
           ERRORS=0
           WARNINGS=0
 
-          # Require both en-GB and en-US language directories
+          # en-GB / en-US locale parity. This is NON-FATAL: the release packager
+          # (mokocli release_package.php) AUTO-CREATES any missing sibling locale
+          # file/dir from the "familiar" locale at build time, so a mismatch here
+          # is a heads-up, not a blocker. Genuine .ini syntax errors below stay fatal.
           LANG_ROOT=$(find . -path "*/language" -type d -not -path "./.git/*" 2>/dev/null | head -1)
           if [ -z "$LANG_ROOT" ]; then
             echo "No language/ directory found — skipping"
@@ -376,30 +399,30 @@ jobs:
           fi
 
           if [ ! -d "$LANG_ROOT/en-GB" ]; then
-            echo "::error::Missing en-GB language directory (${LANG_ROOT}/en-GB)"
-            ERRORS=$((ERRORS + 1))
+            echo "::warning::Missing en-GB language directory (${LANG_ROOT}/en-GB) — the release will auto-create it from en-US"
+            WARNINGS=$((WARNINGS + 1))
           fi
           if [ ! -d "$LANG_ROOT/en-US" ]; then
-            echo "::error::Missing en-US language directory (${LANG_ROOT}/en-US)"
-            ERRORS=$((ERRORS + 1))
+            echo "::warning::Missing en-US language directory (${LANG_ROOT}/en-US) — the release will auto-create it from en-GB"
+            WARNINGS=$((WARNINGS + 1))
           fi
 
-          # Check that en-GB and en-US have matching .ini files
+          # Warn (don't fail) when en-GB and en-US .ini sets differ — auto-healed at release.
           if [ -d "$LANG_ROOT/en-GB" ] && [ -d "$LANG_ROOT/en-US" ]; then
             for GB_INI in "$LANG_ROOT/en-GB"/*.ini; do
               [ ! -f "$GB_INI" ] && continue
               US_INI="$LANG_ROOT/en-US/$(basename "$GB_INI")"
               if [ ! -f "$US_INI" ]; then
-                echo "::error::$(basename "$GB_INI") exists in en-GB but missing from en-US"
-                ERRORS=$((ERRORS + 1))
+                echo "::warning::$(basename "$GB_INI") exists in en-GB but missing from en-US — the release will auto-create it"
+                WARNINGS=$((WARNINGS + 1))
               fi
             done
             for US_INI in "$LANG_ROOT/en-US"/*.ini; do
               [ ! -f "$US_INI" ] && continue
               GB_INI="$LANG_ROOT/en-GB/$(basename "$US_INI")"
               if [ ! -f "$GB_INI" ]; then
-                echo "::error::$(basename "$US_INI") exists in en-US but missing from en-GB"
-                ERRORS=$((ERRORS + 1))
+                echo "::warning::$(basename "$US_INI") exists in en-US but missing from en-GB — the release will auto-create it"
+                WARNINGS=$((WARNINGS + 1))
               fi
             done
           fi
@@ -518,7 +541,8 @@ jobs:
 
       - name: Verify package source
         run: |
-          SOURCE_DIR="src"
+          SOURCE_DIR="source"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="src"
           [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
           if [ ! -d "$SOURCE_DIR" ]; then
             echo "::warning::No src/ or htdocs/ directory"
@@ -532,15 +556,19 @@ jobs:
   pre-release:
     name: Build RC Package
     runs-on: ubuntu-latest
-    needs: [branch-policy, validate]
-    # Run only when both gates succeeded; always() forces evaluation so a skipped
-    # validate (e.g. template repos) skips this job cleanly instead of hanging.
-    if: ${{ always() && needs.branch-policy.result == 'success' && needs.validate.result == 'success' }}
+    # Independent job (no `needs:`) — needs-dependent jobs stall unscheduled on
+    # the MokoGIT runner (they sit in `waiting` with started_at=epoch and never
+    # run, leaving the check permanently pending). The Joomla Extension CI
+    # "Build RC Pre-Release" job uses this same independent pattern for exactly
+    # this reason. Guard template repos directly; branch policy is enforced by
+    # its own required check, and the pre-release workflow re-validates before
+    # publishing, so gating here on validate is not load-bearing.
+    if: github.event_name == 'pull_request' && !startsWith(github.event.repository.name, 'Template-')
 
