@qijenchen/design-system 0.1.0-beta.96 → 0.1.0-beta.99

package/ds-canonical/fork/consumer/managed-files/77e06f62670dfee01e9b5e8b0f8dad085ce711d75538c1fb0679d9818acaca82.blob

@@ -1,424 +0,0 @@
-name: Propose Design System Upgrade
-
-# Immutable consumer promotion has three trust domains. The certifier emits evidence
-# without credentials; a fresh read-only job independently reconstructs it; only then
-# may an environment-gated writer mint the dedicated Governance Writer App token. The App
-# is writer-only(Contents/Pull requests), is not a check authority, and its automatic
-# candidate runs are non-authoritative. The explicit protected-default repository_dispatch
-# remains the required Check App validation path(no direct main write).
-on:
-  repository_dispatch:
-    # repository_dispatch always loads this workflow from the protected default
-    # branch. manual-governance-upgrade-request is the API-driven manual path;
-    # branch-selectable workflow_dispatch is intentionally forbidden here.
-    types: [governance-release, manual-governance-upgrade-request]
-
-concurrency:
-  group: governance-upgrade-${{ github.event.client_payload.version || github.run_id }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    shell: bash -eo pipefail {0}
-
-jobs:
-  certify-upgrade:
-    name: Certify exact upgrade without credentials
-    runs-on: ubuntu-24.04
-    timeout-minutes: 35
-    outputs:
-      ready: ${{ steps.upgrade.outputs.ready }}
-      version: ${{ steps.upgrade.outputs.version }}
-      base_sha: ${{ steps.source.outputs.sha }}
-      patch_sha256: ${{ steps.evidence.outputs.patch_sha256 }}
-      tree_sha256: ${{ steps.evidence.outputs.tree_sha256 }}
-      authority_sha256: ${{ steps.evidence.outputs.authority_sha256 }}
-      artifact_digest: ${{ steps.upload.outputs.artifact-digest }}
-    env:
-      REQUESTED_VERSION: ${{ github.event.client_payload.version }}
-    steps:
-      - name: Checkout exact protected-base source
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Prove current protected-main source
-        id: source
-        run: |
-          BASE_SHA=$(git rev-parse HEAD)
-          MAIN_SHA=$(git rev-parse refs/remotes/origin/main)
-          test "$BASE_SHA" = "$MAIN_SHA" || {
-            echo "GOV-UPGRADE-SOURCE-001: stale source $BASE_SHA; current main is $MAIN_SHA"
-            exit 1
-          }
-          echo "sha=$BASE_SHA" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '24.14.0'
-          cache: npm
-
-      - name: Validate and normalize exact version
-        run: |
-          VERSION="${REQUESTED_VERSION#v}"
-          node scripts/workflow-static-validation.mjs assert-exact-semver --value "$VERSION"
-          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
-
-      - name: Install current immutable snapshot
-        run: |
-          npm run setup:governance
-          PREVIOUS_ROOT="$RUNNER_TEMP/previous-corpus"
-          mkdir -p "$PREVIOUS_ROOT/node_modules/@qijenchen"
-          cp -R node_modules/@qijenchen/design-system "$PREVIOUS_ROOT/node_modules/@qijenchen/design-system"
-          echo "PREVIOUS_ROOT=$PREVIOUS_ROOT" >> "$GITHUB_ENV"
-
-      - name: Apply exact transactional upgrade
-        id: upgrade
-        run: |
-          git checkout -b "governance/certify-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          node scripts/sync-all.mjs --apply --to "$VERSION" --json > "$RUNNER_TEMP/sync-all-report.json"
-          git add -A
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          if git diff --cached --quiet; then
-            echo "ready=false" >> "$GITHUB_OUTPUT"
-            echo "Already on exact immutable snapshot $VERSION"
-          else
-            echo "ready=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Freeze transition-authenticated upgrade evidence
-        if: steps.upgrade.outputs.ready == 'true'
-        id: evidence
-        env:
-          BASE_SHA: ${{ steps.source.outputs.sha }}
-        run: |
