@plainconceptsplatform/workflows 1.21.4 → 1.21.6

package/loops/actions/merge-train/merge-train.sh

@@ -410,10 +410,18 @@ for line in "${candidates[@]}"; do
     continue
   fi
 
-  meta=$(gh pr view "$pr" --repo "$REPO" --json reviewDecision,commits,closingIssuesReferences 2>/dev/null || echo '{}')
+  meta=$(gh pr view "$pr" --repo "$REPO" --json reviewDecision,commits,closingIssuesReferences,body 2>/dev/null || echo '{}')
   review_decision=$(jq -r '.reviewDecision // ""' <<<"$meta")
   head_committed=$(jq -r '[.commits[]?.committedDate] | max // ""' <<<"$meta")
   linked_issue=$(jq -r '.closingIssuesReferences[0].number // ""' <<<"$meta")
+  # GitHub links closing keywords only on pull requests into the default branch, so a stack
+  # child (into feat/N) has none. The gate reads `Closes #N` from the body instead
+  # (identify-gate-subject); the train must find the same issue, or it misses the attempt the
+  # gate recorded there, counts a failed gate as a silent one and never retries it.
+  if [ -z "$linked_issue" ]; then
+    linked_issue=$(jq -r '.body // ""' <<<"$meta" |
+      grep -oiE '(close[sd]?|fixe?[sd]?|resolve[sd]?) +#[0-9]+' | grep -oE '[0-9]+' | head -n 1 || true)
+  fi
 
   # The latest verdict on the pull request or its issue, and how many retries it has had.
   verdicts=$(

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1951,6 +1951,11 @@ fi
 if ! grep -qF 'contains($prefix)' "$ROUTER_YML" || ! grep -qF 'REFINE_PREFIX: "Refinement update"' "$ROUTER_YML"; then
   LEAD_OK=0; echo "FAIL: the refine auto-accept must find the questions by refine's visible prefix, not only the stripped marker" >&2
 fi
+# A stack child (into feat/N) has no closingIssuesReferences; the train must read `Closes #N` from the body like the
+# gate does, or a failed gate's attempt on the issue is invisible and the child is parked as a silent gate forever.
+if [ -f "${HERE}/../merge-train/merge-train.sh" ] && ! grep -qF "(close[sd]?|fixe?[sd]?|resolve[sd]?) +#[0-9]+" "${HERE}/../merge-train/merge-train.sh"; then
+  LEAD_OK=0; echo "FAIL: the merge train must find a stack child's issue from 'Closes #N' in the body" >&2
+fi
 if [ "$LEAD_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # The harness plugins only load with .opencode/node_modules installed; without it every CI run
 # spawned untiered workers on the session's model. And the tier model a worker pins has to be one
@@ -3744,6 +3749,10 @@ rc 'test-timings\.mjs' "$CI_DOTNET" 'the .NET template must summarise the test t
 SYNC_YML="${HERE}/../../templates/platform-template/.github/workflows/platform-template-sync.yml"
 rc '^  UV_SHA256: [0-9a-f]{64}$' "$SYNC_YML" 'the template sync must pin uv by SHA-256'
 rc 'sha256sum --check --strict' "$SYNC_YML" 'the template sync must check the uv download'
+# A conformance run that could not read the template must not pass as a comparison.
+rc 'compare\+=\(--require-source\)' "$CI_DOTNET" 'the conformance job must require the template when it has a token'
+rc 'create-github-app-token@[0-9a-f]{40}' "$CI_DOTNET" 'the conformance job must mint a token that reads the template'
+rc "requireSource \\? \\{ failures: \\[message\\]" "${HERE}/../../templates/platform-template/scripts/check-platform-conformance.mjs" 'check-platform-conformance must fail on an unread template with --require-source'
 rc "python3 -c 'import ensurepip'" "$SYNC_YML" 'the template sync must not try a venv where ensurepip is missing'
 if [ "$RC_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -33,6 +33,12 @@ on:
     secrets:
       NPM_REGISTRY_TOKEN:
         required: false
+      # The bot App, for the platform conformance job to read the template repository when it is
+      # private. A deploy pipeline passes them; without them the owned files are not compared.
+      BOT_APP_ID:
+        required: false
+      BOT_PRIVATE_KEY:
+        required: false
 
