@opengsd/gsd-core 1.2.0-rc.1

package/scripts/check-npm-integrity.cjs

@@ -0,0 +1,209 @@
+'use strict';
+// check-npm-integrity.cjs — Node.js port of scripts/check-npm-integrity.sh
+// Shell-agnostic replacement for the "Dependency integrity gate" CI step.
+// Invoked as: node scripts/check-npm-integrity.cjs [--ignore-extraneous]
+//
+// Parses package-lock.json in cwd and exits non-zero if any package is:
+//   INVALID    — resolved version does not satisfy declared semver range
+//   MISSING    — declared in package.json but absent from lockfile packages map
+//   EXTRANEOUS — marked extraneous: true in lockfile (unless --ignore-extraneous)
+//
+// Exit codes:
+//   0 = clean
+//   1 = integrity drift detected
+//   2 = tool error (lockfile missing, JSON parse failure, unknown arg)
+
+const fs = require('fs');
+const path = require('path');
+
+// ---- Argument parsing -------------------------------------------------------
+
+let ignoreExtraneous = false;
+
+for (const arg of process.argv.slice(2)) {
+  if (arg === '--ignore-extraneous') {
+    ignoreExtraneous = true;
+  } else if (arg === '--help' || arg === '-h') {
+    process.stdout.write(
+      'Usage: node scripts/check-npm-integrity.cjs [--ignore-extraneous]\n'
+    );
+    process.exit(0);
+  } else {
+    process.stderr.write(`ERROR: Unknown argument: ${arg}\n`);
+    process.exit(2);
+  }
+}
+
+// ---- Locate lockfile --------------------------------------------------------
+
+const lockfilePath = path.join(process.cwd(), 'package-lock.json');
+
+if (!fs.existsSync(lockfilePath)) {
+  process.stderr.write(`ERROR: package-lock.json not found in ${process.cwd()}\n`);
+  process.exit(2);
+}
+
+// ---- Parse lockfile ---------------------------------------------------------
+
+let lock;
+try {
+  lock = JSON.parse(fs.readFileSync(lockfilePath, 'utf-8'));
+} catch (e) {
+  process.stderr.write(`ERROR: Failed to parse package-lock.json: ${e.message}\n`);
+  process.exit(2);
+}
+
+const lockVersion = lock.lockfileVersion || 1;
+if (lockVersion < 2) {
+  process.stderr.write(
+    `ERROR: package-lock.json lockfileVersion ${lockVersion} is not supported. ` +
+    'Run `npm install` to upgrade to v3.\n'
+  );
+  process.exit(2);
+}
+
+const packages = lock.packages || {};
+const rootEntry = packages[''] || {};
+
+// Collect declared dependency ranges from root entry.
+const declaredRanges = {};
+for (const field of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+  for (const [name, range] of Object.entries(rootEntry[field] || {})) {
+    if (!declaredRanges[name]) declaredRanges[name] = range;
+  }
+}
+
+// ---- Minimal semver satisfies -----------------------------------------------
+
+function parseVersion(v) {
+  const m = String(v).match(/^(\d+)\.(\d+)\.(\d+)/);
+  if (!m) return null;
+  return [parseInt(m[1], 10), parseInt(m[2], 10), parseInt(m[3], 10)];
+}
+
+function cmpVersion(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function satisfies(installed, range) {
+  range = String(range).trim();
+  if (!range || range === '*' || range === 'latest') return true;
+  if (/^\d/.test(range)) {
+    const iv = parseVersion(installed);
+    const rv = parseVersion(range);
+    if (!iv || !rv) return installed === range;
+    return cmpVersion(iv, rv) === 0;
+  }
+  if (range[0] === '^') {
+    const base = parseVersion(range.slice(1));
+    const inst = parseVersion(installed);
+    if (!base || !inst) return false;
+    if (cmpVersion(inst, base) < 0) return false;
+    if (base[0] > 0) return inst[0] === base[0];
+    if (base[1] > 0) return inst[0] === 0 && inst[1] === base[1];
+    return inst[0] === 0 && inst[1] === 0 && inst[2] === base[2];
