@mokoconsulting/mokoabs-mcp 0.0.0-stage → 4.0.2

package/.mokogit/workflows/ci-issue-reporter.yml

@@ -0,0 +1,100 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogit/workflows/ci-issue-reporter.yml
+# VERSION: 01.00.00
+# BRIEF: Reusable workflow � creates/updates a MokoGIT issue when a CI gate fails.
+#        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
+
+name: "Universal: CI Issue Reporter"
+
+on:
+  workflow_call:
+    inputs:
+      gate:
+        description: "CI gate name (e.g. PR Validation, Repository Health)"
+        required: true
+        type: string
+      details:
+        description: "Human-readable failure description"
+        required: true
+        type: string
+      severity:
+        description: "error or warning"
+        required: false
+        type: string
+        default: "error"
+      workflow:
+        description: "Workflow name for the issue title"
+        required: false
+        type: string
+        default: ""
+    secrets:
+      MOKOGIT_TOKEN:
+        required: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  report:
+    name: "Report: ${{ inputs.gate }}"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Setup MokoCLI tools
+        run: |
+          # Standard mokocli install: FRESH from the MokoGIT Composer registry every
+          # run (PRIMARY); /opt/mokocli is a FAILSAFE only (its sync unit is disabled,
+          # so it rots). Registry path /api/packages/** is anon-allowlisted (no token)
+          # and reliable — unlike the former anonymous git clone, which REQUIRE_SIGNIN
+          # can block. Installs to /tmp/mokocli (the path this workflow's steps use).
+          if ! command -v composer > /dev/null 2>&1; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1 || true
+          fi
+          rm -rf /tmp/mokocli
+          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          if composer create-project --no-install --no-interaction --no-progress --quiet \
+               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+             && [ -f /tmp/mokocli/cli/version_bump.php ]; then
+            echo "Installed mokocli fresh from the Composer registry (primary)"
+            echo "MOKO_CLI=/tmp/mokocli/cli" >> $GITHUB_ENV
+            if command -v sudo >/dev/null 2>&1 && [ -d /opt/mokocli ] \
+               && ! cmp -s /tmp/mokocli/cli/version_reset_dev.php /opt/mokocli/cli/version_reset_dev.php 2>/dev/null; then
+              sudo cp -a /tmp/mokocli/. /opt/mokocli/ 2>/dev/null && echo "Refreshed /opt/mokocli failsafe from the fresh registry copy" || true
+            fi
+          elif [ -f /opt/mokocli/cli/version_bump.php ]; then
+            echo "::warning::Registry install failed — using /opt/mokocli FAILSAFE (may be stale)"
+            echo "MOKO_CLI=/opt/mokocli/cli" >> $GITHUB_ENV
+            [ -d /tmp/mokocli ] || cp -a /opt/mokocli /tmp/mokocli 2>/dev/null || true
+          else
+            echo "::warning::mokocli unavailable — issue-reporter steps may be degraded"
+          fi
+
+      - name: Report CI failure
+        env:
+          MOKOGIT_TOKEN: ${{ github.token }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          # Route all workflow_call inputs through env vars — referencing ${{ inputs.* }}
+          # directly in a run: block interpolates at YAML-parse time and is a shell-injection
+          # vector. Shell variables are not re-parsed, so a crafted input can't break out.
+          INPUT_GATE: ${{ inputs.gate }}
+          INPUT_DETAILS: ${{ inputs.details }}
+          INPUT_SEVERITY: ${{ inputs.severity }}
+          INPUT_WORKFLOW: ${{ inputs.workflow }}
+        run: |
+          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
+          /tmp/mokocli/cli/ci_issue_reporter.sh \
+            --gate "$INPUT_GATE" \
+            --details "$INPUT_DETAILS" \
+            --severity "$INPUT_SEVERITY" \
+            --workflow "$INPUT_WORKFLOW"

package/.mokogit/workflows/cleanup.yml

@@ -0,0 +1,112 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogit/workflows/cleanup.yml
+# VERSION: 01.01.00
+# CHANGE (01.01.00): fail-open branch/run cleanup (#430) — the run token may lack REST read on some repos, returning an error OBJECT; `jq '.[]'` on it exit-5'd the job under pipefail (fleet-wide red). Guard type=="array" / `(.workflow_runs // [])` and skip gracefully; cleanup is best-effort housekeeping and must never red the run.
+# BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
+
+name: "Universal: Repository Cleanup"
+
+on:
+  schedule:
+    - cron: '0 3 * * 0'  # Weekly on Sunday at 03:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: write
+
+env:
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  cleanup:
+    name: Clean Merged Branches
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ github.token }}
+
+      - name: Delete merged branches
+        env:
+          MOKOGIT_TOKEN: ${{ github.token }}
+        run: |
+          echo "=== Merged Branch Cleanup ==="
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
+
+          # List branches via API. FAIL-OPEN (#430): the run token may lack REST read
+          # on some repos, so the API returns an error OBJECT (not an array); piping
+          # that into `jq '.[]'` errors (exit 5) and, under `set -o pipefail`, fails the
+          # whole job. Guard type=="array" and skip gracefully — branch cleanup is
+          # best-effort housekeeping and must never red the run.
+          BR_RESP=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            "${API}/branches?limit=50" 2>/dev/null || true)
+          BRANCHES=$(printf '%s' "$BR_RESP" | jq -r 'if type=="array" then .[].name else empty end' 2>/dev/null || true)
+          if [ -z "$BRANCHES" ]; then
+            echo "::warning::branch cleanup: could not list branches (token/API); skipping (not a failure)."
+            exit 0
+          fi
+
+          # Head refs of every OPEN pull request — never delete one of these. A
+          # branch can be an ancestor of main yet still back an open PR (e.g. the
+          # native sync engine's moko-sync/* review PRs); deleting it orphans the PR.
+          OPEN_PR_HEADS=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            "${API}/pulls?state=open&limit=100" 2>/dev/null \
+            | jq -r 'if type=="array" then .[].head.ref else empty end' 2>/dev/null || true)
+
+          DELETED=0
+          for BRANCH in $BRANCHES; do
+            # Skip protected branches
+            case "$BRANCH" in
+              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
+            esac
+
+            # Skip any branch that backs an open PR
+            if echo "${OPEN_PR_HEADS}" | grep -qxF "${BRANCH}"; then
+              echo "  Skipping (open PR): ${BRANCH}"
+              continue
+            fi
+
+            # Check if branch is merged into main
+            if git merge-base --is-ancestor "origin/${BRANCH}" "origin/${{ github.event.repository.default_branch }}" 2>/dev/null; then
+              echo "  Deleting merged branch: ${BRANCH}"
+              curl -sS -X DELETE -H "Authorization: token ${MOKOGIT_TOKEN}" \
+                "${API}/branches/${BRANCH}" 2>/dev/null || true
+              DELETED=$((DELETED + 1))
+            fi
+          done
+
+          echo "Deleted ${DELETED} merged branch(es)"
+
+      - name: Clean old workflow runs
+        env:
+          MOKOGIT_TOKEN: ${{ github.token }}
+        run: |
+          echo "=== Workflow Run Cleanup ==="
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
+          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
+
+          # Get old completed runs. FAIL-OPEN (#430): `(.workflow_runs // [])` guards a
+          # non-array/error response so `jq` can't exit-5 the job under pipefail.
+          RUNS=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            "${API}/actions/runs?status=completed&limit=50" 2>/dev/null \
+            | jq -r "(.workflow_runs // []) | .[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null || true)
+
+          DELETED=0
+          for RUN_ID in $RUNS; do
+            curl -sS -X DELETE -H "Authorization: token ${MOKOGIT_TOKEN}" \
+              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
+            DELETED=$((DELETED + 1))
+          done
+
+          echo "Deleted ${DELETED} old workflow run(s)"

package/.mokogit/workflows/makefile-lint.yml

@@ -0,0 +1,240 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Validation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogit/workflows/makefile-lint.yml
+# VERSION: 01.02.00
+# BRIEF: Makefile sanity lint -- identity fields + release contract (SRC_DIR, PROJECT_VERSION format, BUILD_DIR, required targets, parse). Release-contract checks are WARN by default; set vars.MAKEFILE_LINT_ENFORCE=enforce to hard-fail (JOOMLA_I18N_ENFORCE-style, per-repo opt-in).
