@starci/hfs 4.5.1 → 4.7.0

package/templates/app/hooks/husky/pre-push

@@ -4,6 +4,8 @@
 #   refs/backup/*                  allowed: the coordinator backup namespace
 #   refs/heads/main, refs/tags/v*  allowed only when HEAD carries an annotated tag v[0-9]* and the release cut recorded the
 #                                  full suite of HEAD: <git common dir>/starci-release/<HEAD sha>.l4.json names that head and tag
+#   refs/heads/release/candidate-* the release candidate (starci app release push sends the release sha there first and moves main
+#                                  and the tag only when its ci.yml run is green): allowed under the same release gate, never deleted
 #   any other ref, a delete        refused
 common=$(git rev-parse --git-common-dir)
 case "$common" in /* | [A-Za-z]:*) ;; *) common="$(pwd)/$common" ;; esac
@@ -12,7 +14,7 @@ record="$common/starci-release/$head.l4.json"
 status=0
 gate=""
 refuse() {
-  echo "RIGHTS_PUSH_NOT_RELEASE: $1 - the allowed path is the release cut (main and v* tags) or refs/backup/* (backups)" >&2
+  echo "RIGHTS_PUSH_NOT_RELEASE: $1 - the allowed path is the release cut (main, v* tags and the release/candidate-* ref) or refs/backup/* (backups)" >&2
   status=1
 }
 # gate: the verdict of the release gate for HEAD, computed once: "ok" or the reason it is closed.
@@ -33,7 +35,7 @@ release_gate() {
 while read -r local_ref local_sha remote_ref remote_sha; do
   case "$remote_ref" in
     refs/backup/*) ;;
-    refs/heads/main | refs/tags/v*)
+    refs/heads/main | refs/tags/v* | refs/heads/release/candidate-*)
       case "$local_sha" in
         *[!0]*) ;;
         *) refuse "refusing to delete $remote_ref"; continue ;;

package/templates/app/skeleton/.github/dependabot.yml

@@ -1,4 +1,3 @@
 {{header}}
 version: 2
-updates:
-{{dependabotUpdates}}
+updates:{{dependabotUpdates}}

package/templates/app/skeleton-lite/.github/dependabot.yml

@@ -1,4 +1,3 @@
 {{header}}
 version: 2
-updates:
-{{dependabotUpdates}}
+updates:{{dependabotUpdates}}

package/release/ci-red.mjs

@@ -1,70 +0,0 @@
-// ci-red.mjs - the latest completed default-branch CI is a release precondition; unreadable GitHub warns, a red run needs the owner's SHA-bound override.
-import fs from 'node:fs';
-import path from 'node:path';
-import { refusal } from '../stack/errors.mjs';
-
-const FIELDS = 'databaseId,headSha,status,conclusion,url,event,createdAt';
-const SHA = /^[a-f0-9]{40}$/u;
-const RED = new Set(['failure', 'cancelled', 'timed_out', 'startup_failure', 'action_required']);
-
-/** Every process uses the supplied seam; an unavailable executable is an unreadable result. */
-function run(spawn, cwd, command, args) {
-  try { return spawn(command, args, { cwd }); } catch { return { status: null }; }
-}
-
-function runsOf(result) {
-  if (result.error || result.status !== 0) return null;
-  try {
-    const rows = JSON.parse(result.stdout);
-    return Array.isArray(rows) ? rows : null;
-  } catch { return null; }
-}
-
-/** Reads branch runs plus push/tag runs whose commits are reachable from the default branch; the newest completed run decides, even if a newer run is pending. */
-export function latestDefaultBranchCi({ spawn, cwd, defaultBranch = 'main' }) {
-  const args = ['run', 'list', '--workflow', 'ci.yml'];
-  const tail = ['--limit', '20', '--json', FIELDS];
-  const branch = runsOf(run(spawn, cwd, 'gh', [...args, '--branch', defaultBranch, ...tail]));
-  if (!branch) return { state: 'unknown', why: 'gh branch runs unavailable (missing gh, authentication, or unreadable response)' };
-  const pushes = runsOf(run(spawn, cwd, 'gh', [...args, '--event', 'push', ...tail]));
-  if (!pushes) return { state: 'unknown', why: 'gh push runs unavailable (missing gh, authentication, or unreadable response)' };
-  const candidates = branch.filter((row) => row && SHA.test(row.headSha));
-  let ancestryUnknown = false;
-  for (const row of pushes) {
-    if (!row || !SHA.test(row.headSha) || row.event !== 'push') continue;
-    const ancestor = run(spawn, cwd, 'git', ['merge-base', '--is-ancestor', row.headSha, defaultBranch]);
-    if (!ancestor.error && ancestor.status === 0) candidates.push(row);
-    else if (ancestor.error || ancestor.status !== 1) ancestryUnknown = true;
-  }
-  const completed = candidates.filter((row) => row.status === 'completed' && Number.isFinite(Date.parse(row.createdAt)));
-  completed.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || Number(b.databaseId) - Number(a.databaseId));
-  const latest = completed[0];
-  if (!latest) return { state: 'unknown', why: ancestryUnknown ? 'cannot establish push run ancestry on the default branch' : 'no completed CI run on the default branch' };
-  if (latest.conclusion === 'success') return { state: 'green', run: latest };
-  if (RED.has(latest.conclusion)) return { state: 'red', run: latest };
-  return { state: 'unknown', why: 'latest completed CI run has no success or red conclusion', run: latest };
-}
-
-/** Only a complete starci/ci-override@1 record for this exact commit can excuse a red run. */
-function overrideOf(ctx, sha) {
-  const common = run(ctx.spawn, ctx.cwd, 'git', ['rev-parse', '--git-common-dir']);
-  if (common.error || common.status !== 0 || !String(common.stdout ?? '').trim()) return null;
-  const file = path.join(path.resolve(ctx.cwd, String(common.stdout).trim()), 'starci-release', `${sha}.ci-override.json`);
-  try {
-    const record = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (record.schema !== 'starci/ci-override@1' || record.sha !== sha || typeof record.reason !== 'string' || !record.reason.trim() || typeof record.by !== 'string' || !record.by.trim() || typeof record.at !== 'string' || !Number.isFinite(Date.parse(record.at))) return null;
-    return record;
-  } catch { return null; }
-}
-
-/** Warns on unknown CI and refuses red CI unless the owner left a valid override beside the release records. */
-export function requireGreenCi(ctx, ci) {
-  if (ci.state === 'unknown') {
-    ctx.stderr(`RELEASE_CI_UNKNOWN: ${ci.why}\n`);
-    return [];
-  }
-  if (ci.state !== 'red') return [];
-  const record = overrideOf(ctx, ci.run.headSha);
-  if (record) return [`RELEASE_CI_RED overridden by the owner: ${record.reason}`];
-  throw refusal('RELEASE_CI_RED', `CI run ${ci.run.url} for ${ci.run.headSha} concluded ${ci.run.conclusion}; the owner must use starci release ci-override --sha ${ci.run.headSha} --reason <text>`);
-}