+  }
+  if (range[0] === '~') {
+    const tbase = parseVersion(range.slice(1));
+    const tinst = parseVersion(installed);
+    if (!tbase || !tinst) return false;
+    if (cmpVersion(tinst, tbase) < 0) return false;
+    return tinst[0] === tbase[0] && tinst[1] === tbase[1];
+  }
+  const opMatch = range.match(/^(>=|<=|>|<|=)\s*(.+)/);
+  if (opMatch) {
+    const op = opMatch[1];
+    const ov = parseVersion(opMatch[2]);
+    const iv2 = parseVersion(installed);
+    if (!ov || !iv2) return false;
+    const c = cmpVersion(iv2, ov);
+    if (op === '>=') return c >= 0;
+    if (op === '<=') return c <= 0;
+    if (op === '>')  return c > 0;
+    if (op === '<')  return c < 0;
+    if (op === '=')  return c === 0;
+  }
+  if (range.includes(' ')) {
+    return range.split(/\s+/).every(part => satisfies(installed, part));
+  }
+  return installed === range;
+}
+
+// ---- Walk packages map ------------------------------------------------------
+
+const invalids = [];
+const missings = [];
+const extraneousFound = [];
+
+for (const [key, entry] of Object.entries(packages)) {
+  if (!key.startsWith('node_modules/')) continue;
+  const rest = key.slice('node_modules/'.length);
+  const isScoped = rest[0] === '@';
+  const slashCount = (rest.match(/\//g) || []).length;
+  if (isScoped && slashCount > 1) continue;
+  if (!isScoped && slashCount > 0) continue;
+
+  const pkgName = rest;
+  const installedVersion = entry.version || '';
+
+  if (entry.extraneous) {
+    extraneousFound.push({ name: pkgName, version: installedVersion });
+    continue;
+  }
+
+  if (!declaredRanges[pkgName]) continue;
+
+  if (!satisfies(installedVersion, declaredRanges[pkgName])) {
+    invalids.push({ name: pkgName, version: installedVersion, declared: declaredRanges[pkgName] });
+  }
+}
+
+for (const name of Object.keys(declaredRanges)) {
+  if (!packages[`node_modules/${name}`]) {
+    missings.push({ name, required: declaredRanges[name] });
+  }
+}
+
+// ---- Verdict ----------------------------------------------------------------
+
+const failInvalid = invalids.length > 0;
+const failMissing = missings.length > 0;
+const failExtra   = !ignoreExtraneous && extraneousFound.length > 0;
+
+if (!failInvalid && !failMissing && !failExtra) {
+  process.stderr.write('check-npm-integrity.cjs: clean\n');
+  process.exit(0);
+}
+
+const lines = ['FAIL: dependency integrity drift detected', ''];
+
+if (failInvalid) {
+  lines.push('  INVALID (installed version does not satisfy declared range):');
+  for (const { name, declared, version } of invalids) {
+    lines.push(`    ${name}: declared=${declared}  installed=${version}`);
+  }
+  lines.push('');
+}
+
+if (failMissing) {
+  lines.push('  MISSING (declared but absent from lockfile packages map):');
+  for (const { name, required } of missings) {
+    lines.push(`    ${name}@${required}`);
+  }
+  lines.push('');
+}
+
+if (failExtra) {
+  lines.push('  EXTRANEOUS (in lockfile but not declared as a dependency):');
+  for (const { name, version } of extraneousFound) {
+    lines.push(`    ${name}@${version}`);
+  }
+  lines.push('');
+}
+
+lines.push('Remediation: rm -rf node_modules && npm ci');
+process.stderr.write(lines.join('\n') + '\n');
+process.exit(1);

package/scripts/ci-guard-runner.cjs

@@ -0,0 +1,16 @@
+'use strict';
+// ci-guard-runner.cjs — Assert the current runner is github-hosted.
+// Replaces the inline bash "Guard — require GitHub-hosted runner" step.
+// Shell-agnostic: invoked as `node scripts/ci-guard-runner.cjs` from any shell.
+//
+// Exit 0 = github-hosted runner confirmed.
+// Exit 1 = not a github-hosted runner (emits GitHub Actions error annotation).