-          node scripts/verify-upgrade-evidence.mjs \
-            --certify-staged \
-            --repo . \
-            --evidence "$RUNNER_TEMP/upgrade-evidence" \
-            --previous-root "$PREVIOUS_ROOT" \
-            --sync-report "$RUNNER_TEMP/sync-all-report.json" \
-            --base-sha "$BASE_SHA" \
-            --version "$VERSION"
-
-      - name: Re-verify upgraded registry and provider-neutral product
-        if: steps.upgrade.outputs.ready == 'true'
-        run: |
-          npm run setup:governance
-          npm run typecheck
-          npm run lint:imports
-          npm run build
-          npx --no-install playwright install --with-deps chromium
-          npm run audit:a11y
-
-      - name: Reject post-certification mutation
-        if: steps.upgrade.outputs.ready == 'true'
-        env:
-          EXPECTED_TREE_SHA: ${{ steps.evidence.outputs.tree_sha256 }}
-        run: |
-          git add -A
-          ACTUAL_TREE_SHA=$(git write-tree)
-          test "$ACTUAL_TREE_SHA" = "$EXPECTED_TREE_SHA" || {
-            echo "GOV-UPGRADE-TREE-001: checks changed the certified tree"
-            exit 1
-          }
-
-      - name: Upload exact upgrade evidence
-        if: steps.upgrade.outputs.ready == 'true'
-        id: upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: governance-upgrade-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/upgrade-evidence/
-          if-no-files-found: error
-          retention-days: 14
-          compression-level: 0
-
-  verify-upgrade:
-    name: Independently reconstruct evidence without write authority
-    needs: certify-upgrade
-    if: needs.certify-upgrade.outputs.ready == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 40
-    permissions:
-      contents: read
-    outputs:
-      base_sha: ${{ steps.verified.outputs.base_sha }}
-      version: ${{ steps.verified.outputs.version }}
-      patch_sha256: ${{ steps.verified.outputs.patch_sha256 }}
-      tree_sha256: ${{ steps.verified.outputs.tree_sha256 }}
-      authority_sha256: ${{ steps.verified.outputs.authority_sha256 }}
-      verification_sha256: ${{ steps.verified.outputs.verification_sha256 }}
-    steps:
-      - name: Checkout exact certified base
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-          # repository_dispatch is loaded from the protected default branch. Do
-          # not trust an unprivileged job output to select writer source bytes.
-          ref: ${{ github.sha }}
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '24.14.0'
-          cache: npm
-
-      - name: Authenticate current protected-base materialization authority
-        run: |
-          test "$(git rev-parse HEAD)" = "${{ github.sha }}"
-          test "$(git rev-parse refs/remotes/origin/main)" = "${{ github.sha }}" || {
-            echo 'GOV-UPGRADE-SOURCE-002: main moved after dispatch; rerun against the new base'
-            exit 1
-          }
-          npm run setup:governance
-
-      - name: Download certified upgrade evidence
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: governance-upgrade-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/upgrade-evidence
-
-      - name: Independently reconstruct exact incoming tree without write authority
-        id: verified
-        env:
-          REQUESTED_VERSION: ${{ github.event.client_payload.version }}
-        run: |
-          test "${{ needs.certify-upgrade.outputs.base_sha }}" = "${{ github.sha }}"
-          test "${{ needs.certify-upgrade.outputs.version }}" = "${REQUESTED_VERSION#v}"
-          node scripts/verify-upgrade-evidence.mjs \
-            --verify-only \
-            --repo . \
-            --evidence "$RUNNER_TEMP/upgrade-evidence" \
-            --base-sha "${{ needs.certify-upgrade.outputs.base_sha }}" \
-            --version "${{ needs.certify-upgrade.outputs.version }}" \
-            --expected-patch-sha256 "${{ needs.certify-upgrade.outputs.patch_sha256 }}" \
