@plainconceptsplatform/workflows 1.0.14 → 1.2.0

package/dist/catalog-installation.js

@@ -5,7 +5,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { parse as parseYaml } from "yaml";
-import { catalogTemplates, mandatoryFiles, routeNames, templateNames, workflowRoutes } from "./workflow-catalog.js";
+import { catalogTemplates, mandatoryFiles, retiredWorkflowFiles, routeNames, templateNames, workflowRoutes } from "./workflow-catalog.js";
 import { processRoutes, excludedWorkerFiles } from "./route-processing.js";
 import { generateOpencodeCi, generateOpencodeConfig, generateStackDefaults, injectStackEnv } from "./stack-defaults.js";
 import { mergeRouter, mergeWorker } from "./worker-env.js";
@@ -202,6 +202,16 @@ async function orphanedManagedFiles(repositoryPath, keep) {
                 orphans.push(target);
         }
     }
+    // A retired worker is ours when it still carries the header; its lock was generated from it, so
+    // the lock goes with it either way.
+    for (const file of retiredWorkflowFiles) {
+        const target = `.github/workflows/${file}`;
+        const path = join(repositoryPath, target);
+        if (!await exists(path))
+            continue;
+        if (file.endsWith(".lock.yml") || hasOwnershipHeader(await readFile(path, "utf8")))
+            orphans.push(target);
+    }
     return orphans.sort();
 }
 async function removeFiles(repositoryPath, targets) {
@@ -276,14 +286,14 @@ export async function installedRoutes(repositoryPath) {
     return found.filter((name) => name !== undefined);
 }
 export async function removeRouteFiles(repositoryPath, routes) {
-    const workerByRoute = new Map(workflowRoutes.map((route) => [route.name, route.worker]));
+    const routeByName = new Map(workflowRoutes.map((route) => [route.name, route]));
     const removed = [];
-    for (const route of routes) {
-        const worker = workerByRoute.get(route);
-        if (worker === undefined)
+    for (const name of routes) {
+        const route = routeByName.get(name);
+        if (route === undefined)
             continue;
-        const lock = worker.replace(/\.md$/, ".lock.yml");
-        for (const file of [worker, lock]) {
+        const lock = route.worker.replace(/\.md$/, ".lock.yml");
+        for (const file of [route.worker, lock, ...(route.companions ?? [])]) {
             const destination = join(repositoryPath, ".github", "workflows", file);
             if (await exists(destination)) {
                 await rm(destination, { force: true });

package/dist/route-processing.js

@@ -41,7 +41,7 @@ export function processRoutes(files, selectedRoutes) {
 export function excludedWorkerFiles(selectedRoutes) {
     return new Set(workflowRoutes
         .filter((route) => !selectedRoutes.includes(route.name))
-        .map((route) => route.worker));
+        .flatMap((route) => [route.worker, ...(route.companions ?? [])]));
 }
 // Remove a top-level job (two-space indent) together with the comment lines that introduce it.
 // A job's comment describes that job; left behind it describes nothing.

package/dist/workflow-catalog.d.ts

@@ -5,9 +5,12 @@ export interface WorkflowRoute {
     readonly worker: string;
     readonly description: string;
     readonly defaultEnabled: boolean;
+    /** Plain workflows that exist only to serve this route. They are installed and removed with it. */
+    readonly companions?: readonly string[];
 }
 export declare const workflowRoutes: readonly WorkflowRoute[];
-export declare const packageOwnedTargets: readonly [".github/actions", ".github/workflows/agent-*.md", ".github/workflows/shared/platform-defaults.md", ".github/workflows/shared/opencode-ci.md", ".github/workflows/work-router.yml", "scripts/compile-agent-workflows.mjs", "opencode.ci.json", "docs/diagrams.md"];
+export declare const retiredWorkflowFiles: readonly ["agent-visual-verify.md", "agent-visual-verify.lock.yml"];
+export declare const packageOwnedTargets: readonly [".github/actions", ".github/workflows/agent-*.md", ".github/workflows/shared/platform-defaults.md", ".github/workflows/shared/opencode-ci.md", ".github/workflows/work-router.yml", ".github/workflows/evidence.yml", "scripts/compile-agent-workflows.mjs", "opencode.ci.json", "docs/diagrams.md"];
 export interface MandatoryFile {
     readonly source: string;
     readonly target: string;

