@plainconceptsplatform/workflows 0.3.2 → 0.4.0

package/dist/catalog-installation.js

@@ -133,10 +133,13 @@ export function isTemplateName(value) {
 }
 export async function ensurePreCommitHook(repositoryPath) {
     const hookPath = join(repositoryPath, ".husky", "pre-commit");
-    if (!await exists(hookPath))
+    const compileLine = "node scripts/compile-agent-workflows.mjs";
+    if (!await exists(hookPath)) {
+        await mkdir(dirname(hookPath), { recursive: true });
+        await writeFile(hookPath, `${compileLine}\n`, "utf8");
         return;
+    }
     const content = await readFile(hookPath, "utf8");
-    const compileLine = "node scripts/compile-agent-workflows.mjs";
     if (content.includes("compile-agent-workflows"))
         return;
     const newContent = content.endsWith("\n") || content === ""

package/dist/catalog-installation.test.js

@@ -2,7 +2,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { catalogSourcePath, installCatalog, installMandatoryFiles, installTemplate } from "./catalog-installation.js";
+import { catalogSourcePath, ensurePreCommitHook, installCatalog, installMandatoryFiles, installTemplate } from "./catalog-installation.js";
 const temporaryDirectories = [];
 afterEach(async () => {
     await Promise.all(temporaryDirectories.splice(0).map((directory) => rm(directory, { force: true, recursive: true })));
@@ -243,6 +243,19 @@ describe("catalog installation", () => {
         const compileEntries = result.installed.filter((path) => path === "scripts/compile-agent-workflows.mjs");
         expect(compileEntries).toHaveLength(1);
     });
+    it("creates a Husky pre-commit hook when the consumer has none", async () => {
+        const repositoryPath = await createDirectory({});
+        await ensurePreCommitHook(repositoryPath);
+        await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
+            .resolves.toBe("node scripts/compile-agent-workflows.mjs\n");
+    });
+    it("keeps existing pre-commit commands and appends the compiler once", async () => {
+        const repositoryPath = await createDirectory({ ".husky/pre-commit": "pnpm lint\n" });
+        await ensurePreCommitHook(repositoryPath);
+        await ensurePreCommitHook(repositoryPath);
+        await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
+            .resolves.toBe("pnpm lint\nnode scripts/compile-agent-workflows.mjs\n");
+    });
     it("installs the opencode.ci.json template to the repository root", async () => {
         const sourcePath = await createDirectory({
             "templates/opencode/opencode.ci.json": "{ \"model\": \"plainconcepts/glm-5-2\" }\n",

package/dist/repository-inspection.js

@@ -46,11 +46,33 @@ export function parseVisibility(value) {
     return value === "public" || value === "private" ? value : undefined;
 }
 async function findSolutionFiles(repositoryPath) {
-    const entries = await readdir(repositoryPath, { recursive: true, withFileTypes: true });
-    return entries
-        .filter((entry) => entry.isFile() && entry.name.endsWith(".slnx"))
-        .map((entry) => entry.parentPath === undefined ? entry.name : join(entry.parentPath, entry.name))
-        .sort();
+    const results = [];
+    await scanForSlnx(repositoryPath, "", results, 0);
+    return results.sort();
+}
+const MAX_DEPTH = 5;
+const SKIP_DIRS = new Set(["node_modules", ".git", ".next", "dist", "out", "build", ".turbo", ".cache"]);
+async function scanForSlnx(root, relativePath, results, depth) {
+    if (depth >= MAX_DEPTH)
+        return;
+    const currentPath = join(root, relativePath);
+    let entries;
+    try {
+        entries = await readdir(currentPath, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            await scanForSlnx(root, join(relativePath, entry.name), results, depth + 1);
+        }
+        else if (entry.isFile() && entry.name.endsWith(".slnx")) {
+            results.push(relativePath === "" ? entry.name : join(relativePath, entry.name));
+        }
+    }
 }
 async function pathExists(path) {
     try {

package/dist/repository-inspection.test.js

@@ -24,7 +24,7 @@ describe("repository inspection", () => {
             stackHints: {
                 packageJson: true,
                 pnpmLockfile: true,
-                solutionFiles: [join(repositoryPath, "apps", "api", "Numa.slnx")],
+                solutionFiles: [join("apps", "api", "Numa.slnx")],
                 openSpec: true,
             },
         });