+
+const env = process.env.RUNNER_ENVIRONMENT || '';
+
+if (env !== 'github-hosted') {
+  process.stderr.write(
+    `::error::Expected github-hosted runner. RUNNER_ENVIRONMENT=${env || 'unset'}\n`
+  );
+  process.exit(1);
+}

package/scripts/ci-prepare-test-scope.cjs

@@ -0,0 +1,46 @@
+'use strict';
+// ci-prepare-test-scope.cjs — Write .ci-selected-tests.txt for scoped CI runs.
+// Replaces the inline bash "Prepare scoped test list" step.
+// Shell-agnostic: invoked as `node scripts/ci-prepare-test-scope.cjs` from any shell.
+//
+// Required environment variables (set by the workflow step's `env:` block):
+//   TEST_SCOPE       — "windows" | "targeted"
+//   TARGETED_TESTS   — space-separated test file list (from ci-test-scope.cjs output)
+//   WINDOWS_TESTS    — space-separated test file list for the windows lane
+//
+// Writes: .ci-selected-tests.txt (one file per line, no blanks)
+// Exit 0 = success; exit 1 = unknown scope.
+
+const fs = require('fs');
+const path = require('path');
+
+const scope = process.env.TEST_SCOPE || '';
+const targeted = process.env.TARGETED_TESTS || '';
+const windows = process.env.WINDOWS_TESTS || '';
+
+const FALLBACK = 'tests/command-contract.test.cjs tests/commands.test.cjs tests/core.test.cjs tests/package-manifest.test.cjs';
+
+let selected;
+if (scope === 'windows') {
+  selected = windows;
+} else if (scope === 'targeted') {
+  selected = targeted;
+} else {
+  process.stderr.write(`::error::Unknown test scope: ${scope}\n`);
+  process.exit(1);
+}
+
+// Trim and fall back to default set if empty.
+if (!selected.trim()) {
+  selected = FALLBACK;
+}
+
+// Split on whitespace, filter blanks, join with newlines.
+const lines = selected.split(/\s+/).filter(Boolean);
+const content = lines.join('\n') + '\n';
+
+const outPath = path.join(process.cwd(), '.ci-selected-tests.txt');
+fs.writeFileSync(outPath, content, 'utf-8');
+
+process.stdout.write('Scoped tests:\n');
+process.stdout.write(content);

package/scripts/ci-rebase-check.cjs

@@ -0,0 +1,85 @@
+'use strict';
+// ci-rebase-check.cjs — Merge the PR base branch into the current PR head.
+// Replaces the inline bash "Rebase check — merge PR base branch into PR head" step.
+// Shell-agnostic: invoked as `node scripts/ci-rebase-check.cjs` from any shell.
+//
+// Required environment variables (set by the workflow step's `env:` block):
+//   GITHUB_TOKEN    — access token for remote set-url
+//   GITHUB_BASE_REF — PR base branch name (set by GitHub Actions on pull_request events)
+//   GITHUB_REPOSITORY — owner/repo (set by GitHub Actions)
+//
+// Exit 0 = merged cleanly (or merge was a no-op).
+// Exit 1 = merge conflict or fetch failure.
+
+const { execFileSync, execSync } = require('child_process');
+const path = require('path');
+
+function run(cmd, args, opts) {
+  try {
+    execFileSync(cmd, args, { stdio: 'inherit', ...opts });
+    return true; // success sentinel; execFileSync returns null with stdio:'inherit'
+  } catch (e) {
+    return false;
+  }
+}
+
+function runOrThrow(cmd, args, label) {
+  try {
+    execFileSync(cmd, args, { stdio: 'inherit' });
+  } catch (e) {
+    process.stderr.write(`::error::${label} failed\n`);
+    process.exit(1);
+  }
+}
+
+const token = process.env.GITHUB_TOKEN || '';
+const baseBranch = process.env.GITHUB_BASE_REF || 'main';
+const repo = process.env.GITHUB_REPOSITORY || '';
+
+// Configure git identity (needed for merge commit).
+runOrThrow('git', ['config', 'user.email', 'ci@gsd-redux'], 'git config user.email');
+runOrThrow('git', ['config', 'user.name', 'CI Rebase Check'], 'git config user.name');
+
+// Set authenticated remote URL.