+#
+# +========================================================================+
+# |                     MAKEFILE IDENTITY LINT                             |
+# +========================================================================+
+# |                                                                        |
+# |  The release pipeline reads project identity from the Makefile         |
+# |  (PROJECT_VERSION drives the version; PROJECT_AUTHOR is stamped into    |
+# |  Joomla <author> at build -- see MokoCLI #803 / #289). A missing field  |
+# |  degrades silently (the build just omits it), so this lints the        |
+# |  Makefile on every PR and surfaces gaps early.                         |
+# |                                                                        |
+# |  Tiering (so a fleet-wide sync does NOT redden CI everywhere):         |
+# |   - EXEMPT: a Makefile with NO PROJECT_* fields (foreign/native, e.g.   |
+# |     MokoGIT=gitea, MokoNtfy=ntfy) is skipped, not failed.               |
+# |   - HARD FAIL: no Makefile, or PROJECT_NAME / PROJECT_VERSION missing   |
+# |     or empty (long-established, every repo already has them).           |
+# |   - WARN only: PROJECT_AUTHOR missing (newly required -- grace period), |
+# |     or an identity value left at a scaffold placeholder.               |
+# |   - PLATFORM is validated only IF present (it is platform-specific;     |
+# |     generic repos derive platform from .mokogit/manifest.xml).          |
+# |                                                                        |
+# +========================================================================+
+
+name: "Universal: Makefile Identity Lint"
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  makefile-identity:
+    name: Makefile Identity Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Lint Makefile identity block
+        env:
+          # Opt-in hard-fail for the release-contract checks (SRC_DIR, parse),
+          # mirroring the JOOMLA_I18N_ENFORCE rollout: unset => WARN only (a
+          # fleet-wide sync never reddens anyone), enforce|true|1 => hard fail.
+          MAKEFILE_LINT_ENFORCE: ${{ vars.MAKEFILE_LINT_ENFORCE }}
+          # Mirror the pre-release #469 SRC_DIR gate opt-out: electron-style repos
+          # set this "off" (always-bump) and are not required to declare SRC_DIR.
+          RELEASE_SRCDIR_GATE: ${{ vars.RELEASE_SRCDIR_GATE }}
+        run: |
+          # The runner shell is `bash -e -o pipefail`. `read_field` greps the
+          # Makefile, and a MISSING field makes grep exit 1 -> pipefail would abort
+          # the whole script (set -e) before the warn/heal logic runs. Disable
+          # pipefail here so a grep non-match is treated as "field absent", not a
+          # fatal error (the field-presence logic below handles absence explicitly).
+          set +o pipefail
+          echo "### Makefile Identity Lint" >> "$GITHUB_STEP_SUMMARY"
+
+          if [ ! -f Makefile ]; then
+            echo "::notice::No Makefile in repo root -- skipping identity lint (nothing to release from a Makefile)."
+            echo "No Makefile -- skipped." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          # Exempt foreign/native Makefiles that don't participate in the Moko
+          # identity convention at all (no PROJECT_* fields) -- e.g. MokoGIT ships
+          # the upstream gitea Makefile and MokoNtfy the ntfy Makefile. A
+          # Moko-standard Makefile always declares at least one PROJECT_* field,
+          # so a half-configured standard Makefile (has some PROJECT_* but is
+          # missing NAME/VERSION) is still caught below; only genuinely-foreign
+          # Makefiles are skipped, so a fleet-wide sync does not redden them.
+          if ! grep -qE '^[[:space:]]*PROJECT_[A-Z_]+[[:space:]]*:?=' Makefile; then
+            echo "::notice::Makefile has no PROJECT_* identity fields -- treating as a non-Moko/native Makefile and skipping identity lint."
+            echo "Non-Moko Makefile (no PROJECT_* fields) -- skipped." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          # Read a `FIELD := value` (or `FIELD = value`) identity line, trimmed.
+          read_field() {
+            { grep -m1 -E "^[[:space:]]*$1[[:space:]]*:?=" Makefile 2>/dev/null || true; } \
+              | sed -E 's/^[^=]*:?=[[:space:]]*//' \
+              | sed -E 's/[[:space:]]+#.*$//' \
+              | sed -E 's/[[:space:]]*$//'
+          }
+
+          is_placeholder() {
+            # scaffold leftovers: myproject, {{PROJECT_NAME}}, CHANGEME, etc.
