@starci/hfs 5.0.5 → 5.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/README.md +22 -2
  3. package/cache/session.mjs +1 -1
  4. package/cache/test-family.d.mts +1 -1
  5. package/cache/test-family.mjs +15 -7
  6. package/ci/cli.d.mts +7 -1
  7. package/ci/cli.mjs +37 -6
  8. package/ci/github.d.mts +1 -0
  9. package/ci/secret.d.mts +10 -1
  10. package/ci/secret.mjs +26 -6
  11. package/ci/verify.d.mts +9 -1
  12. package/ci/verify.mjs +5 -3
  13. package/package.json +1 -1
  14. package/release/candidate-ci.mjs +1 -1
  15. package/release/gate.d.mts +1 -0
  16. package/release/gate.mjs +76 -18
  17. package/release/index.d.mts +1 -1
  18. package/release/index.mjs +7 -3
  19. package/runtime/knowledge/hfs/canon-pins.yaml +6 -6
  20. package/runtime/knowledge/hfs/rules.yaml +2 -2
  21. package/runtime/modules/kernel/failure-codes.yaml +4 -4
  22. package/runtime/modules/schemas/application-stacks.schema.yaml +10 -7
  23. package/runtime/scripts/gates/starcistacks-ci.mjs +3 -1
  24. package/runtime/scripts/gates/starcistacks-form.d.mts +1 -0
  25. package/runtime/scripts/gates/starcistacks.d.mts +1 -0
  26. package/runtime/scripts/gates/starcistacks.mjs +22 -10
  27. package/runtime/scripts/hfs/architecture/contract-bounds.d.mts +3 -0
  28. package/runtime/scripts/hfs/architecture/contract-bounds.mjs +72 -0
  29. package/runtime/scripts/hfs/architecture/index.mjs +1 -1
  30. package/runtime/scripts/hfs/architecture/tiers.d.mts +2 -1
  31. package/runtime/scripts/hfs/architecture/tiers.mjs +45 -4
  32. package/runtime/scripts/hfs/ci-declaration.d.mts +47 -1
  33. package/runtime/scripts/hfs/ci-declaration.mjs +115 -3
  34. package/runtime/scripts/hfs/repo-identity.d.mts +5 -1
  35. package/runtime/scripts/hfs/repo-identity.mjs +15 -10
  36. package/runtime/scripts/hfs/rules/ci-custody.mjs +21 -32
  37. package/runtime/scripts/hfs/rules/env-parity.mjs +15 -6
  38. package/runtime/scripts/hfs/secret-standard.d.mts +1 -0
  39. package/runtime/scripts/hfs/secret-standard.mjs +25 -4
  40. package/runtime/scripts/hfs/secret-store.d.mts +5 -0
  41. package/runtime/scripts/hfs/secret-store.mjs +31 -0
  42. package/src/main.mjs +1 -1
  43. package/sync/ci-commands.mjs +2 -1
  44. package/sync/quality-services.mjs +3 -2
  45. package/sync/readme-badges.mjs +1 -1
  46. package/sync/sonar-key.d.mts +2 -3
  47. package/sync/sonar-key.mjs +7 -14
  48. package/templates/app/skeleton/.starcistacks/application-stacks.yaml +7 -3
  49. package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml +7 -3
package/templates/app/skeleton/.starcistacks/application-stacks.yaml CHANGED
@@ -181,11 +181,15 @@ services:
181
181
  environment: dev
182
182
  compose: compose.yaml
183
183
  auth: token
184
- credentials: []
184
+ credentials:
185
+ - id: analysis
186
+ project: "{{project}}"
187
+ key: SONAR_TOKEN
188
+ custody: {repository: "{{project}}", path: .starcistacks/dev/secrets/sonar.enc.yaml}
185
189
  projects: [{repository: "{{project}}", key: "{{project}}"}]
186
- ci: {wiring: required, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
190
+ ci: {wiring: required, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL, secrets: [{name: SONAR_TOKEN, credential: analysis}]}
187
191
  ownerAction:
188
- needed: Provision this app's Sonar host and project, then set SONAR_TOKEN with starci app ci secret set SONAR_TOKEN --execute and sync SONAR_HOST_URL.
192
+ needed: Declare this app's connection profile and project credential with its actual sealed member/key and project reference, seal it through starci app secret, bind ci.secrets to that credential, then set the CI execution copy with starci app ci secret set SONAR_TOKEN --from-custody --execute and sync SONAR_HOST_URL.
189
193
  reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.
190
194
  codecov:
191
195
  provider: codecov
package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml CHANGED
@@ -270,11 +270,15 @@ services:
270
270
  environment: dev
271
271
  compose: compose.yaml
272
272
  auth: token
273
- credentials: []
273
+ credentials:
274
+ - id: analysis
275
+ project: "{{project}}"
276
+ key: SONAR_TOKEN
277
+ custody: {repository: "{{project}}", path: .starcistacks/dev/secrets/sonar.enc.yaml}
274
278
  projects: [{repository: "{{project}}", key: "{{project}}"}]
275
- ci: {wiring: required, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
279
+ ci: {wiring: required, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL, secrets: [{name: SONAR_TOKEN, credential: analysis}]}
276
280
  ownerAction:
277
- needed: Provision this app's Sonar host and project, then set SONAR_TOKEN with starci app ci secret set SONAR_TOKEN --execute and sync SONAR_HOST_URL.
281
+ needed: Declare this app's connection profile and project credential with its actual sealed member/key and project reference, seal it through starci app secret, bind ci.secrets to that credential, then set the CI execution copy with starci app ci secret set SONAR_TOKEN --from-custody --execute and sync SONAR_HOST_URL.
278
282
  reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.
279
283
  codecov:
280
284
  provider: codecov