-            --expected-tree-sha "${{ needs.certify-upgrade.outputs.tree_sha256 }}" \
-            --expected-authority-sha256 "${{ needs.certify-upgrade.outputs.authority_sha256 }}" \
-            --live-main-remote origin
-
-  write-upgrade-pr:
-    name: Apply preverified evidence + open Writer App reviewed PR
-    needs: [certify-upgrade, verify-upgrade]
-    if: needs.certify-upgrade.outputs.ready == 'true' && needs.verify-upgrade.result == 'success'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    environment:
-      name: governance-upgrade
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout exact verified base
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-          ref: ${{ needs.verify-upgrade.outputs.base_sha }}
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '24.14.0'
-          cache: npm
-
-      - name: Install authenticated protected-base verifier only
-        run: |
-          test "$(git rev-parse HEAD)" = "${{ needs.verify-upgrade.outputs.base_sha }}"
-          npm run setup:governance
-
-      - name: Download exact certifier evidence
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          name: governance-upgrade-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/upgrade-evidence
-
-      - name: Rebind trusted verification and apply verified candidate bytes
-        id: applied
-        run: |
-          test "${{ needs.verify-upgrade.outputs.base_sha }}" = "${{ needs.certify-upgrade.outputs.base_sha }}"
-          test "${{ needs.verify-upgrade.outputs.version }}" = "${{ needs.certify-upgrade.outputs.version }}"
-          test "${{ needs.verify-upgrade.outputs.patch_sha256 }}" = "${{ needs.certify-upgrade.outputs.patch_sha256 }}"
-          test "${{ needs.verify-upgrade.outputs.tree_sha256 }}" = "${{ needs.certify-upgrade.outputs.tree_sha256 }}"
-          test "${{ needs.verify-upgrade.outputs.authority_sha256 }}" = "${{ needs.certify-upgrade.outputs.authority_sha256 }}"
-          node scripts/verify-upgrade-evidence.mjs \
-            --apply-preverified \
-            --repo . \
-            --evidence "$RUNNER_TEMP/upgrade-evidence" \
-            --base-sha "${{ needs.verify-upgrade.outputs.base_sha }}" \
-            --version "${{ needs.verify-upgrade.outputs.version }}" \
-            --expected-patch-sha256 "${{ needs.verify-upgrade.outputs.patch_sha256 }}" \
-            --expected-tree-sha "${{ needs.verify-upgrade.outputs.tree_sha256 }}" \
-            --expected-authority-sha256 "${{ needs.verify-upgrade.outputs.authority_sha256 }}" \
-            --expected-verification-sha256 "${{ needs.verify-upgrade.outputs.verification_sha256 }}" \
-            --live-main-remote origin
-
-      - name: Mint least-privilege short-lived Governance Writer App token
-        id: app-token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
-        with:
-          app-id: ${{ secrets.GOVERNANCE_WRITER_APP_ID }}
-          private-key: ${{ secrets.GOVERNANCE_WRITER_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: ${{ github.event.repository.name }}
-          permission-contents: write
-          permission-pull-requests: write
-          permission-workflows: write
-
-      - name: Open or reuse one Writer App-authored deterministic upgrade PR, then dispatch trusted validation
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GH_PROMPT_DISABLED: '1'
-          PATH: /usr/bin:/bin
-          HOME: ${{ runner.temp }}/upgrade-writer-home
-          XDG_CONFIG_HOME: ${{ runner.temp }}/upgrade-writer-home/xdg
-          GH_CONFIG_DIR: ${{ runner.temp }}/upgrade-writer-home/gh
-          GIT_CONFIG_NOSYSTEM: '1'
-          GIT_CONFIG_GLOBAL: /dev/null
-          GIT_TERMINAL_PROMPT: '0'
-          GIT_ASKPASS: /bin/false
-          SSH_ASKPASS: /bin/false
-          GIT_PAGER: /bin/cat
-          PAGER: /bin/cat
-          HTTP_PROXY: ''
-          HTTPS_PROXY: ''
-          ALL_PROXY: ''
-          NO_PROXY: ''
-          GIT_CONFIG_COUNT: '4'
-          GIT_CONFIG_KEY_0: credential.helper