+if (token && repo) {
+  runOrThrow(
+    'git',
+    ['remote', 'set-url', 'origin', `https://x-access-token:${token}@github.com/${repo}.git`],
+    'git remote set-url'
+  );
+}
+
+// Fetch base branch with retry.
+let fetched = false;
+for (let attempt = 1; attempt <= 3; attempt++) {
+  const result = run('git', ['fetch', 'origin', baseBranch]);
+  if (result) {
+    fetched = true;
+    break;
+  }
+  if (attempt === 3) {
+    process.stderr.write(`::error::git fetch origin ${baseBranch} failed after 3 attempts.\n`);
+    process.exit(1);
+  }
+  // Wait before retry: attempt * 4 seconds.
+  const waitMs = attempt * 4000;
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) { /* busy wait, acceptable in CI */ }
+}
+
+// Attempt merge.
+try {
+  execFileSync('git', ['merge', '--no-edit', '--no-ff', `origin/${baseBranch}`], { stdio: 'inherit' });
+} catch (e) {
+  process.stderr.write(
+    `::error::This PR cannot cleanly merge origin/${baseBranch}. Rebase your branch onto current ${baseBranch} and push again.\n`
+  );
+  process.stderr.write('::error::Conflicting files:\n');
+  try {
+    execFileSync('git', ['diff', '--name-only', '--diff-filter=U'], { stdio: 'inherit' });
+  } catch (_) { /* ignore */ }
+  try {
+    execFileSync('git', ['merge', '--abort'], { stdio: 'inherit' });
+  } catch (_) { /* ignore */ }
+  process.exit(1);
+}

package/scripts/ci-test-scope.cjs

@@ -0,0 +1,302 @@
+#!/usr/bin/env node
+'use strict';
+
+const { execFileSync } = require('child_process');
+const { existsSync, readdirSync, appendFileSync } = require('fs');
+const { join } = require('path');
+
+const RULES = [
+  {
+    name: 'workflow automation',
+    match: path => path.startsWith('.github/workflows/') || path.startsWith('.github/rulesets/'),
+    fullMatrix: true,
+    tests: [
+      'tests/workflow-shell-pinning.test.cjs',
+      'tests/release-tarball-smoke-workflow.test.cjs',
+      'tests/lint-pr-check-project-dir.test.cjs',
+      'tests/pr-template-policy.test.cjs',
+    ],
+  },
+  {
+    name: 'test harness',
+    match: path => path === 'scripts/run-tests.cjs',
+    fullMatrix: true,
+    tests: [
+      'tests/run-tests-harness.test.cjs',
+      'tests/workflow-shell-pinning.test.cjs',
+    ],
+  },
+  {
+    name: 'environment and dependency gates',
+    match: path => [
+      'scripts/check-env.cjs',
+      'scripts/check-npm-integrity.cjs',
+      'package.json',
+      'package-lock.json',
+    ].includes(path),
+    fullMatrix: true,
+    tests: [
+      'tests/check-env.test.cjs',
+      'tests/npm-integrity-gate.test.cjs',
+      'tests/package-manifest.test.cjs',
+      'tests/bug-3588-npm-audit-clean.test.cjs',
+    ],
+  },
+  {
+    name: 'installer and package layout',
+    match: path => path.startsWith('bin/') ||
+      path.startsWith('get-shit-done/bin/') ||
+      path.includes('install') ||
+      path.includes('release-tarball-smoke'),
+    fullMatrix: true,
+    tests: [
+      'tests/install.test.cjs',
+      'tests/install-regressions.test.cjs',
+      'tests/install-runtime-artifacts.test.cjs',
+      'tests/install-path-detection.test.cjs',
+      'tests/release-tarball-smoke.install.test.cjs',
+      'tests/runtime-artifact-layout.test.cjs',
+    ],
+  },
+  {
+    name: 'hooks',
+    match: path => path.startsWith('hooks/'),
+    fullMatrix: true,
+    tests: [
+      'tests/hook-validation.test.cjs',
+      'tests/managed-hooks.test.cjs',
+      'tests/hooks-opt-in.test.cjs',
+      'tests/sh-hook-paths.test.cjs',
+      'tests/precommit-alias-drift-hook.test.cjs',
+      'tests/prepush-enterprise-email-hook.test.cjs',
+    ],
+  },
+  {
+    name: 'changeset tooling',
