@plainconceptsplatform/workflows 0.3.2 → 0.4.1

package/README.md

@@ -48,7 +48,7 @@ Route names: refine, implement, direct, apply-review, merge-gate, audit, propose
 
 Use `workflows update --force` to force-overwrite managed files that differ from the package source.
 
-Install optional standalone templates with `add --template`. Available templates are `agentics-checks`, `agentics-maintenance`, `app-ci-dotnet-next`, and `app-ci-node-monorepo`. CI templates are stack-specific copies, not a combined template. Edit their top-level `env:` values for repository paths, package names, and commands.
+Install optional standalone templates with `add --template`. Available templates are `agentics-checks`, `agentics-maintenance`, `app-ci-dotnet-next`, `app-ci-node-monorepo`, and `github-release`. CI templates are stack-specific copies, not a combined template. `github-release` publishes generated release notes when a `v*` tag is pushed. Edit their top-level `env:` values for repository paths, package names, and commands.
 
 ## List and search
 

package/dist/catalog-installation.d.ts

@@ -9,6 +9,7 @@ export interface CatalogInstallOptions {
     readonly sourcePath?: string;
     readonly selectedRoutes?: readonly RouteName[];
     readonly inspection?: RepositoryInspection;
+    readonly compile?: (repositoryPath: string) => Promise<void>;
 }
 interface CatalogFile {
     readonly source: string;