-          GIT_CONFIG_VALUE_0: ''
-          GIT_CONFIG_KEY_1: credential.helper
-          GIT_CONFIG_VALUE_1: '!/usr/bin/gh auth git-credential'
-          GIT_CONFIG_KEY_2: core.hooksPath
-          GIT_CONFIG_VALUE_2: /dev/null
-          GIT_CONFIG_KEY_3: protocol.file.allow
-          GIT_CONFIG_VALUE_3: never
-          GIT_AUTHOR_NAME: Qijenchen Governance Writer App
-          GIT_AUTHOR_EMAIL: qijenchen-governance-writer[bot]@users.noreply.github.com
-          GIT_COMMITTER_NAME: Qijenchen Governance Writer App
-          GIT_COMMITTER_EMAIL: qijenchen-governance-writer[bot]@users.noreply.github.com
-          BASE_SHA: ${{ needs.verify-upgrade.outputs.base_sha }}
-          VERSION: ${{ needs.verify-upgrade.outputs.version }}
-          TREE_SHA: ${{ needs.verify-upgrade.outputs.tree_sha256 }}
-          PATCH_SHA: ${{ needs.verify-upgrade.outputs.patch_sha256 }}
-          WRITER_LOGIN: qijenchen-governance-writer[bot]
-        run: |
-          set -euo pipefail
-          test -n "$GH_TOKEN" || { echo 'GOV-UPGRADE-TOKEN-001: Governance Writer App token missing'; exit 1; }
-          WRITER_TOKEN="$GH_TOKEN"
-          unset GH_TOKEN
-          gh() {
-            /usr/bin/env -i \
-              PATH=/usr/bin:/bin \
-              HOME="$HOME" \
-              XDG_CONFIG_HOME="$XDG_CONFIG_HOME" \
-              GH_CONFIG_DIR="$GH_CONFIG_DIR" \
-              GH_TOKEN="$WRITER_TOKEN" \
-              GH_PROMPT_DISABLED=1 \
-              /usr/bin/gh "$@"
-          }
-          git() {
-            local token_environment=()
-            case "${1:-}" in
-              fetch|ls-remote|push)
-                token_environment=(GH_TOKEN="$WRITER_TOKEN" GH_PROMPT_DISABLED=1)
-                ;;
-            esac
-            /usr/bin/env -i \
-              PATH=/usr/bin:/bin \
-              HOME="$HOME" \
-              LANG=C.UTF-8 \
-              LC_ALL=C.UTF-8 \
-              TZ=UTC \
-              GIT_CONFIG_NOSYSTEM=1 \
-              GIT_CONFIG_GLOBAL=/dev/null \
-              GIT_TERMINAL_PROMPT=0 \
-              GIT_ASKPASS=/bin/false \
-              SSH_ASKPASS=/bin/false \
-              GIT_PAGER=/bin/cat \
-              PAGER=/bin/cat \
-              GIT_CONFIG_COUNT=4 \
-              GIT_CONFIG_KEY_0=credential.helper \
-              GIT_CONFIG_VALUE_0= \
-              GIT_CONFIG_KEY_1=credential.helper \
-              GIT_CONFIG_VALUE_1='!/usr/bin/gh auth git-credential' \
-              GIT_CONFIG_KEY_2=core.hooksPath \
-              GIT_CONFIG_VALUE_2=/dev/null \
-              GIT_CONFIG_KEY_3=protocol.file.allow \
-              GIT_CONFIG_VALUE_3=never \
-              GIT_AUTHOR_NAME='Qijenchen Governance Writer App' \
-              GIT_AUTHOR_EMAIL='qijenchen-governance-writer[bot]@users.noreply.github.com' \
-              GIT_COMMITTER_NAME='Qijenchen Governance Writer App' \
-              GIT_COMMITTER_EMAIL='qijenchen-governance-writer[bot]@users.noreply.github.com' \
-              "${token_environment[@]}" \
-              /usr/bin/git "$@"
-          }
-          mkdir -m 700 "$HOME" "$XDG_CONFIG_HOME" "$GH_CONFIG_DIR"
-          BRANCH="governance/upgrade-${VERSION//./-}-${BASE_SHA:0:12}"
-          DESIRED_TREE=$(git write-tree)
-          LIVE_MAIN_SHA=$(git ls-remote --exit-code origin refs/heads/main | awk 'NR == 1 { print $1 }')
-          test "$LIVE_MAIN_SHA" = "$BASE_SHA" || {
-            echo 'GOV-UPGRADE-SOURCE-007: main moved before remote mutation'
-            exit 1
-          }
-          if ! git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
-            git checkout -b "$BRANCH"
-            git commit --no-gpg-sign -m "chore(governance): upgrade immutable snapshot to $VERSION"
-            LIVE_MAIN_SHA=$(git ls-remote --exit-code origin refs/heads/main | awk 'NR == 1 { print $1 }')
-            test "$LIVE_MAIN_SHA" = "$BASE_SHA" || { echo 'GOV-UPGRADE-SOURCE-007: main moved before branch push'; exit 1; }
-            git push origin "$BRANCH"