package/dist/route-processing.js

@@ -72,17 +72,46 @@ export function processRoutes(files, selectedRoutes) {
         if (routerKey !== undefined) {
             result.set(routerKey, stripRouteFromRouter(result.get(routerKey), route));
         }
-        const classifierKey = findFileKey(result, "classify-route.sh");
-        if (classifierKey !== undefined) {
-            result.set(classifierKey, stripRouteFromClassifier(result.get(classifierKey), route));
-        }
         const matrixKey = findFileKey(result, "verify-route-matrix.sh");
         if (matrixKey !== undefined) {
             result.set(matrixKey, addRouteExclusion(result.get(matrixKey), route));
         }
     }
+    const matrixKey = findFileKey(result, "verify-route-matrix.sh");
+    if (matrixKey !== undefined) {
+        result.set(matrixKey, createRouteMatrix(selectedRoutes));
+    }
     return result;
 }
+function createRouteMatrix(selectedRoutes) {
+    const selected = selectedRoutes.join(" ");
+    const excluded = routeNames.filter((route) => !selectedRoutes.includes(route)).join(" ");
+    return `#!/usr/bin/env bash
+set -euo pipefail
+
+HERE="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+ROUTER_YML="\${HERE}/../../workflows/work-router.yml"
+CLASSIFIER="\${HERE}/../classify-route/classify-route.sh"
+
+bash -n "$CLASSIFIER"
+
+for route in ${selected}; do
+  grep -q "route == '$route'" "$ROUTER_YML" || {
+    echo "FAIL: selected route '$route' has no router job" >&2
+    exit 1
+  }
+done
+
+for route in ${excluded}; do
+  if grep -q "route == '$route'" "$ROUTER_YML"; then
+    echo "FAIL: excluded route '$route' remains in router" >&2
+    exit 1
+  fi
+done
+
+echo "Route matrix: selected routes valid"
+`;
+}
 export function excludedWorkerFiles(selectedRoutes) {
     return new Set(workflowRoutes
         .filter((route) => !selectedRoutes.includes(route.name))

package/dist/route-processing.test.js

@@ -259,11 +259,10 @@ describe("processRoutes", () => {
         expect(router).not.toContain("- propose");
         expect(router).not.toContain("- refine");
         const classifier = result.get(".github/actions/classify-route/classify-route.sh");
-        expect(classifier).not.toContain("readonly PROPOSE_CRON");
-        expect(classifier).not.toContain("readonly AUDIT_CRON");
+        expect(classifier).toBe(CLASSIFIER_SH);
         const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
-        expect(matrix).toContain("excluded route 'propose'");
-        expect(matrix).toContain("excluded route 'refine'");
+        expect(matrix).toContain("Route matrix: selected routes valid");
+        expect(matrix).toContain("for route in refine implement direct apply-review merge-gate audit propose");
     });
     it("strips propose from all three files when unselected", () => {
         const files = new Map([
@@ -278,10 +277,10 @@ describe("processRoutes", () => {
         expect(router).not.toContain('cron: "29 7 * * *"');
         expect(router).not.toMatch(/^\s+- propose$/m);
         const classifier = result.get(".github/actions/classify-route/classify-route.sh");
-        expect(classifier).not.toContain("readonly PROPOSE_CRON");
-        expect(classifier).not.toContain('"$PROPOSE_CRON")');
+        expect(classifier).toBe(CLASSIFIER_SH);
         const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
-        expect(matrix).toContain("excluded route 'propose'");
+        expect(matrix).toContain("for route in refine implement direct apply-review merge-gate audit");
+        expect(matrix).toContain("for route in propose");
     });
     it("strips audit from all three files when unselected", () => {
         const files = new Map([
@@ -295,8 +294,7 @@ describe("processRoutes", () => {
         expect(router).not.toContain("call-audit");
         expect(router).not.toContain('cron: "17 1 * * 1"');
         const classifier = result.get("classify-route.sh");
-        expect(classifier).not.toContain("readonly AUDIT_CRON");
-        expect(classifier).not.toContain('"$AUDIT_CRON")');
+        expect(classifier).toBe(CLASSIFIER_SH);
     });
     it("processes multiple excluded routes at once", () => {
         const files = new Map([

package/dist/stack-defaults.js

@@ -20,8 +20,6 @@ export function generateStackDefaults(inspection) {
 }
 export function injectStackEnv(content, defaults) {
     let result = content;
-    if (defaults.verifyCommands === "pnpm verify")
-        return result;
     if (result.includes("VERIFY_COMMANDS:")) {
         result = result.replace(/  VERIFY_COMMANDS: ".*"/, `  VERIFY_COMMANDS: "${defaults.verifyCommands}"`);
     }
@@ -33,6 +31,7 @@ export function injectStackEnv(content, defaults) {
 export function generateOpencodeCi(baseContent, inspection) {
     let result = baseContent;
     if (inspection.stackHints.solutionFiles.length > 0) {
+        const solutionPath = inspection.stackHints.solutionFiles[0];
         const nugetSteps = `  - name: Cache NuGet packages
     uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
     with:
@@ -40,8 +39,8 @@ export function generateOpencodeCi(baseContent, inspection) {
       key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
       restore-keys: nuget-\${{ runner.os }}-
 