package/dist/catalog-installation.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { access, copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { access, copyFile, cp, mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { constants } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -33,13 +33,6 @@ export async function installCatalog(repositoryPath, options = {}) {
         const fileName = file.target.split("/").pop() ?? "";
         return !excluded.has(fileName);
     });
-    const managedFiles = filtered.filter((file) => file.managed);
-    const conflicts = (await Promise.all(managedFiles.map(async (file) => {
-        const destination = join(repositoryPath, file.target);
-        return await exists(destination) && !(await filesMatch(file.source, destination)) ? file.target : undefined;
-    }))).filter((file) => file !== undefined);
-    if (conflicts.length > 0 && !options.force)
-        return { installed: [], conflicts };
     const fileContents = new Map();
     for (const file of filtered) {
         fileContents.set(file.target, await readFile(file.source, "utf8"));
@@ -50,21 +43,14 @@ export async function installCatalog(repositoryPath, options = {}) {
         processedContents = injectStackIntoWorkers(processedContents, defaults);
         processedContents = transformOpencodeFiles(processedContents, options.inspection);
     }
-    await Promise.all([...processedContents.entries()].map(async ([target, content]) => {
-        const destination = join(repositoryPath, target);
-        const originalFile = filtered.find((f) => f.target === target);
-        if (originalFile !== undefined && !originalFile.managed && await exists(destination))
-            return;
-        await mkdir(dirname(destination), { recursive: true });
-        await writeFile(destination, content, "utf8");
-    }));
-    await ensurePreCommitHook(repositoryPath);
-    try {
-        await runCompileIfAvailable(repositoryPath);
-    }
-    catch {
-        // compile failure is non-fatal
-    }
+    const updates = [...processedContents.entries()]
+        .filter(([target]) => filtered.find((file) => file.target === target)?.managed ?? true)
+        .map(([target, content]) => ({ target, content }));
+    const conflicts = await conflictingTargets(repositoryPath, updates);
+    if (conflicts.length > 0 && !options.force)
+        return { installed: [], conflicts };
+    const stagedLocks = await validateStagedCatalog(repositoryPath, updates, options.compile);
+    await applyTransaction(repositoryPath, [...updates, ...stagedLocks, await preCommitHookUpdate(repositoryPath)]);
     return { installed: [...processedContents.keys()].sort(), conflicts };
 }
 function injectStackIntoWorkers(files, defaults) {
@@ -121,28 +107,30 @@ export async function installMandatoryFiles(repositoryPath, options = {}) {
     }))).filter((file) => file !== undefined);
     if (conflicts.length > 0 && !options.force)
         return { installed: [], conflicts };
-    await Promise.all(files.map(async (file) => {
-        const destination = join(repositoryPath, file.target);
-        await mkdir(dirname(destination), { recursive: true });
-        await copyFile(file.source, destination);
-    }));
+    const updates = await Promise.all(files.map(async (file) => ({ target: file.target, content: await readFile(file.source, "utf8") })));
+    await applyTransaction(repositoryPath, [...updates, await preCommitHookUpdate(repositoryPath)]);
     return { installed: files.map((file) => file.target), conflicts };
 }
 export function isTemplateName(value) {
     return templateNames.includes(value);
 }
 export async function ensurePreCommitHook(repositoryPath) {
-    const hookPath = join(repositoryPath, ".husky", "pre-commit");
-    if (!await exists(hookPath))
-        return;
-    const content = await readFile(hookPath, "utf8");
+    const update = await preCommitHookUpdate(repositoryPath);
+    await applyTransaction(repositoryPath, [update]);
+}
+async function preCommitHookUpdate(repositoryPath) {
+    const target = ".husky/pre-commit";
+    const hookPath = join(repositoryPath, target);
     const compileLine = "node scripts/compile-agent-workflows.mjs";
+    if (!await exists(hookPath)) {
+        return { target, content: `${compileLine}\n` };
+    }
+    const content = await readFile(hookPath, "utf8");
     if (content.includes("compile-agent-workflows"))
-        return;
-    const newContent = content.endsWith("\n") || content === ""
-        ? `${content}${compileLine}\n`
-        : `${content}\n${compileLine}\n`;
-    await writeFile(hookPath, newContent, "utf8");
+        return { target, content };
+    return { target, content: content.endsWith("\n") || content === ""
+            ? `${content}${compileLine}\n`
+            : `${content}\n${compileLine}\n` };