+            case "$1" in
+              myproject|CHANGEME|TODO|"{{"*"}}"|"") return 0 ;;
+              *) return 1 ;;
+            esac
+          }
+
+          # Release-contract severity: hard-fail only when enforce is opted in
+          # (per-repo vars.MAKEFILE_LINT_ENFORCE), else warn -- so a fleet-wide
+          # sync never reddens a repo that has not adopted the contract yet.
+          ENFORCE=0
+          case "${MAKEFILE_LINT_ENFORCE:-}" in enforce|true|1) ENFORCE=1 ;; esac
+
+          gate() {  # gate "<message>" "<summary-label>"
+            if [ "$ENFORCE" -eq 1 ]; then
+              echo "::error::$1"
+              echo "- [FAIL] $2" >> "$GITHUB_STEP_SUMMARY"
+              FAIL=1
+            else
+              echo "::warning::$1"
+              echo "- [WARN] $2 (MAKEFILE_LINT_ENFORCE off)" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          }
+
+          FAIL=0
+
+          # -- Hard-required fields --
+          for f in PROJECT_NAME PROJECT_VERSION; do
+            v="$(read_field "$f")"
+            if [ -z "$v" ]; then
+              echo "::error::Makefile is missing required identity field ${f} (expected e.g. '${f} := ...')."
+              echo "- [FAIL] ${f}: missing" >> "$GITHUB_STEP_SUMMARY"
+              FAIL=1
+            elif is_placeholder "$v"; then
+              echo "::warning::Makefile ${f} is still a scaffold placeholder ('${v}') -- set it for this project."
+              echo "- [WARN] ${f}: placeholder (${v})" >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "- [OK] ${f}: ${v}" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          done
+
+          # -- Newly-required (warn only for now: #289/#408 rollout grace period) --
+          author="$(read_field PROJECT_AUTHOR)"
+          if [ -z "$author" ]; then
+            echo "::warning::Makefile is missing PROJECT_AUTHOR -- release builds cannot stamp Joomla <author> (MokoCLI #803/#289). Add 'PROJECT_AUTHOR := <name>'."
+            echo "- [WARN] PROJECT_AUTHOR: missing (recommended)" >> "$GITHUB_STEP_SUMMARY"
+          elif is_placeholder "$author"; then
+            echo "::warning::Makefile PROJECT_AUTHOR is still a placeholder ('${author}')."
+            echo "- [WARN] PROJECT_AUTHOR: placeholder (${author})" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "- [OK] PROJECT_AUTHOR: ${author}" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # -- PLATFORM: validate only if the repo declares one (platform-specific) --
+          if grep -qE '^[[:space:]]*PLATFORM[[:space:]]*:?=' Makefile; then
+            platform="$(read_field PLATFORM)"
+            if [ -z "$platform" ] || is_placeholder "$platform"; then
+              echo "::warning::Makefile declares PLATFORM but it is empty/placeholder ('${platform}')."
+              echo "- [WARN] PLATFORM: empty/placeholder" >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "- [OK] PLATFORM: ${platform}" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          fi
+
+          # === Release-contract checks (beyond identity) -- #280 / #483 ===
+          # The pre-release pipeline reads SRC_DIR (the #469 bump gate) and
+          # PROJECT_VERSION, and runs `make build/package/version`. A stale,
+          # renamed, or missing var -- or a Makefile that doesn't parse --
+          # becomes a LATE, silent pre-release failure (no artifact). Surface it
+          # here at PR time. WARN unless vars.MAKEFILE_LINT_ENFORCE is set.
+          platform="$(read_field PLATFORM)"
+          platform_lc="$(printf '%s' "$platform" | tr '[:upper:]' '[:lower:]')"
+
+          # -- SRC_DIR: source root the #469 pre-release gate greps for.