 permissions:
   contents: read
@@ -518,17 +524,34 @@ jobs:
     name: Platform conformance
     runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
     timeout-minutes: 5
+    env:
+      HAS_BOT_APP: ${{ secrets.BOT_APP_ID != '' && secrets.BOT_PRIVATE_KEY != '' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      # The template repository is usually private, and GITHUB_TOKEN reads only this one. Without a
+      # token the comparison could not run and the job still said the owned files matched.
+      - name: Token that reads the platform template
+        id: app-token
+        if: env.HAS_BOT_APP == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+      # The token reaches git through process-scoped config only, never a file on the runner.
       - name: Owned files change only through a template sync
         env:
           EVENT: ${{ github.event_name }}
           BASE_REF: ${{ github.base_ref }}
+          GIT_CONFIG_COUNT: ${{ steps.app-token.outputs.token != '' && '1' || '0' }}
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
+          HAS_TOKEN: ${{ steps.app-token.outputs.token != '' }}
         run: |
           set -euo pipefail
           if [ ! -f .platform/contract.yml ] && { [ ! -f .copier-answers.yml ] || [ ! -f .platform/manifest ]; }; then
@@ -539,11 +562,19 @@ jobs:
             echo "::error::This repository has a platform contract but no scripts/check-platform-conformance.mjs. Install it with: npx @plainconceptsplatform/workflows add --template platform-template"
             exit 1
           fi
+          # With a token the template must be read; without one (Dependabot, a caller that passes no
+          # secrets) the job still checks for changes outside a sync, and says it did not compare.
+          compare=(--compare)
+          if [ "$HAS_TOKEN" = true ]; then
+            compare+=(--require-source)
+          else
+            echo "::warning::No bot App token in this run, so the owned files were not compared with the template. Pass BOT_APP_ID and BOT_PRIVATE_KEY to this workflow."
+          fi
           if [ "$EVENT" = pull_request ]; then
             git fetch origin "$BASE_REF"
-            node scripts/check-platform-conformance.mjs --compare --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"
+            node scripts/check-platform-conformance.mjs "${compare[@]}" --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"
           else
-            node scripts/check-platform-conformance.mjs --compare | tee -a "$GITHUB_STEP_SUMMARY"
+            node scripts/check-platform-conformance.mjs "${compare[@]}" | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 
   secret-scan:

package/loops/templates/platform-template/scripts/check-platform-conformance.mjs

@@ -3,10 +3,11 @@
 // Keeps the paths a platform contract (.platform/contract.yml) marks as `owned` equal to the template
 // they come from. A pull request may change them only in a template sync (it changes `sync.marker` or
 // moves `sync.version`) or under an unexpired exception; conflict markers and expired exceptions fail.
-// With --compare, owned files are also compared with `source.url` at the recorded version.
+// With --compare, owned files are also compared with `source.url` at the recorded version; with
+// --require-source as well, a template it cannot read is a failure rather than a note.
 // Without a contract it passes silently. .copier-answers.yml + .platform/manifest is read as one.
 //
-// Usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare]
+// Usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare [--require-source]]
 //        node scripts/check-platform-conformance.mjs --contract   (key=value lines for $GITHUB_OUTPUT)
 
 import { execFileSync } from 'node:child_process';
@@ -321,7 +322,7 @@ function sourceBlobs(url, version) {
   }
 }
 
-function compareWithSource(root, contract, patterns, live, version) {
+function compareWithSource(root, contract, patterns, live, version, requireSource = false) {
   const failures = [];
   const notes = [];
   const { name, url, changes } = contract.source;
@@ -331,7 +332,8 @@ function compareWithSource(root, contract, patterns, live, version) {
     source = sourceBlobs(url, version);
   } catch (error) {
     const reason = String(error.stderr ?? error.message).trim().split('\n').at(-1);
-    return { failures, notes: [`cannot read ${url} at ${version} (${reason}); owned files were not compared with the source`] };
+    const message = `cannot read ${url} at ${version} (${reason}); owned files were not compared with the source`;
+    return requireSource ? { failures: [message], notes, compared: false } : { failures, notes: [message], compared: false };
   }
   const local = blobIds(git(root, ['ls-files', '-s', '-z']), 1);
   for (const [path, id] of source) {
@@ -343,10 +345,10 @@ function compareWithSource(root, contract, patterns, live, version) {
   }
   const onlyHere = [...local.keys()].filter((path) => isOwned(patterns, path) && !source.has(path));
   if (onlyHere.length > 0) notes.push(`${onlyHere.length} owned file(s) are not in ${name} at ${version} under the same path; not compared`);
-  return { failures, notes };
+  return { failures, notes, compared: true };
 }
 