 }
 export async function runCompileIfAvailable(repositoryPath) {
     const script = join(repositoryPath, "scripts", "compile-agent-workflows.mjs");
@@ -150,11 +138,93 @@ export async function runCompileIfAvailable(repositoryPath) {
         await execFileAsync("node", [script, "--force"], { cwd: repositoryPath });
     }
 }
+async function conflictingTargets(repositoryPath, updates) {
+    const conflicts = (await Promise.all(updates.map(async ({ target, content }) => {
+        const destination = join(repositoryPath, target);
+        if (!await exists(destination))
+            return undefined;
+        return (await readFile(destination, "utf8")) === content ? undefined : target;
+    }))).filter((target) => target !== undefined);
+    return [...new Set(conflicts)].sort();
+}
+async function validateStagedCatalog(repositoryPath, updates, compileOverride) {
+    const temporaryRoot = join(repositoryPath, ".opencode", ".tmp");
+    await mkdir(temporaryRoot, { recursive: true });
+    const stagingPath = await mkdtemp(join(temporaryRoot, "workflows-"));
+    try {
+        await copyCompilationInputs(repositoryPath, stagingPath);
+        await writeUpdates(stagingPath, updates);
+        const compiler = compileOverride ?? await packageCompiler(stagingPath);
+        if (compiler === undefined)
+            return [];
+        await compiler(stagingPath);
+        return await generatedFiles(stagingPath);
+    }
+    finally {
+        await rm(stagingPath, { force: true, recursive: true });
+    }
+}
+async function copyCompilationInputs(repositoryPath, stagingPath) {
+    const githubPath = join(repositoryPath, ".github");
+    if (await exists(githubPath))
+        await cp(githubPath, join(stagingPath, ".github"), { recursive: true });
+}
+async function packageCompiler(repositoryPath) {
+    const scriptPath = join(repositoryPath, "scripts", "compile-agent-workflows.mjs");
+    if (!await exists(scriptPath))
+        return undefined;
+    const content = await readFile(scriptPath, "utf8");
+    return content.includes("gh aw compile") ? runCompileIfAvailable : undefined;
+}
+async function generatedFiles(repositoryPath) {
+    const workflowPath = join(repositoryPath, ".github", "workflows");
+    const updates = [];
+    if (await exists(workflowPath)) {
+        for (const file of await filesIn(workflowPath)) {
+            if (!file.endsWith(".lock.yml"))
+                continue;
+            updates.push({ target: `.github/workflows/${file.replaceAll("\\", "/")}`, content: await readFile(join(workflowPath, file), "utf8") });
+        }
+    }
+    const actionsLock = join(repositoryPath, ".github", "actions", "actions-lock.json");
+    if (await exists(actionsLock)) {
+        updates.push({ target: ".github/actions/actions-lock.json", content: await readFile(actionsLock, "utf8") });
+    }
+    return updates.sort((left, right) => left.target.localeCompare(right.target));
+}
+async function applyTransaction(repositoryPath, updates) {
+    const uniqueUpdates = [...new Map(updates.map((update) => [update.target, update])).values()];
+    const rollback = await Promise.all(uniqueUpdates.map(async ({ target }) => {
+        const path = join(repositoryPath, target);
+        return { target, existed: await exists(path), content: await exists(path) ? await readFile(path, "utf8") : undefined };
+    }));
+    try {
+        await writeUpdates(repositoryPath, uniqueUpdates);
+    }
+    catch (error) {
+        await Promise.all(rollback.map(async ({ target, existed, content }) => {
+            if (existed && content !== undefined) {
+                await writeUpdates(repositoryPath, [{ target, content }]);
+            }
+            else {
+                await rm(join(repositoryPath, target), { force: true });
+            }
+        }));
+        throw error;
+    }
+}
+async function writeUpdates(repositoryPath, updates) {
+    await Promise.all(updates.map(async ({ target, content }) => {
+        const destination = join(repositoryPath, target);
+        await mkdir(dirname(destination), { recursive: true });
+        await writeFile(destination, content, "utf8");
+    }));
+}
 function catalogTemplateMeta(template) {
     const entry = catalogTemplates.find((item) => item.name === template);
     if (entry === undefined)
         throw new Error(`Unknown template: ${template}`);
-    const directory = template.startsWith("opencode") ? "opencode" : template.startsWith("app-ci-") ? "ci" : "agentics";
+    const directory = template.startsWith("opencode") ? "opencode" : template.startsWith("app-ci-") ? "ci" : template === "github-release" ? "release" : "agentics";
     const isWorkflow = entry.file.endsWith(".yml");
     const target = template === "app-ci-dotnet-next"
         ? ".github/workflows/app-ci.yml"