package/dist/workflow-catalog.js

@@ -14,7 +14,15 @@ export const workflowRoutes = [
     { name: "apply-review", worker: "agent-apply-review.md", description: "Applies reviewer feedback to an open pull request the bot authored, then pushes the fixes to the same branch.", defaultEnabled: true },
     { name: "merge-gate", worker: "agent-merge-gate.md", description: "Decides what happens to a bot-authored pull request once CI has reported: merge, hand to a human, or fix CI.", defaultEnabled: true },
     { name: "audit", worker: "agent-audit.md", description: "Read-only repository audit. Finds 5-7 problems, scores each 1-10, and files a single issue that Refine then sizes and splits.", defaultEnabled: true },
-    { name: "release", worker: "agent-release.md", description: "Writes release notes from the commit log, then a deterministic job bumps the version, tags, and publishes a GitHub Release. Manual dispatch only (operation=release).", defaultEnabled: true },
+    { name: "release", worker: "agent-release.md", description: "Writes release notes from the commit log, then a deterministic job opens a version-bump pull request with auto-merge; once it merges, release-tag.yml tags the commit and publishes the GitHub Release. Manual dispatch only (operation=release).", defaultEnabled: true, companions: ["release-tag.yml"] },
+];
+// Workflow files the package used to ship and no longer does. `.github/workflows/` is not pruned
+// wholesale, because a missing worker there means a route the consumer left out, so a retired one
+// is named here or it sits in every consumer forever with a lock that still compiles.
+// agent-visual-verify was replaced by evidence.yml in 1.1.0.
+export const retiredWorkflowFiles = [
+    "agent-visual-verify.md",
+    "agent-visual-verify.lock.yml",
 ];
 export const packageOwnedTargets = [
     ".github/actions",
@@ -22,6 +30,7 @@ export const packageOwnedTargets = [
     ".github/workflows/shared/platform-defaults.md",
     ".github/workflows/shared/opencode-ci.md",
     ".github/workflows/work-router.yml",
+    ".github/workflows/evidence.yml",
     "scripts/compile-agent-workflows.mjs",
     "opencode.ci.json",
     "docs/diagrams.md",