     steps:
       - name: Trigger RC pre-release
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.head_ref }}
           MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
@@ -552,14 +580,114 @@ jobs:
   # ── Issue Reporter ──────────────────────────────────────────────────────
   report-issues:
     name: Report Issues
-    needs: [branch-policy, validate]
-    if: >-
-      always() &&
-      needs.validate.result == 'failure'
-    uses: ./.mokogit/workflows/ci-issue-reporter.yml
-    with:
-      gate: "PR Validation"
-      workflow: "PR Check"
-      severity: error
-      details: "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
-    secrets: inherit
+    # No `needs:` — the MokoGIT Actions scheduler does not offer needs-dependent
+    # jobs to runners (they stall "waiting" and are reaped by
+    # ABANDONED_JOB_TIMEOUT). This job runs independently and polls the run API
+    # for the Validate PR result, then files an issue only when it failed.
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve Validate PR result (run API)
+        id: gate
+        env:
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -u
+          api="${SERVER}/api/v1/repos/${REPO}/actions/runs/${RUN_ID}/jobs"
+          val="unknown"
+          for i in $(seq 1 120); do
+            resp=$(curl -sf -H "Authorization: token ${TOKEN}" "$api" 2>/dev/null || echo '{}')
+            done_n=$(printf '%s' "$resp" | jq -r '[.jobs[]?|select(.name=="Validate PR")|select(.status=="completed")]|length' 2>/dev/null || echo 0)
+            if [ "${done_n:-0}" -ge 1 ]; then
+              val=$(printf '%s' "$resp" | jq -r '[.jobs[]?|select(.name=="Validate PR")][0].conclusion // "unknown"' 2>/dev/null || echo unknown)
+              break
+            fi
+            sleep 15
+          done
+          echo "validate=${val}" >> "$GITHUB_OUTPUT"
+          echo "Validate PR result: ${val}"
+      - name: Clone MokoCLI
+        if: steps.gate.outputs.validate == 'failure'
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          git clone --depth 1 --filter=blob:none --sparse "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+          cd /tmp/mokocli && git sparse-checkout set cli
+      - name: Report CI failure
+        if: steps.gate.outputs.validate == 'failure'
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          # Route inputs through env vars (avoid ${{ }} shell-injection in run:).
+          INPUT_GATE: "PR Validation"
+          INPUT_DETAILS: "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
+          INPUT_SEVERITY: error
+          INPUT_WORKFLOW: "PR Check"
+        run: |
+          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
+          /tmp/mokocli/cli/ci_issue_reporter.sh \
+            --gate "$INPUT_GATE" \
+            --details "$INPUT_DETAILS" \
+            --severity "$INPUT_SEVERITY" \
+            --workflow "$INPUT_WORKFLOW"
+
+  # ── PR Check Summary (sticky comment) ──────────────────────────────────────
+  # Create-or-update ONE comment (hidden marker) reflecting the gate outcome, so
+  # the PR carries a live status line refreshed on every push. Best-effort.
+  pr-summary:
+    name: PR Check Summary (sticky comment)
+    runs-on: ubuntu-latest
+    # No `needs:` — poll the run API for gate results (the scheduler does not
+    # dispatch needs-dependent jobs; they stall and are reaped).
+    if: always()
+    steps:
+      - name: Upsert sticky summary comment
+        env:
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          HEAD_REF: ${{ github.head_ref }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          set -uo pipefail
+          { [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; } || { echo "no token/PR; skip"; exit 0; }
+          # Poll the run API for Branch Policy + Validate PR results (no `needs:`).
+          api="${SERVER}/api/v1/repos/${REPO}/actions/runs/${RUN_ID}/jobs"
+          BP=unknown; VAL=unknown
+          for i in $(seq 1 120); do
+            resp=$(curl -sf -H "Authorization: token ${TOKEN}" "$api" 2>/dev/null || echo '{}')
+            pend=$(printf '%s' "$resp" | jq -r '[.jobs[]?|select(.name=="Branch Policy" or .name=="Validate PR")|select(.status!="completed")]|length' 2>/dev/null || echo 1)
+            tot=$(printf '%s' "$resp" | jq -r '[.jobs[]?|select(.name=="Branch Policy" or .name=="Validate PR")]|length' 2>/dev/null || echo 0)
+            if [ "${tot:-0}" -ge 2 ] && [ "${pend:-1}" = "0" ]; then
+              BP=$(printf '%s' "$resp" | jq -r '[.jobs[]?|select(.name=="Branch Policy")][0].conclusion // "unknown"')
+              VAL=$(printf '%s' "$resp" | jq -r '[.jobs[]?|select(.name=="Validate PR")][0].conclusion // "unknown"')
+              break
+            fi
+            sleep 15
+          done
+          icon() { case "$1" in success) printf '✅';; failure) printf '❌';; skipped) printf '⏭️';; *) printf '⚪';; esac; }
+          MARKER="<!-- pr-check-summary -->"
+          BODY="$(printf '%s\n## PR Check Summary\n\n- %s Branch policy (`%s` → `%s`)\n- %s Validation\n\n_Updated %s · [run](%s)_' \
+            "${MARKER}" \
+            "$(icon "${BP}")" "${HEAD_REF}" "${BASE_REF}" \
+            "$(icon "${VAL}")" \
+            "$(date -u +%FT%TZ)" "${RUN_URL}")"
+          LIST="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
+          EDIT="${SERVER}/api/v1/repos/${REPO}/issues/comments"
+          CID="$(curl -sf -H "Authorization: token ${TOKEN}" "${LIST}?limit=100" 2>/dev/null \
+                 | python3 -c "import sys,json; c=[x for x in json.load(sys.stdin) if '${MARKER}' in (x.get('body') or '')]; print(c[-1]['id'] if c else '')" 2>/dev/null || true)"
+          PAYLOAD="$(python3 -c "import json,sys; print(json.dumps({'body': sys.stdin.read()}))" <<<"${BODY}")"
+          if [ -n "${CID}" ]; then
+            curl -sf -X PATCH -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "${PAYLOAD}" "${EDIT}/${CID}" >/dev/null 2>&1 || true
+            echo "updated sticky summary #${CID} on PR #${PR}"
+          else
+            curl -sf -X POST  -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "${PAYLOAD}" "${LIST}" >/dev/null 2>&1 || true
+            echo "created sticky summary on PR #${PR}"
+          fi