package/dist/catalog-installation.test.js

@@ -2,7 +2,7 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { catalogSourcePath, installCatalog, installMandatoryFiles, installTemplate } from "./catalog-installation.js";
+import { catalogSourcePath, ensurePreCommitHook, installCatalog, installMandatoryFiles, installTemplate } from "./catalog-installation.js";
 const temporaryDirectories = [];
 afterEach(async () => {
     await Promise.all(temporaryDirectories.splice(0).map((directory) => rm(directory, { force: true, recursive: true })));
@@ -154,6 +154,7 @@ describe("catalog installation", () => {
             "templates/opencode/opencode.ci.json": "{ \"model\": \"plainconcepts/glm-5-2\" }\n",
             "templates/agentics/agentics-checks.yml": "name: Agentics checks\n",
             "templates/ci/app-ci-node-monorepo.yml": "name: Node CI\n",
+            "templates/release/github-release.yml": "name: Publish GitHub release\n",
         });
         const repositoryPath = await createDirectory({});
         await installCatalog(repositoryPath, { sourcePath });
@@ -166,6 +167,10 @@ describe("catalog installation", () => {
             installed: [".github/workflows/app-ci-node-monorepo.yml"],
             conflicts: [],
         });
+        await expect(installTemplate(repositoryPath, "github-release", { sourcePath })).resolves.toEqual({
+            installed: [".github/workflows/github-release.yml"],
+            conflicts: [],
+        });
     });
     it("installCatalog installs mandatory opencode.ci.json and compile script alongside catalog files", async () => {
         const sourcePath = await createDirectory({
@@ -243,6 +248,60 @@ describe("catalog installation", () => {
         const compileEntries = result.installed.filter((path) => path === "scripts/compile-agent-workflows.mjs");
         expect(compileEntries).toHaveLength(1);
     });
+    it("creates a Husky pre-commit hook when the consumer has none", async () => {
+        const repositoryPath = await createDirectory({});
+        await ensurePreCommitHook(repositoryPath);
+        await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
+            .resolves.toBe("node scripts/compile-agent-workflows.mjs\n");
+    });
+    it("keeps existing pre-commit commands and appends the compiler once", async () => {
+        const repositoryPath = await createDirectory({ ".husky/pre-commit": "pnpm lint\n" });
+        await ensurePreCommitHook(repositoryPath);
+        await ensurePreCommitHook(repositoryPath);
+        await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
+            .resolves.toBe("pnpm lint\nnode scripts/compile-agent-workflows.mjs\n");
+    });
+    it("leaves consumer files untouched when staged workflow compilation fails", async () => {
+        const sourcePath = await createDirectory({
+            "actions/check/action.yml": "package action\n",
+            "workflows/agent-check.md": "package workflow\n",
+            "scripts/compile-agent-workflows.mjs": "compile\n",
+            "templates/opencode/opencode.ci.json": "{ \"model\": \"package\" }\n",
+        });
+        const repositoryPath = await createDirectory({
+            ".github/actions/check/action.yml": "consumer action\n",
+            ".github/workflows/agent-check.md": "consumer workflow\n",
+            "opencode.ci.json": "{ \"model\": \"consumer\" }\n",
+            "scripts/compile-agent-workflows.mjs": "consumer compiler\n",
+        });
+        await expect(installCatalog(repositoryPath, {
+            force: true,
+            sourcePath,
+            compile: async () => { throw new Error("compile failed"); },
+        })).rejects.toThrow("compile failed");
+        await expect(readFile(join(repositoryPath, ".github/workflows/agent-check.md"), "utf8"))
+            .resolves.toBe("consumer workflow\n");
+        await expect(readFile(join(repositoryPath, "scripts/compile-agent-workflows.mjs"), "utf8"))
+            .resolves.toBe("consumer compiler\n");
+        await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8")).rejects.toThrow();
+    });
+    it("applies staged generated locks with managed sources", async () => {
+        const sourcePath = await createDirectory({
+            "actions/check/action.yml": "package action\n",
+            "workflows/agent-check.md": "package workflow\n",
+            "scripts/compile-agent-workflows.mjs": "compile\n",
+            "templates/opencode/opencode.ci.json": "{ \"model\": \"package\" }\n",
+        });
+        const repositoryPath = await createDirectory({});
+        await installCatalog(repositoryPath, {
+            sourcePath,
+            compile: async (stagingPath) => {
+                await writeFile(join(stagingPath, ".github", "workflows", "agent-check.lock.yml"), "opencode run --log-level ERROR\n", "utf8");
+            },
+        });
+        await expect(readFile(join(repositoryPath, ".github", "workflows", "agent-check.lock.yml"), "utf8"))
+            .resolves.toBe("opencode run --log-level ERROR\n");
+    });
     it("installs the opencode.ci.json template to the repository root", async () => {
         const sourcePath = await createDirectory({
             "templates/opencode/opencode.ci.json": "{ \"model\": \"plainconcepts/glm-5-2\" }\n",

package/dist/catalog-listing.test.js

@@ -16,7 +16,7 @@ describe("catalog listing", () => {
         const routeNames = entries.filter((entry) => entry.kind === "route").map((entry) => entry.name);
         const templateNames = entries.filter((entry) => entry.kind === "template").map((entry) => entry.name);
         expect(routeNames).toEqual(["refine", "implement", "direct", "apply-review", "merge-gate", "audit", "propose"]);
-        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "opencode.ci.json"]);
+        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"]);
     });
     it("reports all entries as not installed in an empty repository", async () => {
         const repositoryPath = await createRepository({});

package/dist/index.test.js

@@ -61,12 +61,13 @@ describe("workflows CLI", () => {
         expect(output).toContain("implement");
         expect(output).toContain("agentics-checks");
         expect(output).toContain("app-ci-dotnet-next");
+        expect(output).toContain("github-release");
         // None installed: all [ ]
         const installedCount = (output.match(/\[x\]/g) ?? []).length;
         expect(installedCount).toBe(0);
-        // 7 routes + 5 templates = 12 entries
+        // 7 routes + 6 templates = 13 entries
         const uninstalledCount = (output.match(/\[ \]/g) ?? []).length;
-        expect(uninstalledCount).toBe(12);
+        expect(uninstalledCount).toBe(13);
         log.mockRestore();
     });
     it("marks installed workflows with [x]", async () => {

