@synoikia/create-plugin 0.3.1 → 0.4.0

package/dist/workflow/index.js

@@ -0,0 +1,162 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { checkBranch } from './branch.js';
+import { loadConfig } from './config.js';
+import { checkFeatures, checkSlice } from './features.js';
+import { addedLines, changedSince, commitsSince, currentBranch, git, mergeBase, showFile, stagedFiles, trackedFiles, } from './git.js';
+import { matchesAny } from './glob.js';
+import { checkPhases } from './phases.js';
+import { checkProse } from './prose.js';
+import { featuresFailAt } from './red.js';
+import { credentialPaths } from './secrets.js';
+import { checkSecurityLine } from './security-line.js';
+import { syncWorkflow } from './sync.js';
+import { unlistedTests } from './tests.js';
+export const WORKFLOW_USAGE = `synoikia-plugin workflow <command>   (rules: docs/workflow.md)
+
+  check-branch [name]                    Branch name (default: the PR head or the current branch)
+  check-phases --base <ref> [--red-green] [--backfill]
+                                         One phase per commit. --red-green runs the scenarios at the test: commit
+  check-features [--base <ref>] [--backfill]
+                                         Feature files. With --base: the slice size and new test files
+  check-prose [--base <ref>] [--pr-body] [files...]
+                                         Writing rules on files, on lines added since <ref>, or on the PR description
+  check-security-line --base <ref>       A ready PR that changes a security path has a "Security audit:" line
+  pre-commit                             Credential file names, then gitleaks on staged changes when installed
+  pre-push [--base <ref>]                check-branch, check-features, check-prose and check-phases (default base origin/main)
+  hooks install                          Use .githooks for this clone
+  sync [--check]                         Write the shared workflow files, or list the ones out of date
+`;
+const OPTIONS = {
+    base: { type: 'string' },
+    'red-green': { type: 'boolean' },
+    backfill: { type: 'boolean' },
+    'pr-body': { type: 'boolean' },
+    check: { type: 'boolean' },
+};
+const report = (title, issues) => {
+    for (const issue of issues)
+        console.error(`${title}: ${issue}`);
+    return issues.length ? 1 : 0;
+};
+const pullRequest = () => {
+    const file = process.env.GITHUB_EVENT_PATH;
+    if (!file)
+        return undefined;
+    return JSON.parse(readFileSync(file, 'utf8'))
+        .pull_request;
+};
+function branch({ root, config }, name) {
+    const branchName = name ?? currentBranch(root);
+    if (!branchName)
+        return report('check-branch', ['no branch (detached HEAD). Pass the name']);
+    return report('check-branch', checkBranch(branchName, config.components, config.ignoreBranches));
+}
+const readFeatures = (root, ref, config) => trackedFiles(root, ref ?? 'HEAD')
+    .filter((f) => matchesAny(f, config.features))
+    .map((f) => ({ path: f, text: (ref ? showFile(root, ref, f) : readFileSync(path.join(root, f), 'utf8')) ?? '' }));
+function features({ root, config }, base, backfill) {
+    const issues = checkFeatures(readFeatures(root, undefined, config));
+    if (base) {
+        if (!backfill)
+            issues.push(...checkSlice(readFeatures(root, mergeBase(root, base), config), readFeatures(root, undefined, config)));
+        issues.push(...unlistedTests(changedSince(root, base, 'A'), config.unitTests));
+    }
+    return report('check-features', issues);
+}
+function prose({ root, config }, base, prBody, files) {
+    const issues = [];
+    if (files.length)
+        for (const f of files)
+            issues.push(...checkProse(f, readFileSync(path.join(root, f), 'utf8')));
+    else if (base) {
+        const changed = changedSince(root, base).filter((f) => matchesAny(f, config.prose));
+        const added = addedLines(root, base, changed);
+        for (const f of changed)
+            issues.push(...checkProse(f, readFileSync(path.join(root, f), 'utf8'), added.get(f) ?? new Set()));
+    }
+    if (prBody) {
+        const pr = pullRequest();
+        if (pr?.body)
+            issues.push(...checkProse('PR description', pr.body.replace(/\r\n/g, '\n')));
+    }
+    return report('check-prose', issues);
+}
+function phases({ root, config }, base, redGreen, backfill) {
+    const result = checkPhases(commitsSince(root, base), config, { backfill });
+    if (result.issues.length || !redGreen || !result.redAt)
+        return report('check-phases', result.issues);
+    const sha = result.redAt.sha;
+    console.log(`check-phases: running ${result.redFeatures.length} feature file(s) at ${sha.slice(0, 7)}, expecting red`);
+    if (!featuresFailAt(root, sha, result.redFeatures))
+        return report('check-phases', [
+            `the scenarios pass at ${sha.slice(0, 7)} ${result.redAt.subject}. Commit the steps before the code, so they fail first`,
+        ]);
+    console.log('check-phases: red at the test: commit. CI runs them green at the head');
+    return 0;
+}
+function securityLine({ root, config }, base) {
+    const pr = pullRequest();
+    if (!pr)
+        return report('check-security-line', ['no pull request event (GITHUB_EVENT_PATH)']);
+    return report('check-security-line', checkSecurityLine(pr, changedSince(root, base, 'ACMRD'), config.securityPaths));
+}
+function preCommit({ root }) {
+    const found = credentialPaths(stagedFiles(root));
+    if (found.length)
+        return report('pre-commit', found.map((f) => `${f} looks like a credential file. If it is tracked already: git rm --cached ${f}`));
+    const leaks = spawnSync('gitleaks', ['git', '--staged', '--no-banner', '--redact'], { cwd: root, stdio: 'inherit' });
+    if (leaks.error)
+        return 0;
+    return leaks.status === 0 ? 0 : report('pre-commit', ['gitleaks found a secret in the staged changes']);
+}
+export async function runWorkflow(argv, root) {
+    const [command, ...rest] = argv;
+    const { values, positionals } = parseArgs({ args: rest, allowPositionals: true, options: OPTIONS });
+    const ctx = { root, config: loadConfig(root) };
+    const base = values.base;
+    const needBase = () => {
+        if (!base)
+            throw new Error(`${command} needs --base <ref>`);
+        return base;
+    };
+    switch (command) {
+        case 'check-branch':
+            return branch(ctx, positionals[0]);
+        case 'check-phases':
+            return phases(ctx, needBase(), !!values['red-green'], !!values.backfill);
+        case 'check-features':
+            return features(ctx, base, !!values.backfill);
+        case 'check-prose':
+            return prose(ctx, base, !!values['pr-body'], positionals);
+        case 'check-security-line':
+            return securityLine(ctx, needBase());
+        case 'pre-commit':
+            return preCommit(ctx);
+        case 'pre-push': {
+            const b = base ?? 'origin/main';
+            if (currentBranch(root) === 'main')
+                return 0;
+            git(root, 'rev-parse', '--verify', '--quiet', b);
+            return branch(ctx) | features(ctx, b, false) | prose(ctx, b, false, []) | phases(ctx, b, false, false);
+        }
+        case 'hooks':
+            if (positionals[0] !== 'install')
+                break;
+            git(root, 'config', 'core.hooksPath', '.githooks');
+            console.log('git hooks: .githooks');
+            return 0;
+        case 'sync': {
+            const changed = syncWorkflow(root, !!values.check);
+            if (values.check)
+                return report('sync', changed.map((f) => `${f} differs from the template. Run the sync`));
+            console.log(changed.length ? `wrote ${changed.join(', ')}` : 'workflow files are current');
+            return 0;
+        }
+    }
+    console.error(WORKFLOW_USAGE);
+    return 2;
+}
+//# sourceMappingURL=index.js.map