+    match: path => path.startsWith('scripts/changeset/') || path.startsWith('.changeset/'),
+    tests: [
+      'tests/changeset-cli.test.cjs',
+      'tests/changeset-lint.test.cjs',
+      'tests/changeset-new.test.cjs',
+      'tests/changeset-parse.test.cjs',
+      'tests/changeset-render.test.cjs',
+      'tests/changeset-serialize.test.cjs',
+      'tests/changeset-github-release-notes.test.cjs',
+    ],
+  },
+  {
+    name: 'security scanners',
+    match: path => path.includes('secret-scan') ||
+      path.includes('base64-scan') ||
+      path.includes('prompt-injection-scan') ||
+      path.startsWith('tests/fixtures/adversarial/security/'),
+    tests: [
+      'tests/secret-scan-lint.test.cjs',
+      'tests/prompt-injection-scan.test.cjs',
+      'tests/security-prompt-injection.test.cjs',
+      'tests/read-injection-scanner.test.cjs',
+      'tests/security-scan.test.cjs',
+    ],
+  },
+  {
+    name: 'command definitions',
+    match: path => path.startsWith('commands/'),
+    tests: [
+      'tests/command-contract.test.cjs',
+      'tests/command-routing-hub.test.cjs',
+      'tests/commands.test.cjs',
+      'tests/docs-parity-live-registry.test.cjs',
+      'tests/phase-command-router.test.cjs',
+      'tests/roadmap-command-router.test.cjs',
+    ],
+  },
+  {
+    name: 'workflow prompts',
+    match: path => path.startsWith('get-shit-done/workflows/'),
+    tests: [
+      'tests/workflow-compat.test.cjs',
+      'tests/workflow-size-budget.test.cjs',
+      'tests/workflow-guard-registration.test.cjs',
+      'tests/commands.test.cjs',
+      'tests/bug-3683-workflow-colon-namespace-leak.test.cjs',
+    ],
+  },
+  {
+    name: 'agent prompts',
+    match: path => path.startsWith('agents/'),
+    tests: [
+      'tests/agent-frontmatter.test.cjs',
+      'tests/agent-size-budget.test.cjs',
+      'tests/agent-skills.test.cjs',
+      'tests/agent-skills-awareness.test.cjs',
+      'tests/agent-required-reading-consistency.test.cjs',
+      'tests/docs-parity-live-registry.test.cjs',
+    ],
+  },
+  {
+    name: 'docs content',
+    match: path => path.startsWith('docs/'),
+    fullMatrix: false,
+    tests: [
+      'tests/docs-parity-live-registry.test.cjs',
+    ],
+  },
+  {
+    name: 'configuration',
+    match: path => /config|configuration|model-catalog|model-profile/.test(path),
+    tests: [
+      'tests/config.test.cjs',
+      'tests/config-get-default.test.cjs',
+      'tests/configuration-migrate-config.test.cjs',
+      'tests/model-catalog-runtime-defaults.test.cjs',
+      'tests/model-profiles.test.cjs',
+    ],
+  },
+];
+
+function usage() {
+  return [
+    'Usage:',
+    '  node scripts/ci-test-scope.cjs --base <sha> --head <sha>',
+    '  node scripts/ci-test-scope.cjs --files <path-list>',
+    '',
+    'Prints JSON by default. With GITHUB_OUTPUT set, also writes workflow outputs.',
+  ].join('\n');
+}
+
+function parseArgs(argv) {
+  const out = { base: null, head: null, files: null };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--base') {
+      out.base = argv[++i];
+      if (!out.base || out.base.startsWith('--')) throw new Error('--base requires a value');
+    } else if (arg.startsWith('--base=')) {
+      out.base = arg.slice('--base='.length);
+      if (!out.base) throw new Error('--base requires a value');
+    } else if (arg === '--head') {
+      out.head = argv[++i];
+      if (!out.head || out.head.startsWith('--')) throw new Error('--head requires a value');
+    } else if (arg.startsWith('--head=')) {
+      out.head = arg.slice('--head='.length);
+      if (!out.head) throw new Error('--head requires a value');
+    } else if (arg === '--files') {