package/dist/repository-inspection.js

@@ -46,11 +46,33 @@ export function parseVisibility(value) {
     return value === "public" || value === "private" ? value : undefined;
 }
 async function findSolutionFiles(repositoryPath) {
-    const entries = await readdir(repositoryPath, { recursive: true, withFileTypes: true });
-    return entries
-        .filter((entry) => entry.isFile() && entry.name.endsWith(".slnx"))
-        .map((entry) => entry.parentPath === undefined ? entry.name : join(entry.parentPath, entry.name))
-        .sort();
+    const results = [];
+    await scanForSlnx(repositoryPath, "", results, 0);
+    return results.sort();
+}
+const MAX_DEPTH = 5;
+const SKIP_DIRS = new Set(["node_modules", ".git", ".next", "dist", "out", "build", ".turbo", ".cache"]);
+async function scanForSlnx(root, relativePath, results, depth) {
+    if (depth >= MAX_DEPTH)
+        return;
+    const currentPath = join(root, relativePath);
+    let entries;
+    try {
+        entries = await readdir(currentPath, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            await scanForSlnx(root, join(relativePath, entry.name), results, depth + 1);
+        }
+        else if (entry.isFile() && entry.name.endsWith(".slnx")) {
+            results.push(relativePath === "" ? entry.name : join(relativePath, entry.name));
+        }
+    }
 }
 async function pathExists(path) {
     try {

package/dist/repository-inspection.test.js

@@ -24,7 +24,7 @@ describe("repository inspection", () => {
             stackHints: {
                 packageJson: true,
                 pnpmLockfile: true,
-                solutionFiles: [join(repositoryPath, "apps", "api", "Numa.slnx")],
+                solutionFiles: [join("apps", "api", "Numa.slnx")],
                 openSpec: true,
             },
         });

package/dist/route-processing.js

@@ -72,17 +72,46 @@ export function processRoutes(files, selectedRoutes) {
         if (routerKey !== undefined) {
             result.set(routerKey, stripRouteFromRouter(result.get(routerKey), route));
         }
-        const classifierKey = findFileKey(result, "classify-route.sh");
-        if (classifierKey !== undefined) {
-            result.set(classifierKey, stripRouteFromClassifier(result.get(classifierKey), route));
-        }
         const matrixKey = findFileKey(result, "verify-route-matrix.sh");
         if (matrixKey !== undefined) {
             result.set(matrixKey, addRouteExclusion(result.get(matrixKey), route));
         }
     }
+    const matrixKey = findFileKey(result, "verify-route-matrix.sh");
+    if (matrixKey !== undefined) {
+        result.set(matrixKey, createRouteMatrix(selectedRoutes));
+    }
     return result;
 }
+function createRouteMatrix(selectedRoutes) {
+    const selected = selectedRoutes.join(" ");
+    const excluded = routeNames.filter((route) => !selectedRoutes.includes(route)).join(" ");
+    return `#!/usr/bin/env bash
+set -euo pipefail
+
+HERE="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+ROUTER_YML="\${HERE}/../../workflows/work-router.yml"
+CLASSIFIER="\${HERE}/../classify-route/classify-route.sh"
+
+bash -n "$CLASSIFIER"
+
+for route in ${selected}; do
+  grep -q "route == '$route'" "$ROUTER_YML" || {
+    echo "FAIL: selected route '$route' has no router job" >&2
+    exit 1
+  }
+done
+
+for route in ${excluded}; do
+  if grep -q "route == '$route'" "$ROUTER_YML"; then
+    echo "FAIL: excluded route '$route' remains in router" >&2
+    exit 1
+  fi
+done
+
+echo "Route matrix: selected routes valid"
+`;
+}
 export function excludedWorkerFiles(selectedRoutes) {
     return new Set(workflowRoutes
         .filter((route) => !selectedRoutes.includes(route.name))