-          fi
-
-          git fetch --force --no-tags origin "refs/heads/$BRANCH:refs/remotes/origin/$BRANCH"
-          REMOTE_COMMIT=$(git rev-parse "refs/remotes/origin/$BRANCH^{commit}")
-          REMOTE_TREE=$(git rev-parse "$REMOTE_COMMIT^{tree}")
-          REMOTE_LINE=$(git rev-list --parents -n 1 "$REMOTE_COMMIT")
-          test "$(wc -w <<<"$REMOTE_LINE" | tr -d ' ')" = 2
-          REMOTE_PARENT=$(cut -d' ' -f2 <<<"$REMOTE_LINE")
-          test "$REMOTE_TREE" = "$DESIRED_TREE" && test "$REMOTE_PARENT" = "$BASE_SHA" || {
-            echo 'GOV-UPGRADE-BRANCH-001: deterministic branch exists with different evidence'
-            exit 1
-          }
-
-          PR_JSON=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --head "$BRANCH" --limit 2 \
-            --json number,url,author,baseRefName,headRefName,headRefOid,isCrossRepository)
-          PR_COUNT=$(jq 'length' <<<"$PR_JSON")
-          test "$PR_COUNT" -le 1 || { echo 'GOV-UPGRADE-PR-001: multiple deterministic PRs exist'; exit 1; }
-          if [ "$PR_COUNT" = 0 ]; then
-            LIVE_MAIN_SHA=$(git ls-remote --exit-code origin refs/heads/main | awk 'NR == 1 { print $1 }')
-            test "$LIVE_MAIN_SHA" = "$BASE_SHA" || { echo 'GOV-UPGRADE-SOURCE-007: main moved before PR creation'; exit 1; }
-            gh pr create \
-              --repo "$GITHUB_REPOSITORY" \
-              --base main \
-              --head "$BRANCH" \
-              --title "chore(governance): upgrade immutable snapshot to $VERSION" \
-              --body "Automated exact-version upgrade from base \`$BASE_SHA\`. Certified tree: \`$TREE_SHA\`; patch: \`sha256:$PATCH_SHA\`. The dedicated Writer App is not a check authority; automatic candidate runs are non-authoritative. The protected-default validation dispatch publishes the required Check App verdict."
-            PR_JSON=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --head "$BRANCH" --limit 2 \
-              --json number,url,author,baseRefName,headRefName,headRefOid,isCrossRepository)
-          fi
-
-          test "$(jq 'length' <<<"$PR_JSON")" = 1 || { echo 'GOV-UPGRADE-PR-001: deterministic PR is missing or ambiguous'; exit 1; }
-          test "$(jq -r '.[0].baseRefName' <<<"$PR_JSON")" = main || { echo 'GOV-UPGRADE-PR-002: existing PR targets the wrong base'; exit 1; }
-          test "$(jq -r '.[0].author.login' <<<"$PR_JSON")" = "$WRITER_LOGIN" || { echo 'GOV-UPGRADE-PR-002: PR author is not the Governance Writer App'; exit 1; }
-          test "$(jq -r '.[0].headRefName' <<<"$PR_JSON")" = "$BRANCH" || { echo 'GOV-UPGRADE-PR-003: existing PR uses the wrong head ref'; exit 1; }
-          test "$(jq -r '.[0].isCrossRepository' <<<"$PR_JSON")" = false || { echo 'GOV-UPGRADE-PR-003: existing PR uses a fork head'; exit 1; }
-          test "$(jq -r '.[0].headRefOid' <<<"$PR_JSON")" = "$REMOTE_COMMIT" || { echo 'GOV-UPGRADE-PR-004: existing PR head differs from the verified remote commit'; exit 1; }
-          PR_NUMBER=$(jq -r '.[0].number' <<<"$PR_JSON")
-
-          LIVE_MAIN_SHA=$(git ls-remote --exit-code origin refs/heads/main | awk 'NR == 1 { print $1 }')
-          LIVE_BRANCH_SHA=$(git ls-remote --exit-code origin "refs/heads/$BRANCH" | awk 'NR == 1 { print $1 }')
-          test "$LIVE_MAIN_SHA" = "$BASE_SHA" && test "$LIVE_BRANCH_SHA" = "$REMOTE_COMMIT" || {
-            echo 'GOV-UPGRADE-SOURCE-008: base or candidate moved before trusted validation dispatch'
-            exit 1
-          }
-          jq -n \
-            --arg source 'governance-upgrade-writer-v1' \
-            --argjson pull_number "$PR_NUMBER" \
-            --arg head_sha "$REMOTE_COMMIT" \
-            --arg base_sha "$BASE_SHA" \
-            '{event_type:"governance-upgrade-candidate-validation",client_payload:{source:$source,pull_number:$pull_number,head_sha:$head_sha,base_sha:$base_sha}}' \
-            | gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -
-          WRITER_TOKEN=''
-          unset WRITER_TOKEN