-  - name: Restore .NET dependencies
-    run: dotnet restore
+   - name: Restore .NET dependencies
+    run: dotnet restore ${solutionPath}
 `;
         result = insertBeforeMarker(result, nugetSteps, "  - name: Install workspace dependencies");
     }
@@ -49,7 +48,7 @@ export function generateOpencodeCi(baseContent, inspection) {
         const openspecStep = `  - name: Install OpenSpec CLI
     run: |
       set -euo pipefail
-      npm install -g @openspec/cli@latest
+      npm install -g "@fission-ai/openspec@1.8.0"
       openspec --version
 `;
         result = insertBeforeMarker(result, openspecStep, "  - name: Install workspace dependencies");

package/dist/stack-defaults.test.js

@@ -76,7 +76,7 @@ description: test
         const result = injectStackEnv(content, defaults);
         expect(result).toContain('VERIFY_COMMANDS: "dotnet restore && dotnet build -c Release --no-restore && dotnet test"');
     });
-    it("does not inject when verifyCommands is pnpm verify (the default)", () => {
+    it("injects pnpm verification when no .slnx is present", () => {
         const content = `---
 env:
   REPO_RULES: "some rules"
@@ -85,7 +85,7 @@ env:
             pnpmLockfile: true,
         }));
         const result = injectStackEnv(content, defaults);
-        expect(result).not.toContain("VERIFY_COMMANDS");
+        expect(result).toContain('VERIFY_COMMANDS: "pnpm verify"');
     });
 });
 const OPENCODE_CI_MD = `---
@@ -113,20 +113,20 @@ pre-agent-steps:
       jq -e . "$FRAGMENT" > /dev/null
 ---`;
 describe("generateOpencodeCi", () => {
-    it("adds NuGet cache and dotnet restore steps when .slnx is found", () => {
+    it("adds NuGet cache and restores detected solution when .slnx is found", () => {
         const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
-            solutionFiles: ["app.slnx"],
+            solutionFiles: ["apps/api/Numa.slnx"],
         }));
         expect(result).toContain("Cache NuGet packages");
         expect(result).toContain("Restore .NET dependencies");
-        expect(result).toContain("dotnet restore");
+        expect(result).toContain("dotnet restore apps/api/Numa.slnx");
     });
-    it("adds OpenSpec CLI install step when openspec/ directory exists", () => {
+    it("adds the pinned OpenSpec CLI install step when openspec/ directory exists", () => {
         const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
             openSpec: true,
         }));
         expect(result).toContain("Install OpenSpec CLI");
-        expect(result).toContain("@openspec/cli");
+        expect(result).toContain("@fission-ai/openspec@1.8.0");
     });
     it("adds both NuGet and OpenSpec steps when both are detected", () => {
         const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({

package/loops/scripts/compile-agent-workflows.mjs

@@ -1,6 +1,7 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 const workflowDirectory = existsSync("loops/workflows") ? "loops/workflows" : ".github/workflows";
 
@@ -21,9 +22,22 @@ const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir"
   shell: false,
 });
 
-if (compile.error?.code === "ENOENT" || compile.status === null) {
+if (compile.error?.code === "ENOENT" || compile.status === null) {
   process.stderr.write("Could not run `gh aw compile`. Install githubnext/gh-aw first.\n");
   process.exit(1);
-}
-
-process.exit(compile.status ?? 1);
+}
+
+if (compile.status !== 0) process.exit(compile.status ?? 1);
+
+for (const file of readdirSync(workflowDirectory)) {
+  if (!file.endsWith(".lock.yml")) continue;
+
+  const path = join(workflowDirectory, file);
+  const content = readFileSync(path, "utf8");
+  const patched = content
+    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
+    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
+    .replaceAll("--log-level DEBUG", "--log-level ERROR");
+
+  if (patched !== content) writeFileSync(path, patched);
+}

package/loops/templates/opencode/opencode.ci.json

@@ -13,7 +13,8 @@
   "permission": {
     "read": "allow",
     "external_directory": {
-      "/tmp/**": "allow"
+      "/tmp/**": "allow",
+      "/home/runner/work/_temp/gh-aw/**": "allow"
     }
   },
   "lsp": {

package/loops/workflows/shared/platform-defaults.md

@@ -8,6 +8,8 @@ network:
     - forge.plainconcepts.com
     - node
     - github
+    - dotnet
+    - fonts
 
 safe-outputs:
   threat-detection: false

package/loops/workflows/work-router.yml

@@ -39,7 +39,7 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
   workflow_run:
-    workflows: ["App: CI"]
+    workflows: ["App: CI", "CI"]
     types: [completed]
     branches:
       - "fix/*"
@@ -142,7 +142,10 @@ jobs:
               ;;
           esac
 
-          if [ "$ACTOR" = "github-actions[bot]" ]; then
+          # Platform bot owns Safe Outputs. Its label changes must be able to
+          # start the follow-on worker, even though GitHub does not report it
+          # as a repository collaborator.
+          if [ "$ACTOR" = "github-actions[bot]" ] || [ "$ACTOR" = "platform-devbox[bot]" ]; then
             echo "trusted=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",