package/dist/route-processing.test.js

@@ -259,11 +259,10 @@ describe("processRoutes", () => {
         expect(router).not.toContain("- propose");
         expect(router).not.toContain("- refine");
         const classifier = result.get(".github/actions/classify-route/classify-route.sh");
-        expect(classifier).not.toContain("readonly PROPOSE_CRON");
-        expect(classifier).not.toContain("readonly AUDIT_CRON");
+        expect(classifier).toBe(CLASSIFIER_SH);
         const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
-        expect(matrix).toContain("excluded route 'propose'");
-        expect(matrix).toContain("excluded route 'refine'");
+        expect(matrix).toContain("Route matrix: selected routes valid");
+        expect(matrix).toContain("for route in refine implement direct apply-review merge-gate audit propose");
     });
     it("strips propose from all three files when unselected", () => {
         const files = new Map([
@@ -278,10 +277,10 @@ describe("processRoutes", () => {
         expect(router).not.toContain('cron: "29 7 * * *"');
         expect(router).not.toMatch(/^\s+- propose$/m);
         const classifier = result.get(".github/actions/classify-route/classify-route.sh");
-        expect(classifier).not.toContain("readonly PROPOSE_CRON");
-        expect(classifier).not.toContain('"$PROPOSE_CRON")');
+        expect(classifier).toBe(CLASSIFIER_SH);
         const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
-        expect(matrix).toContain("excluded route 'propose'");
+        expect(matrix).toContain("for route in refine implement direct apply-review merge-gate audit");
+        expect(matrix).toContain("for route in propose");
     });
     it("strips audit from all three files when unselected", () => {
         const files = new Map([
@@ -295,8 +294,7 @@ describe("processRoutes", () => {
         expect(router).not.toContain("call-audit");
         expect(router).not.toContain('cron: "17 1 * * 1"');
         const classifier = result.get("classify-route.sh");
-        expect(classifier).not.toContain("readonly AUDIT_CRON");
-        expect(classifier).not.toContain('"$AUDIT_CRON")');
+        expect(classifier).toBe(CLASSIFIER_SH);
     });
     it("processes multiple excluded routes at once", () => {
         const files = new Map([

package/dist/stack-defaults.js

@@ -20,8 +20,6 @@ export function generateStackDefaults(inspection) {
 }
 export function injectStackEnv(content, defaults) {
     let result = content;
-    if (defaults.verifyCommands === "pnpm verify")
-        return result;
     if (result.includes("VERIFY_COMMANDS:")) {
         result = result.replace(/  VERIFY_COMMANDS: ".*"/, `  VERIFY_COMMANDS: "${defaults.verifyCommands}"`);
     }
@@ -33,6 +31,7 @@ export function injectStackEnv(content, defaults) {
 export function generateOpencodeCi(baseContent, inspection) {
     let result = baseContent;
     if (inspection.stackHints.solutionFiles.length > 0) {
+        const solutionPath = inspection.stackHints.solutionFiles[0];
         const nugetSteps = `  - name: Cache NuGet packages
     uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
     with:
@@ -40,8 +39,8 @@ export function generateOpencodeCi(baseContent, inspection) {
       key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
       restore-keys: nuget-\${{ runner.os }}-
 
-  - name: Restore .NET dependencies
-    run: dotnet restore
+   - name: Restore .NET dependencies
+    run: dotnet restore ${solutionPath}
 `;
         result = insertBeforeMarker(result, nugetSteps, "  - name: Install workspace dependencies");
     }
@@ -49,7 +48,7 @@ export function generateOpencodeCi(baseContent, inspection) {
         const openspecStep = `  - name: Install OpenSpec CLI
     run: |
       set -euo pipefail
-      npm install -g @openspec/cli@latest
+      npm install -g "@fission-ai/openspec@1.8.0"
       openspec --version
 `;
         result = insertBeforeMarker(result, openspecStep, "  - name: Install workspace dependencies");

