@mutmutco/pi-plugin 4.5.129 → 4.5.131

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.5.129",
+  "version": "4.5.131",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -50,6 +50,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read # #8206: exact-SHA development workflow verdict
   contents: read
   # MMI-Hub#7542: the product image build below reads org private packages with the workflow's
   # own ephemeral token (NODE_AUTH_TOKEN) — the same reader the central deploy uses.
@@ -65,12 +66,40 @@ jobs:
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
     steps:
-      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
+      - name: Reuse development gate for rc tag
+        id: development-gate
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          script: |
+            core.setOutput('reuse', 'false');
+            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
+            try {
+              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
+              const { data } = await github.rest.actions.listWorkflowRuns({
+                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
+                event: 'push', head_sha: context.sha, per_page: 100
+              });
+              // API returns newest first: a newer red/pending rerun must not reuse an older green.
+              const run = data.workflow_runs[0];
+              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
+                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
+              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
+                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
+              });
+              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
+              core.setOutput('reuse', 'true');
+              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
+            } catch (error) {
+              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
+            }
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:
           lockfile-path: {{GATE_CACHE_DEP_PATH}}
           fetch-depth: 0 # #8129: runbook freshness needs the PR merge-base history.
       - name: Runbook guard
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' && (github.event_name == 'pull_request') }}
         uses: mutmutco/MMI-Hub/.github/actions/runbook-guard@{{GATE_RUNBOOK_SHA}}
         with:
           base-ref: origin/${{ github.base_ref }}
@@ -81,11 +110,13 @@ jobs:
       # `npm config get cache` for any explicit cache restore). Job-level `env:` cannot use the
       # `runner` context — write via GITHUB_ENV from the shell `$RUNNER_TEMP` instead.
       - name: Isolate npm cache (per-job)
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         shell: bash
         run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
       # MMI-Hub#5111: Windows CRLF in tracked shell scripts breaks Linux runners before the real
       # check can explain it. Inspect only tracked files before install; .gitattributes is the fix.
       - name: Line-ending guard
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         shell: bash
         run: |
           offenders=$(mktemp)
@@ -116,6 +147,7 @@ jobs:
       # files (Dockerfile + docker-compose.yml) skip in a second — no new job, no new required
       # context, no ruleset or registry change (#7012 needs nothing to cover).
       - name: Product image build (tenant-container only)
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         env:
           # The documented build-secret opt-in (compose `build.secrets` + registry
           # requiredBuildSecrets `NODE_AUTH_TOKEN=@github-packages-token`): the workflow's own
@@ -146,25 +178,27 @@ jobs:
       # MMI-Hub#5871: declare the npm MAJOR rather than inheriting whatever the runner's node bundles.
       # A bare major, never an exact patch (it goes stale and then prescribes downgrading operator
       # hosts toward it, #5862) and never `latest` (it takes the next major silently, #4782).
-      - if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'node') }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
         with:
           node-version: 24
           npm-version: '12'
-      - if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'python') }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: '{{GATE_PY_VERSION}}' }
       # MMI-Hub#3446: assert the runtime toolchain is on PATH BEFORE the install step. Node uses the
       # runner-node-toolchain composite above (setup-node + preflight in one action, #5610). Python
       # keeps the inline preflight below.
       - name: Toolchain preflight
-        if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'python') }}
         run: |
           python3 --version || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — python3 not on PATH after setup-python. This is the runner, not your diff; no install or test ran. Re-run the job; if it persists the mmi-runner python toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
       - run: {{GATE_INSTALL_CMD}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
       # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           command: {{GATE_CMD}}
           max-seconds: {{GATE_MAX_SECONDS}}

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -0,0 +1,6 @@
+{
+  ".github/workflows/agent-pr.yml": {
+    "blob": "3d53d026c1b71f5439ef5781f693802a0375b306",
+    "reason": "comment-only CI waiver placement (#8167), no runtime or operator behaviour change"
+  }
+}

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -8,6 +8,7 @@ concurrency:
   group: gate-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read # #8206: exact-SHA development workflow verdict
   contents: read
   packages: read
 jobs:
@@ -15,26 +16,59 @@ jobs:
     runs-on: [self-hosted, linux, x64, mmi-live]
     timeout-minutes: 10
     steps:
-      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
+      - name: Reuse development gate for rc tag
+        id: development-gate
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          script: |
+            core.setOutput('reuse', 'false');
+            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
+            try {
+              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
+              const { data } = await github.rest.actions.listWorkflowRuns({
+                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
+                event: 'push', head_sha: context.sha, per_page: 100
+              });
+              // API returns newest first: a newer red/pending rerun must not reuse an older green.
+              const run = data.workflow_runs[0];
+              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
+                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
+              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
+                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
+              });
+              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
+              core.setOutput('reuse', 'true');
+              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
+            } catch (error) {
+              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
+            }
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:
           lockfile-path: package-lock.json
           fetch-depth: 0 # #8129: runbook freshness needs the PR merge-base history.
       - name: Runbook guard
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' && (github.event_name == 'pull_request') }}
         uses: mutmutco/MMI-Hub/.github/actions/runbook-guard@{{GATE_RUNBOOK_SHA}}
         with:
           base-ref: origin/${{ github.base_ref }}
       - name: Isolate npm cache
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
       - uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           node-version: 24
           npm-version: '12'
       - run: npm ci --no-audit --no-fund
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
       - run: npm ci --prefix module --no-audit --no-fund
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           command: npm run typecheck && npm run build && npm --prefix module run check
           max-seconds: {{GATE_MAX_SECONDS}}