@moku-labs/ci 1.0.0

package/examples/app/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+# Thin caller for a Layer-3 moku app: validate on every PR, deploy to Cloudflare on push to main.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Cancel superseded runs on the same ref. Safe here — app-deploy.yml sets no group of its own.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: moku-labs/ci/.github/workflows/app-deploy.yml@v1
+    with:
+      test_script: test:coverage
+      build_worker_script: build:worker # client build first — the worker dry-run reads dist/client
+      migrate_script: migrate:remote # wrangler d1 migrations apply <db> --remote
+      deploy_script: deploy # wrangler deploy
+    # Reusable workflows do NOT inherit secrets — pass each one explicitly.
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/examples/package/ci.yml

@@ -0,0 +1,22 @@
+name: CI
+
+# Thin caller. All logic lives in moku-labs/ci, pinned to the moving @v1 major tag.
+# Required status checks land as "ci / lint", "ci / types", "ci / test", "ci / build"
+# (GitHub prefixes a reusable workflow's jobs with the CALLER's job id) — see rulesets/main.json.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # No `workflow_call:` needed — publish.yml reaches the same checks through
+  # package-release.yml, which calls package-ci.yml itself.
+
+# NO concurrency block here on purpose: package-ci.yml already scopes its group by
+# github.workflow (= this workflow's name), and a caller group with the same value would
+# deadlock against its own child.
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: moku-labs/ci/.github/workflows/package-ci.yml@v1

package/examples/package/publish.local-publish.yml

@@ -0,0 +1,84 @@
+name: Release
+
+# FALLBACK variant of publish.yml — use it if npm rejects a publish executed inside a
+# reusable workflow owned by another repo (see README "Known risk"). Copy this over
+# publish.yml (keep the filename — it is the Trusted Publishing contract).
+#
+# The central workflow still owns check → release → package. Only the credentialed
+# `npm publish` runs HERE, in this repo's own publish.yml, so the OIDC claim's
+# job_workflow_ref points at <owner>/<repo>/.github/workflows/publish.yml.
+on:
+  workflow_dispatch:
+    inputs:
+      release_type:
+        description: Semver bump for this release
+        type: choice
+        required: true
+        options: [patch, minor, major, prerelease]
+  release:
+    types: [published]
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    uses: moku-labs/ci/.github/workflows/package-release.yml@v1
+    permissions:
+      contents: write # release job only; no id-token — nothing central publishes now
+    with:
+      release_type: ${{ inputs.release_type }}
+      publish: false # the central publish job is skipped; the local one below takes over
+
+  publish:
+    needs: release
+    if: |
+      always() && needs.release.outputs.artifact_name != '' &&
+      (
+        (github.event_name == 'workflow_dispatch' && needs.release.outputs.tag != '') ||
+        github.event_name == 'release'
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # ONLY this job — tokenless Trusted Publishing via OIDC
+      contents: read
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && needs.release.outputs.tag || github.ref }}
+          persist-credentials: false
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ needs.release.outputs.artifact_name }}
+          path: dist-pack
+      - name: Assert npm floor for Trusted Publishing (fail closed)
+        run: |
+          set -euo pipefail
+          # Rely on the npm bundled with Node 24 — never `npm install -g npm@latest` next to
+          # a publish credential. Assert the floor instead.
+          have="$(npm --version)"; need="11.5.1"
+          [ "$(printf '%s\n%s\n' "$need" "$have" | sort -V | head -1)" = "$need" ] \
+            || { echo "npm $have < $need (Trusted Publishing floor)"; exit 1; }
+      - name: Verify the ref matches package.json, then publish
+        env:
+          EVENT: ${{ github.event_name }}
+          DISPATCH_VERSION: ${{ needs.release.outputs.version }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          pkg="$(node -p "require('./package.json').version")"
+          if [ "$EVENT" = "workflow_dispatch" ]; then want="$DISPATCH_VERSION"; else want="${REF_NAME#v}"; fi
+          [ -n "$want" ] || { echo "empty version/ref — refusing to publish"; exit 1; }
+          [ "$pkg" = "$want" ] || { echo "package.json $pkg != ref $want"; exit 1; }
+          # Prereleases go to dist-tag 'next' so they never clobber 'latest'.
+          case "$pkg" in *-*) tag=next ;; *) tag=latest ;; esac
+          # Leading "./" is REQUIRED: a bare path is parsed by npm as an "owner/repo" spec.
+          npm publish ./dist-pack/*.tgz --tag "$tag" --access public

package/examples/package/publish.yml

@@ -0,0 +1,36 @@
+name: Release
+
+# Thin caller. The FILENAME is a contract: npm Trusted Publishing is registered against
+# "publish.yml" for this repo — renaming it breaks tokenless publishing.
+on:
+  workflow_dispatch:
+    inputs:
+      release_type:
+        description: Semver bump for this release
+        type: choice
+        required: true
+        options: [patch, minor, major, prerelease]
+  release:
+    types: [published]
+
+# Distinct literal group ("publish-…") — NOT github.workflow. The reused package-ci.yml
+# computes its group from the CALLER's github.workflow = "Release", i.e. "Release-<ref>".
+# If this run also used "Release-<ref>" it would hold that slot for its whole duration while
+# its own child waits for the same slot → deadlock, and the reusable workflow never starts.
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read # least privilege at the top; the release job elevates below
+
+jobs:
+  release:
+    uses: moku-labs/ci/.github/workflows/package-release.yml@v1
+    # A called workflow can NEVER elevate beyond what the caller grants. These two are the
+    # ceiling for the whole pipeline; inside, each job takes only the one it needs.
+    permissions:
+      contents: write # release job: push refs/tags/* + create the GitHub release
+      id-token: write # publish job: tokenless OIDC Trusted Publishing
+    with:
+      release_type: ${{ inputs.release_type }}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@moku-labs/ci",
+  "version": "1.0.0",
+  "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
+  "type": "module",
+  "sideEffects": ["./dist/release.mjs", "./src/index.ts"],
+  "bin": {
+    "moku-release": "./dist/release.mjs"
+  },
+  "files": ["dist", "examples", "rulesets", "LICENSE", "README.md"],
+  "engines": {
+    "node": ">=24.0.0",
+    "bun": ">=1.3.14"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moku-labs/ci.git"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.4.16",
+    "@moku-labs/common": "0.3.0",
+    "@types/bun": "1.3.14",
+    "@vitest/coverage-istanbul": "4.0.18",
+    "eslint": "9.39.3",
+    "eslint-config-biome": "2.1.3",
+    "eslint-plugin-jsdoc": "62.6.0",
+    "eslint-plugin-sonarjs": "4.0.0",
+    "eslint-plugin-unicorn": "63.0.0",
+    "globals": "17.4.0",
+    "jiti": "2.6.1",
+    "publint": "0.3.21",
+    "tsdown": "0.22.1",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.58.0",
+    "vitest": "4.0.18"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "validate": "publint",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check . && eslint .",
+    "lint:fix": "biome check --write . && eslint --fix .",
+    "format": "biome format --write .",
+    "test": "vitest run",
+    "release:setup": "moku-release setup",
+    "release:doctor": "moku-release doctor",
+    "release": "moku-release"
+  }
+}

package/rulesets/main.json

@@ -0,0 +1,33 @@
+{
+  "name": "protect-main",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": { "ref_name": { "include": ["refs/heads/main"], "exclude": [] } },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "required_status_checks": [
+          { "context": "ci / lint" },
+          { "context": "ci / types" },
+          { "context": "ci / test" },
+          { "context": "ci / build" }
+        ]
+      }
+    }
+  ]
+}