package/dist/stack-defaults.test.js

@@ -76,7 +76,7 @@ description: test
         const result = injectStackEnv(content, defaults);
         expect(result).toContain('VERIFY_COMMANDS: "dotnet restore && dotnet build -c Release --no-restore && dotnet test"');
     });
-    it("does not inject when verifyCommands is pnpm verify (the default)", () => {
+    it("injects pnpm verification when no .slnx is present", () => {
         const content = `---
 env:
   REPO_RULES: "some rules"
@@ -85,7 +85,7 @@ env:
             pnpmLockfile: true,
         }));
         const result = injectStackEnv(content, defaults);
-        expect(result).not.toContain("VERIFY_COMMANDS");
+        expect(result).toContain('VERIFY_COMMANDS: "pnpm verify"');
     });
 });
 const OPENCODE_CI_MD = `---
@@ -113,20 +113,20 @@ pre-agent-steps:
       jq -e . "$FRAGMENT" > /dev/null
 ---`;
 describe("generateOpencodeCi", () => {
-    it("adds NuGet cache and dotnet restore steps when .slnx is found", () => {
+    it("adds NuGet cache and restores detected solution when .slnx is found", () => {
         const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
-            solutionFiles: ["app.slnx"],
+            solutionFiles: ["apps/api/Numa.slnx"],
         }));
         expect(result).toContain("Cache NuGet packages");
         expect(result).toContain("Restore .NET dependencies");
-        expect(result).toContain("dotnet restore");
+        expect(result).toContain("dotnet restore apps/api/Numa.slnx");
     });
-    it("adds OpenSpec CLI install step when openspec/ directory exists", () => {
+    it("adds the pinned OpenSpec CLI install step when openspec/ directory exists", () => {
         const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({
             openSpec: true,
         }));
         expect(result).toContain("Install OpenSpec CLI");
-        expect(result).toContain("@openspec/cli");
+        expect(result).toContain("@fission-ai/openspec@1.8.0");
     });
     it("adds both NuGet and OpenSpec steps when both are detected", () => {
         const result = generateOpencodeCi(OPENCODE_CI_MD, makeInspection({

package/dist/workflow-catalog.d.ts

@@ -14,7 +14,7 @@ export interface MandatoryFile {
 }
 export declare const mandatoryFiles: readonly MandatoryFile[];
 export declare const generatedConsumerTargets: readonly [".github/workflows/agent-*.lock.yml", ".github/aw/actions-lock.json"];
-export declare const templateNames: readonly ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "opencode.ci.json"];
+export declare const templateNames: readonly ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"];
 export type TemplateName = (typeof templateNames)[number];
 export interface CatalogTemplate {
     readonly name: TemplateName;

package/dist/workflow-catalog.js

@@ -38,6 +38,7 @@ export const templateNames = [
     "agentics-maintenance",
     "app-ci-dotnet-next",
     "app-ci-node-monorepo",
+    "github-release",
     "opencode.ci.json",
 ];
 export const catalogTemplates = [
@@ -45,5 +46,6 @@ export const catalogTemplates = [
     { name: "agentics-maintenance", file: "agentics-maintenance.yml", description: "Agentic maintenance: scheduled daily maintenance workflow for keeping workflows and actions up to date." },
     { name: "app-ci-dotnet-next", file: "app-ci-dotnet-next.yml", description: "App CI pipeline for a .NET + Next.js monorepo: build, test, and lint on PRs and schedule." },
     { name: "app-ci-node-monorepo", file: "app-ci-node-monorepo.yml", description: "App CI pipeline for a Node monorepo: build, test, and lint on PRs and schedule." },
+    { name: "github-release", file: "github-release.yml", description: "Publishes or updates a GitHub Release with generated notes whenever a v* tag is pushed." },
     { name: "opencode.ci.json", file: "opencode.ci.json", description: "Standalone OpenCode CI config: plainconcepts provider, GLM model registration, ci-workflow-agent, and LSP defaults for consumer repositories." },
 ];

package/dist/workflow-catalog.test.js

@@ -17,7 +17,7 @@ describe("workflow catalog", () => {
         }
     });
     it("lists supported optional templates", () => {
-        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "opencode.ci.json"]);
+        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"]);
     });
     it("gives every catalog template a non-empty description and file", () => {
         expect(catalogTemplates.map((template) => template.name)).toEqual([...templateNames]);

package/loops/scripts/compile-agent-workflows.mjs

@@ -1,6 +1,7 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 const workflowDirectory = existsSync("loops/workflows") ? "loops/workflows" : ".github/workflows";
 
@@ -21,9 +22,22 @@ const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir"
   shell: false,
 });
 