-export function checkConformance(root, { base, compare = false, today = new Date().toISOString().slice(0, 10) } = {}) {
+export function checkConformance(root, { base, compare = false, requireSource = false, today = new Date().toISOString().slice(0, 10) } = {}) {
   const read = (path) => (existsSync(join(root, path)) ? readFileSync(join(root, path), 'utf8') : undefined);
   let contract;
   try {
@@ -395,12 +397,14 @@ export function checkConformance(root, { base, compare = false, today = new Date
       }
     }
   }
+  let compared;
   if (compare) {
-    const result = compareWithSource(root, contract, patterns, live, version);
+    const result = compareWithSource(root, contract, patterns, live, version, requireSource);
     failures.push(...result.failures);
     notes.push(...result.notes);
+    compared = result.compared;
   }
-  return { adopted: true, failures, notes };
+  return { adopted: true, failures, notes, compared };
 }
 
 // One key=value line per field, for $GITHUB_OUTPUT; contract=absent when there is none.
@@ -428,9 +432,9 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   const args = process.argv.slice(2);
   const baseIndex = args.indexOf('--base');
   const base = baseIndex === -1 ? undefined : args[baseIndex + 1];
-  const unknown = args.filter((arg, i) => i !== baseIndex + 1 || baseIndex === -1).filter((arg) => !['--base', '--compare', '--contract'].includes(arg));
+  const unknown = args.filter((arg, i) => i !== baseIndex + 1 || baseIndex === -1).filter((arg) => !['--base', '--compare', '--require-source', '--contract'].includes(arg));
   if ((baseIndex !== -1 && !base) || unknown.length > 0) {
-    console.error('usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare] | --contract');
+    console.error('usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare [--require-source]] | --contract');
     process.exit(2);
   }
   const root = fileURLToPath(new URL('..', import.meta.url));
@@ -444,10 +448,11 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       process.exit(1);
     }
   }
-  const { adopted, failures, notes } = checkConformance(root, { base, compare: args.includes('--compare') });
+  const { adopted, failures, notes, compared } = checkConformance(root, { base, compare: args.includes('--compare'), requireSource: args.includes('--require-source') });
   if (!adopted) process.exit(0);
   for (const note of notes) console.log(`· ${note}`);
   for (const failure of failures) console.error(`✗ ${failure}`);
-  if (failures.length === 0) console.log('✓ owned files match the template');
+  // Only a comparison that ran may say the files match: an unread template proves nothing.
+  if (failures.length === 0) console.log(compared === false ? '✓ no owned file changed outside a template sync (not compared with the template)' : '✓ owned files match the template');
   process.exit(failures.length === 0 ? 0 : 1);
 }

package/loops/workflows/release-tag.yml

@@ -120,7 +120,10 @@ jobs:
       # The tag above was created with GITHUB_TOKEN, so its push starts no workflow: a release does
       # not ship by itself. A workflow_dispatch is the exception GitHub allows that token, so a
       # release that asked for a deploy starts DEPLOY_WORKFLOW on the tag explicitly. The deploy
-      # workflow's own `pro` environment rules (required reviewers) still apply.
+      # workflow's own `pro` environment rules (required reviewers) still apply. The tagged commit is
+      # the one the release pull request just merged, so its main run is usually still building PRE:
+      # the platform template's deploy waits for that run, skips the CI it passed and promotes its
+      # image, rather than test the same commit again.
       - name: Deploy the release to production
         if: steps.release.outputs.deploy == 'true'
         env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.21.4",
+  "version": "1.21.6",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",