@rtrentjones/greenlight 0.2.6 → 0.2.7

package/assets/skills/provider-github/SKILL.md

@@ -25,8 +25,9 @@ pushes each to the right repo; see docs/provider-tokens.md):
 
 - **`GREENLIGHT_DISPATCH_TOKEN`** — on the **tool** repo, scoped **Contents: write** on the
   **wrapper** → the tool's build fires `repository_dispatch` so the wrapper deploys.
-- **`GREENLIGHT_STATUS_TOKEN`** — on the **wrapper** repo, scoped **Commit statuses: write** on the
-  **tool** → the wrapper posts deploy/verify status back to the tool's commit.
+- **`GREENLIGHT_STATUS_TOKEN_<TOOL>`** — on the **wrapper** repo, scoped **Commit statuses: write**
+  on the **tool** → the wrapper posts deploy/verify status back to the tool's commit. **Per-tool
+  suffix** (e.g. `…_BAMCP`) because it lives on the shared wrapper alongside other tools' tokens.
 
 Provider creds (OCI/Cloudflare/…) live **only in the wrapper**; the tool repo holds just the
 dispatch PAT (its build pushes to GHCR with the built-in `github.token`).

package/dist/bin.js

@@ -5,8 +5,8 @@ import {
   loadConfig,
   resolveUrl,
   verifyAll
-} from "./chunk-LM6M3DIV.js";
-import "./chunk-XBDQJVAX.js";
+} from "./chunk-VONSDNH4.js";
+import "./chunk-ADS6BJJ5.js";
 import "./chunk-WFZTRXBF.js";
 import "./chunk-KP3Y6WRU.js";
 import "./chunk-UXHHLEYO.js";
@@ -351,9 +351,12 @@ var PACKS = [
         setupUrl: "https://github.com/settings/personal-access-tokens/new"
       },
       {
+        // Stored on the shared wrapper, scoped to THIS tool's repo → per-tool name
+        // (GREENLIGHT_STATUS_TOKEN_<TOOL>) so multiple tools' status tokens don't collide.
         envVar: "GREENLIGHT_STATUS_TOKEN",
-        label: "GitHub PAT, Commits:write on the TOOL (WRAPPER posts deploy status back)",
+        label: "GitHub PAT, Commit statuses:write on the TOOL (WRAPPER posts deploy status back)",
         optional: true,
+        perTool: true,
         setupUrl: "https://github.com/settings/personal-access-tokens/new"
       }
     ],
@@ -387,7 +390,7 @@ function tokensForTool(tool) {
 }
 
 // src/version.ts
-var MODULE_REF = "v0.2.6";
+var MODULE_REF = "v0.2.7";
 var MODULE_SOURCE_BASE = "git::https://github.com/RTrentJones/greenlight.git//infra/modules";
 function moduleSource(module, ref = MODULE_REF) {
   return `${MODULE_SOURCE_BASE}/${module}?ref=${ref}`;
@@ -797,7 +800,8 @@ async function gatherSecrets(name, repo, env, prefill) {
     for (const pack of packs) {
       console.log(`\u2500\u2500 ${pack.name}${pack.setupUrl ? `  \u2192  ${pack.setupUrl}` : ""}`);
       for (const tok of pack.tokens) {
-        const key = tok.envVar.toUpperCase();
+        const suffix = `_${name.toUpperCase().replace(/-/g, "_")}`;
+        const key = tok.envVar.toUpperCase() + (tok.perTool ? suffix : "");
         if (key === "GITHUB_TOKEN") {
           console.log("   \xB7 GITHUB_TOKEN \u2014 provided automatically by Actions; skipping");
           continue;
@@ -1317,13 +1321,13 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    # Native arm64 runner \u2014 builds the arm64 image directly (no QEMU emulation, much faster).
+    runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v4
       - name: Resolve image ref (GHCR namespaces are lowercase)
         id: img
-        run: echo "ref=ghcr.io/\${GITHUB_REPOSITORY_OWNER,,}/${name}:prod" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-qemu-action@v3
+        run: echo "base=ghcr.io/\${GITHUB_REPOSITORY_OWNER,,}/${name}" >> "$GITHUB_OUTPUT"
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
@@ -1335,7 +1339,12 @@ jobs:
           context: .
           platforms: linux/arm64
           push: true
-          tags: \${{ steps.img.outputs.ref }}
+          # :prod is the moving deploy tag; :<sha> is immutable (rollback + deploy-identity).
+          tags: |
+            \${{ steps.img.outputs.base }}:prod
+            \${{ steps.img.outputs.base }}:\${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
       - name: Notify wrapper to deploy
         env:
           GH_TOKEN: \${{ secrets.GREENLIGHT_DISPATCH_TOKEN }}
@@ -1402,7 +1411,8 @@ jobs:
       - name: Report status back to ${toolRepo}
         if: \${{ always() && github.event.client_payload.sha != '' }}
         env:
-          GH_TOKEN: \${{ secrets.GREENLIGHT_STATUS_TOKEN }}
+          # Per-tool name: the status PAT lives on the shared wrapper, scoped to this tool's repo.
+          GH_TOKEN: \${{ secrets.GREENLIGHT_STATUS_TOKEN_${name.toUpperCase().replace(/-/g, "_")} }}
         run: |
           [ -z "$GH_TOKEN" ] && exit 0
           gh api repos/${toolRepo}/statuses/\${{ github.event.client_payload.sha }} \\

package/dist/{chunk-XBDQJVAX.js → chunk-ADS6BJJ5.js}

@@ -9,7 +9,10 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 async function verifyMcp(baseUrl, spec) {
   const checks = [];
   const client = new Client({ name: "greenlight-verify", version: "0.0.0" });
-  const transport = new StreamableHTTPClientTransport(new URL(baseUrl));
+  const transport = new StreamableHTTPClientTransport(
+    new URL(baseUrl),
+    spec.headers ? { requestInit: { headers: spec.headers } } : void 0
+  );
   try {
     await client.connect(transport);
     checks.push({ name: "initialize handshake", pass: true });

package/dist/{chunk-LM6M3DIV.js → chunk-VONSDNH4.js}

@@ -229,7 +229,7 @@ async function verify(baseUrl, spec, opts) {
     case "api":
       return verifyApi(baseUrl, spec);
     case "mcp": {
-      const { verifyMcp: verifyMcp2 } = await import("./mcp-KU7WKB5K.js");
+      const { verifyMcp: verifyMcp2 } = await import("./mcp-3L6HJ6BH.js");
       return verifyMcp2(baseUrl, spec);
     }
     case "playwright": {

package/dist/index.js

@@ -2,8 +2,8 @@ import {
   defineConfig,
   defineVerify,
   loadConfig
-} from "./chunk-LM6M3DIV.js";
-import "./chunk-XBDQJVAX.js";
+} from "./chunk-VONSDNH4.js";
+import "./chunk-ADS6BJJ5.js";
 import "./chunk-WFZTRXBF.js";
 import "./chunk-KP3Y6WRU.js";
 import "./chunk-UXHHLEYO.js";

package/dist/{mcp-KU7WKB5K.js → mcp-3L6HJ6BH.js}

@@ -1,6 +1,6 @@
 import {
   verifyMcp
-} from "./chunk-XBDQJVAX.js";
+} from "./chunk-ADS6BJJ5.js";
 import "./chunk-QFKE5JKC.js";
 export {
   verifyMcp

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rtrentjones/greenlight",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Greenlight CLI — setup and lifecycle for the harness.",
   "license": "MIT",
   "repository": {