@ogygie/cli 0.20.0 → 0.22.0

package/dist/cli.js

@@ -21465,6 +21465,30 @@ var governedChecksumsByVersion = {
     "scripts/verify-specs.ts": "92d54aa5111fe0753aa9d6eb3b4ac89a7f24fa06578ea3369ccb0dc9d4c3dd88",
     "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
   },
+  "0.21.0": {
+    ".github/workflows/ogygie-gates.yml": "c1a05da24a2af4f68bbaae42c17e3dfba88ee44a2411291ce1163a2695b62f36",
+    "AGENTS.md": "8356696ef27c53cad164ab0086163454348b18852b121eca9fb050fb73e625f0",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "scripts/lint-interdits.ts": "4644e1aaabc1d19ed42a0bdf8e2e55b9451f789d87d59754bce3432de7c357e7",
+    "scripts/ogygie-design-brief.ts": "aba1585717b30808dd0bc8930a37a1ad2d83ee6869f969dbd06ca595e37a4a89",
+    "scripts/ogygie-impact.ts": "f06cc8b4a46ddfbcfb32ba747c2454548ca49918123d04ab13d210b4a89c1fb9",
+    "scripts/verify-contracts.ts": "9cd64c88dcc3b54b65bf1e1b7a68eb00353ee16f2a9ce8bca3c49ba063c2a08b",
+    "scripts/verify-manifest.ts": "6c448fa3a19b87666f686ca57c6ca834d9e169b1380e4fe6e4c19b995bf94f3c",
+    "scripts/verify-specs.ts": "92d54aa5111fe0753aa9d6eb3b4ac89a7f24fa06578ea3369ccb0dc9d4c3dd88",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
+  "0.22.0": {
+    ".github/workflows/ogygie-gates.yml": "c1a05da24a2af4f68bbaae42c17e3dfba88ee44a2411291ce1163a2695b62f36",
+    "AGENTS.md": "8356696ef27c53cad164ab0086163454348b18852b121eca9fb050fb73e625f0",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "scripts/lint-interdits.ts": "4644e1aaabc1d19ed42a0bdf8e2e55b9451f789d87d59754bce3432de7c357e7",
+    "scripts/ogygie-design-brief.ts": "aba1585717b30808dd0bc8930a37a1ad2d83ee6869f969dbd06ca595e37a4a89",
+    "scripts/ogygie-impact.ts": "f06cc8b4a46ddfbcfb32ba747c2454548ca49918123d04ab13d210b4a89c1fb9",
+    "scripts/verify-contracts.ts": "9cd64c88dcc3b54b65bf1e1b7a68eb00353ee16f2a9ce8bca3c49ba063c2a08b",
+    "scripts/verify-manifest.ts": "6c448fa3a19b87666f686ca57c6ca834d9e169b1380e4fe6e4c19b995bf94f3c",
+    "scripts/verify-specs.ts": "92d54aa5111fe0753aa9d6eb3b4ac89a7f24fa06578ea3369ccb0dc9d4c3dd88",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
   "0.3.0": {
     ".github/workflows/ogygie-gates.yml": "48c40efe9fe66dd0f9c3b94287026d80eae9afd6782b5833fdf8846d8662babf",
     "AGENTS.md": "ca73ab619d8c55fac11858d815bf5fbab6537ecebe7ae4123cbdeb3e3e36bf1a",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/cli",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Ogygie framework CLI: deterministic scaffolding (init), governed-file upgrades (upgrade) and lockstep verification (check) for Ogygie products.",
   "license": "MIT",
   "repository": {
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@ogygie/core": "0.20.0",
+    "@ogygie/core": "0.22.0",
     "@types/node": "^24.0.0",
     "esbuild": "^0.28.0",
     "tsx": "^4.20.0",

package/templates/project/ci/ogygie-gates.yml

@@ -7,12 +7,10 @@ on:
     branches: [main, "spec/**"]
   pull_request:
 