-if (compile.error?.code === "ENOENT" || compile.status === null) {
+if (compile.error?.code === "ENOENT" || compile.status === null) {
   process.stderr.write("Could not run `gh aw compile`. Install githubnext/gh-aw first.\n");
   process.exit(1);
-}
-
-process.exit(compile.status ?? 1);
+}
+
+if (compile.status !== 0) process.exit(compile.status ?? 1);
+
+for (const file of readdirSync(workflowDirectory)) {
+  if (!file.endsWith(".lock.yml")) continue;
+
+  const path = join(workflowDirectory, file);
+  const content = readFileSync(path, "utf8");
+  const patched = content
+    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
+    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
+    .replaceAll("--log-level DEBUG", "--log-level ERROR");
+
+  if (patched !== content) writeFileSync(path, patched);
+}

package/loops/templates/opencode/opencode.ci.json

@@ -13,7 +13,8 @@
   "permission": {
     "read": "allow",
     "external_directory": {
-      "/tmp/**": "allow"
+      "/tmp/**": "allow",
+      "/home/runner/work/_temp/gh-aw/**": "allow"
     }
   },
   "lsp": {

package/loops/templates/release/github-release.yml

@@ -0,0 +1,30 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/release/github-release.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Publish GitHub release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Publish release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Create or update GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            gh release edit "$TAG" --title "$TAG" --generate-notes
+          else
+            gh release create "$TAG" --title "$TAG" --generate-notes
+          fi

package/loops/workflows/agent-apply-review.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-apply-review.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
   REVIEW_MARKER: "<!-- agent-apply-review -->"

package/loops/workflows/agent-audit.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-audit.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Read-only repository audit. Report only reproducible, actionable defects with evidence. Look for: architectural layer violations, missing tests, security gaps, performance issues, and documentation drift. Do not modify files, commit, push, or run write operations."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   AUDIT_MARKER: "<!-- agent-audit -->"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"

package/loops/workflows/agent-direct.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-direct.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Execute the selected issue's latest human instruction exactly as asked. Follow repository documentation and existing patterns. Keep scope to the requested outcome."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
   DIRECT_LABEL: direct

package/loops/workflows/agent-implement.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-implement.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Implement only the selected issue. Follow repository documentation and existing conventions. Do not weaken tests, lower coverage thresholds, or bypass checks. Run the project's full verification suite before creating a pull request."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   IMPLEMENT_LABEL: implement
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review

package/loops/workflows/agent-merge-gate.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-merge-gate.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Make a risk-based merge decision for the selected bot pull request. Merge only when CI is green and no risk indicators are present. Flag security, schema, auth, or calculation changes for human review. Do not merge protected file changes."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   WORKING_LABEL: bot-working
   IMPLEMENT_LABEL: implement
   REVIEW_LABEL: review

package/loops/workflows/agent-propose.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-propose.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Propose one focused product candidate from repository evidence and curated feature radar. Respect documented product goals and architecture boundaries. Do not propose features that conflict with the project's stated scope."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   PROPOSED_LABEL: proposed
   IMPLEMENT_LABEL: implement
   PROPOSE_MARKER: "<!-- agent-propose -->"

package/loops/workflows/agent-refine.md

@@ -2,7 +2,6 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-refine.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
   REPO_RULES: "Refine only the selected issue into a grounded, implementation-ready user story. Read repository documentation for domain context. Write acceptance criteria that match existing patterns. Do not implement code."
-  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   REFINE_LABEL: refine
   REFINED_LABEL: refined
   WORKING_LABEL: bot-working

package/loops/workflows/shared/platform-defaults.md

@@ -8,6 +8,8 @@ network:
     - forge.plainconcepts.com
     - node
     - github
+    - dotnet
+    - fonts
 
 safe-outputs:
   threat-detection: false

package/loops/workflows/work-router.yml

@@ -39,7 +39,7 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
   workflow_run:
-    workflows: ["App: CI"]
+    workflows: ["App: CI", "CI"]
     types: [completed]
     branches:
       - "fix/*"
@@ -142,7 +142,10 @@ jobs:
               ;;
           esac
 
-          if [ "$ACTOR" = "github-actions[bot]" ]; then
+          # Platform bot owns Safe Outputs. Its label changes must be able to
+          # start the follow-on worker, even though GitHub does not report it
+          # as a repository collaborator.
+          if [ "$ACTOR" = "github-actions[bot]" ] || [ "$ACTOR" = "platform-devbox[bot]" ]; then
             echo "trusted=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",