+          #    electron / RELEASE_SRCDIR_GATE=off opt out (always-bump). --
+          if [ "$platform_lc" = "electron" ] || [ "${RELEASE_SRCDIR_GATE:-}" = "off" ]; then
+            echo "- [OK] SRC_DIR: n/a (electron / RELEASE_SRCDIR_GATE=off)" >> "$GITHUB_STEP_SUMMARY"
+          elif grep -qE '^[[:space:]]*SRC_DIR[[:space:]]*:?=' Makefile; then
+            srcdir="$(read_field SRC_DIR)"
+            if [ -z "$srcdir" ] || is_placeholder "$srcdir"; then
+              gate "Makefile SRC_DIR is empty/placeholder ('${srcdir}') -- the pre-release #469 bump gate needs a real source root." "SRC_DIR: empty/placeholder"
+            else
+              echo "- [OK] SRC_DIR: ${srcdir}" >> "$GITHUB_STEP_SUMMARY"
+              if [ ! -d "$srcdir" ]; then
+                echo "::warning::SRC_DIR='${srcdir}' but no such directory exists in the repo."
+                echo "- [WARN] SRC_DIR: '${srcdir}' not on disk" >> "$GITHUB_STEP_SUMMARY"
+              fi
+            fi
+          elif grep -qE '^[[:space:]]*SRC[[:space:]]*:?=' Makefile; then
+            gate "Makefile uses legacy 'SRC :=' but not 'SRC_DIR :='. The pre-release #469 gate greps ^SRC_DIR= and will HARD-FAIL the publish (no artifact). Rename SRC -> SRC_DIR, or re-run 'mokocli workflow sync --makefiles'. See MokonyxSocial #280." "SRC_DIR: legacy 'SRC' var (#280)"
+          else
+            gate "Makefile is missing SRC_DIR (source root). The pre-release #469 bump gate requires it on non-electron repos; add 'SRC_DIR := <dir>' (or set vars.RELEASE_SRCDIR_GATE=off to opt out)." "SRC_DIR: missing"
+          fi
+
+          # -- PROJECT_VERSION format (warn; scheme varies by platform) --
+          ver="$(read_field PROJECT_VERSION)"
+          if printf '%s' "$ver" | grep -qE '^[0-9]{2}\.[0-9]{2}\.[0-9]{2}$'; then
+            echo "- [OK] PROJECT_VERSION format: NN.NN.NN" >> "$GITHUB_STEP_SUMMARY"
+          elif printf '%s' "$ver" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+([.+-].*)?$'; then
+            echo "- [OK] PROJECT_VERSION format: semver-ish (${ver})" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::warning::PROJECT_VERSION '${ver}' matches neither zero-padded NN.NN.NN (Joomla/PHP) nor semver x.y.z -- release tagging/version integrity may misbehave."
+            echo "- [WARN] PROJECT_VERSION format: unrecognized (${ver})" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # -- BUILD_DIR present (warn) --
+          if grep -qE '^[[:space:]]*BUILD_DIR[[:space:]]*:?=' Makefile; then
+            echo "- [OK] BUILD_DIR: present" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::warning::Makefile has no BUILD_DIR -- build/package targets usually stage into it."
+            echo "- [WARN] BUILD_DIR: missing" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # -- Required release targets the pipeline invokes (warn) --
+          missing_targets=""
+          for t in build package version; do
+            grep -qE "^${t}:" Makefile || missing_targets="${missing_targets} ${t}"
+          done
+          if [ -n "$missing_targets" ]; then
+            echo "::warning::Makefile is missing release target(s):${missing_targets} -- the pipeline runs 'make <target>'."
+            echo "- [WARN] targets: missing${missing_targets}" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "- [OK] targets: build, package, version present" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # -- Makefile parses cleanly -- dry-run the always-present `version`
+          #    target so a syntax/eval error is caught without running a build. --
+          if command -v make >/dev/null 2>&1 && grep -qE '^version:' Makefile; then
+            if make -n version >/dev/null 2>parse.err; then
+              echo "- [OK] make -n version: parses" >> "$GITHUB_STEP_SUMMARY"
+            else
+              gate "'make -n version' failed -- the Makefile has a parse/evaluation error: $(sed -n '1,3p' parse.err | tr '\n' ' ')" "make -n version: parse/eval error"
+            fi
+            rm -f parse.err
+          fi
+
+          if [ "$FAIL" -ne 0 ]; then
+            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "**Fix the FAIL item(s) above (identity + release contract).**" >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+          echo "Makefile sanity OK ($([ "$ENFORCE" -eq 1 ] && echo 'enforce' || echo 'contract checks warn-only'))." >> "$GITHUB_STEP_SUMMARY"