-# Least-privilege token: gitleaks-action reads the PR's commit list on
-# pull_request events; PR comments stay disabled so no write scope is needed.
-# The one job that writes (speculate) raises its own permission, alone.
+# Least-privilege token: the gates only read the checkout. The one job that
+# writes (speculate) raises its own permission, alone.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   verifier:
@@ -35,10 +33,22 @@ jobs:
       - run: pnpm lint                     # any, ts-ignore, raw-db, dangerouslySetInnerHTML
       - run: pnpm test
       # Security
-      - uses: gitleaks/gitleaks-action@v2  # committed secrets
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GITLEAKS_ENABLE_COMMENTS: "false"
+      # Committed secrets: the gitleaks binary, pinned by version and checksum.
+      # Its GitHub action asks for a licence key as soon as the repository
+      # belongs to an organization; the binary asks for nothing. A pull request
+      # scans its own commits and a push the ones it brings, so a leak already
+      # dealt with in the past does not keep the gate red.
+      - env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+          RANGE: "${{ github.event_name == 'pull_request' && format('{0}..{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.sha) }}"
+        run: |
+          curl -sSLo "$RUNNER_TEMP/gitleaks.tar.gz" "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          echo "${GITLEAKS_SHA256}  $RUNNER_TEMP/gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/gitleaks.tar.gz" -C "$RUNNER_TEMP" gitleaks
+          # A branch born with this push has no "before": the whole history is scanned.
+          case "$RANGE" in 0000000000000000000000000000000000000000..*) RANGE="" ;; esac
+          "$RUNNER_TEMP/gitleaks" git --redact --no-banner ${RANGE:+--log-opts="$RANGE"} .
       - uses: semgrep/semgrep-action@v1    # dangerous patterns (SAST)
         with: { config: "p/typescript p/owasp-top-ten" }
       - run: pnpm audit --audit-level=high # dependency CVEs
@@ -64,7 +74,8 @@ jobs:
   # of a screen. The first schemas.ts of a NEW feature is drawn by the model and
   # judged by the gates, written once; refused twice, the pull request gets the
   # needs-operator label and nothing is generated. The holes are filled — library, draw, escalation — with the client's model key
-  # (a repo secret), the test of a candidate running without it. A repo
+  # (a repo secret), the test of a candidate running without it; the body of a
+  # custom view is one of them, and gets the same label when no candidate is green. A repo
   # without the generator installed is told so, and the branch is left as is.
   # With OGYGIE_CI_TOKEN (a token allowed to push to spec/* branches), the
   # commit it pushes gets its own checks; with the default token, it does not.
@@ -115,7 +126,7 @@ jobs:
           PR_NUMBER="$(gh pr list --head "$GITHUB_REF_NAME" --state open --json number --jq '.[0].number' 2>/dev/null || true)"
           if [ "${SCHEMAS_STATUS:-0}" = "2" ]; then
             if [ -n "$PR_NUMBER" ]; then
-              gh label create needs-operator --force --color D9A35A --description "Le premier schemas.ts de la feature attend l'opérateur : les gates l'ont refusé deux fois." >/dev/null
+              gh label create needs-operator --force --color D9A35A --description "La spec attend un geste de l'opérateur : un schemas.ts refusé deux fois, ou le corps d'une vue custom sans candidat vert." >/dev/null
               gh pr edit "$PR_NUMBER" --add-label needs-operator
             fi
             echo "ogygie-gates — le schemas.ts de $SPEC_ID attend l'opérateur (needs-operator) : rien n'est généré sur la branche."
@@ -133,7 +144,16 @@ jobs:
           # runs in a process that holds no secret. Absent, the library alone.
           pnpm exec ogygie generate fill "$SPEC_ID" || FILL_STATUS=$?
           pnpm exec ogygie generate verify
-          if [ "${FILL_STATUS:-0}" != "0" ]; then
+          if [ "${FILL_STATUS:-0}" = "2" ]; then
+            # The body of a custom view (hosted mode, the body as a hole): no candidate
+            # rendered its example — the operator writes it. The label says so; the
+            # view's own test stays red until then, so the pull request does too.
+            if [ -n "$PR_NUMBER" ]; then
+              gh label create needs-operator --force --color D9A35A --description "La spec attend un geste de l'opérateur : un schemas.ts refusé deux fois, ou le corps d'une vue custom sans candidat vert." >/dev/null
+              gh pr edit "$PR_NUMBER" --add-label needs-operator
+            fi
+            echo "ogygie-gates — le corps d'une vue custom de $SPEC_ID attend l'opérateur (needs-operator) : son test d'exemple reste rouge."
+          elif [ "${FILL_STATUS:-0}" != "0" ]; then
             echo "ogygie-gates — des trous restent à l'humain, ou le plafond du modèle est atteint : voir le journal ci-dessus."
           fi
           # The previews of a screen (spec ogygie-hosted-mode B10): a page per

package/templates/project/package.json

@@ -27,7 +27,7 @@
     "@types/node": "^24.0.0",
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",
-    "vitest": "^3.2.0",
+    "vitest": "^4.1.12",
     "zod": "^4.0.0"
   }
 }