package/loops/actions/capture-evidence/action.yml

@@ -0,0 +1,118 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/capture-evidence/action.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Capture evidence
+description: >
+  Reads a pull request's verification plans (written by the harness skill pc-repo-verify) and,
+  in capture mode, replays them in headless Chromium against the running app, writing one JPEG
+  per waypoint under files/<plan directory>/evidence/, laid out as the repository is, plus
+  manifest.json and comment.md. Inspect mode only reports whether any plan is
+  replayable, at which address, and with which start command. No model, no network beyond
+  installing its two pinned packages.
+inputs:
+  mode:
+    description: inspect, capture, or unreached (the app never answered; record why and stop).
+    required: true
+  root:
+    description: Checkout of the pull request head the plans are read from.
+    required: true
+  plans:
+    description: Newline-separated plan paths relative to root.
+    required: true
+  out-dir:
+    description: Where capture and unreached write the screenshots, manifest.json and comment.md.
+    required: false
+    default: ''
+  playwright-version:
+    description: playwright-core version. Must match the mcr.microsoft.com/playwright image tag the capture runs in.
+    required: false
+    default: '1.62.1'
+  yaml-version:
+    description: yaml package version.
+    required: false
+    default: '2.9.0'
+outputs:
+  runnable:
+    description: inspect only. true when at least one plan has a journey to replay.
+    value: ${{ steps.run.outputs.runnable }}
+  url:
+    description: inspect only. The address the first replayable plan expects the app at.
+    value: ${{ steps.run.outputs.url }}
+  start:
+    description: inspect only. The start command the first replayable plan names, empty for the default.
+    value: ${{ steps.run.outputs.start }}
+runs:
+  using: composite
+  steps:
+    - name: Install the plan runner
+      shell: bash
+      env:
+        MODE: ${{ inputs.mode }}
+        PLAYWRIGHT_VERSION: ${{ inputs.playwright-version }}
+        YAML_VERSION: ${{ inputs.yaml-version }}
+        ACTION_DIR: ${{ github.action_path }}
+      run: |
+        set -euo pipefail
+        runner="$RUNNER_TEMP/capture-evidence"
+        mkdir -p "$runner"
+        # A copy beside its node_modules: ESM resolves bare imports from the file's own
+        # directory, never from NODE_PATH, so the script cannot run from the action folder.
+        cp "$ACTION_DIR/capture.mjs" "$runner/capture.mjs"
+        if [ ! -d "$runner/node_modules/playwright-core" ] || [ ! -d "$runner/node_modules/yaml" ]; then
+          npm install --prefix "$runner" --no-save --no-package-lock --no-audit --no-fund \
+            "playwright-core@${PLAYWRIGHT_VERSION}" "yaml@${YAML_VERSION}"
+        fi
+        # capture runs in the Playwright image, which carries Chromium and its system libraries;
+        # the runner has neither, and its user has no sudo to add them (libatk was the first of
+        # many missing). Only without Docker does the browser come down here, as a best effort.
+        if [ "$MODE" = "capture" ] && ! command -v docker > /dev/null 2>&1; then
+          node "$runner/node_modules/playwright-core/cli.js" install --only-shell chromium
+        fi
+
+    - name: Run the plans
+      id: run
+      shell: bash
+      env:
+        MODE: ${{ inputs.mode }}
+        ROOT: ${{ inputs.root }}
+        PLANS: ${{ inputs.plans }}
+        OUT_DIR: ${{ inputs.out-dir }}
+        PLAYWRIGHT_VERSION: ${{ inputs.playwright-version }}
+        # Chromium's own stderr. A browser that dies on launch says why only here.
+        DEBUG: pw:browser
+      run: |
+        set -euo pipefail
+        runner="$RUNNER_TEMP/capture-evidence"
+        mapfile -t plans < <(printf '%s\n' "$PLANS" | sed '/^[[:space:]]*$/d')
+        if [ "${#plans[@]}" -eq 0 ]; then
+          echo "::error::no plan paths were given"
+          exit 1
+        fi
+        case "$MODE" in
+          inspect)
+            report="$(node "$runner/capture.mjs" inspect "$ROOT" "${plans[@]}")"
+            echo "$report"
+            {
+              echo "runnable=$(jq -r '.runnable' <<<"$report")"
+              echo "url=$(jq -r '.url' <<<"$report")"
+              echo "start=$(jq -r '.start' <<<"$report")"
+            } >> "$GITHUB_OUTPUT"
+            ;;
+          capture)
+            [ -n "$OUT_DIR" ] || { echo "::error::capture needs out-dir"; exit 1; }
+            mkdir -p "$OUT_DIR"
+            if command -v docker > /dev/null 2>&1; then
+              # The host network, so the browser reaches the app on localhost where it started;
+              # the runner's own user, so what it writes the publish job can read.
+              docker run --rm --network host --ipc host                 --user "$(id -u):$(id -g)" -e HOME=/tmp -e DEBUG                 -e EVIDENCE_SHA -e EVIDENCE_RUN_URL -e EVIDENCE_STEP_TIMEOUT_MS -e EVIDENCE_NAVIGATION_TIMEOUT_MS                 -v "$runner:$runner:ro" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE:ro" -v "$OUT_DIR:$OUT_DIR"                 -w "$GITHUB_WORKSPACE"                 "mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"                 node "$runner/capture.mjs" capture "$ROOT" "$OUT_DIR" "${plans[@]}"
+            else
+              node "$runner/capture.mjs" capture "$ROOT" "$OUT_DIR" "${plans[@]}"
+            fi
+            ;;
+          unreached)
+            [ -n "$OUT_DIR" ] || { echo "::error::unreached needs out-dir"; exit 1; }
+            node "$runner/capture.mjs" unreached "$ROOT" "$OUT_DIR" "${plans[@]}"
+            ;;
+          *)
+            echo "::error::unknown mode '$MODE'"
+            exit 1
+            ;;
+        esac