+      out.files = argv[++i];
+      if (!out.files || out.files.startsWith('--')) throw new Error('--files requires a value');
+    } else if (arg.startsWith('--files=')) {
+      out.files = arg.slice('--files='.length);
+      if (!out.files) throw new Error('--files requires a value');
+    } else if (arg === '--help' || arg === '-h') {
+      console.log(usage());
+      process.exit(0);
+    } else {
+      throw new Error(`unknown argument: ${arg}`);
+    }
+  }
+  return out;
+}
+
+function splitFiles(value) {
+  if (!value) return [];
+  return value.split(/[,\s]+/).map(v => v.trim()).filter(Boolean);
+}
+
+function changedFiles(args) {
+  if (args.files) return splitFiles(args.files);
+  if (!args.base || !args.head) {
+    throw new Error('--base/--head or --files is required');
+  }
+  const stdout = execFileSync('git', ['diff', '--name-only', args.base, args.head], {
+    encoding: 'utf8',
+  });
+  return splitFiles(stdout);
+}
+
+function existingTests(files) {
+  const all = new Set(readdirSync('tests').filter(f => f.endsWith('.test.cjs')).map(f => `tests/${f}`));
+  return files.filter(file => all.has(file) && existsSync(file));
+}
+
+function addAll(set, values) {
+  for (const value of values) set.add(value);
+}
+
+function classify(files) {
+  const targeted = new Set();
+  const windows = new Set();
+  const reasons = [];
+  let codeChanged = false;
+  let fullMatrix = false;
+
+  for (const file of files) {
+    if (/^(bin|get-shit-done|agents|commands|docs|hooks|tests|scripts)\//.test(file) ||
+      /^package(-lock)?\.json$/.test(file) ||
+      /^tsconfig.*\.json$/.test(file) ||
+      file.startsWith('.github/workflows/') ||
+      file.startsWith('.github/rulesets/')) {
+      codeChanged = true;
+    }
+
+    if (file.startsWith('tests/') && file.endsWith('.test.cjs')) {
+      targeted.add(file);
+      fullMatrix = true;
+      if (/windows|path|shell|workflow|install|hook/i.test(file)) {
+        windows.add(file);
+      }
+    }
+
+    for (const rule of RULES) {
+      if (rule.match(file)) {
+        addAll(targeted, rule.tests);
+        reasons.push(`${file}: ${rule.name}`);
+        if (rule.fullMatrix) fullMatrix = true;
+      }
+    }
+  }
+
+  const targetedTests = existingTests([...targeted].sort());
+
+  // When code changed but no rule matched any changed file, fall back to the
+  // unit suite so the targeted lane always runs something meaningful (#408).
+  if (codeChanged && targetedTests.length === 0) {
+    targetedTests.push('unit');
+  }
+
+  const windowsTests = existingTests([...new Set([...windows, ...targetedTests.filter(t => /windows|path|shell|workflow|install|hook/i.test(t))])].sort());
+
+  return {
+    code_changed: codeChanged,
+    full_matrix: fullMatrix,
+    targeted_tests: targetedTests,
+    windows_tests: windowsTests,
+    reasons: [...new Set(reasons)].sort(),
+  };
+}
+
+function writeOutputs(result) {
+  if (!process.env.GITHUB_OUTPUT) return;
+  const lines = [
+    `code_changed=${result.code_changed}`,
+    `full_matrix=${result.full_matrix}`,
+    `targeted_tests=${result.targeted_tests.join(' ')}`,
+    `windows_tests=${result.windows_tests.join(' ')}`,
+  ];
+  appendFileSync(process.env.GITHUB_OUTPUT, `${lines.join('\n')}\n`);
+}
+
+function main() {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    const files = changedFiles(args);
+    const result = classify(files);
+    result.changed_files = files;
+    writeOutputs(result);
+    console.log(JSON.stringify(result, null, 2));
+  } catch (error) {
+    console.error(`ci-test-scope: ${error.message}`);
+    console.error(usage());
+    process.exit(2);
+  }
+}
+
+main();