package/dist/workflow/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,GAAG,EACH,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CAc7B,CAAC;AAEF,MAAM,OAAO,GAAG;IACd,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAClB,CAAC;AAOX,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAyB,EAAE,EAAE;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,GAAwD,EAAE;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgE;SAC1G,YAAY,CAAC;AAClB,CAAC,CAAC;AAEF,SAAS,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAO,EAAE,IAAa;IAClD,MAAM,UAAU,GAAG,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,GAAuB,EAAE,MAAsB,EAAgB,EAAE,CACnG,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC;KAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;KAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtH,SAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAO,EAAE,IAAwB,EAAE,QAAiB;IAClF,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,QAAQ;YACX,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CACxG,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAO,EAAE,IAAwB,EAAE,MAAe,EAAE,KAAe;IAC9F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;SAC5G,IAAI,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,OAAO;YACrB,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACzB,IAAI,EAAE,EAAE,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAO,EAAE,IAAY,EAAE,QAAiB,EAAE,QAAiB;IACvF,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC7B,OAAO,CAAC,GAAG,CACT,yBAAyB,MAAM,CAAC,WAAW,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAC1G,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;QAChD,OAAO,MAAM,CAAC,cAAc,EAAE;YAC5B,yBAAyB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,wDAAwD;SACzH,CAAC,CAAC;IACL,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAO,EAAE,IAAY;IACvD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,CAAC,2CAA2C,CAAC,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,SAAS,CAAC,EAAE,IAAI,EAAO;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM;QACd,OAAO,MAAM,CACX,YAAY,EACZ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,4EAA4E,CAAC,EAAE,CAAC,CACtG,CAAC;IACJ,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACrH,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,+CAA+C,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,IAAY;IAC5D,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpG,MAAM,GAAG,GAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,qBAAqB,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3E,KAAK,gBAAgB;YACnB,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;QAC5D,KAAK,qBAAqB;YACxB,OAAO,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,KAAK,YAAY;YACf,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,IAAI,IAAI,aAAa,CAAC;YAChC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,MAAM;gBAAE,OAAO,CAAC,CAAC;YAC7C,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,OAAO;YACV,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM;YACxC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK;gBACd,OAAO,MAAM,CACX,MAAM,EACN,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,0CAA0C,CAAC,CACnE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/workflow/phases.d.ts

@@ -0,0 +1,22 @@
+import type { WorkflowConfig } from './config.js';
+export interface Commit {
+    sha: string;
+    subject: string;
+    files: string[];
+}
+export declare const PHASES: readonly ["spec", "arch", "test", "feat", "fix", "refactor", "docs", "chore", "ci"];
+export type Phase = (typeof PHASES)[number];
+export declare const phaseOf: (subject: string) => Phase | undefined;
+type Paths = Pick<WorkflowConfig, 'features' | 'steps' | 'architecture' | 'unitTests' | 'source'>;
+export interface PhaseResult {
+    issues: string[];
+    /** The last `test:` commit before the first code commit: its new scenarios must fail there. */
+    redAt?: Commit;
+    /** Feature files that the spec and test commits changed. */
+    redFeatures: string[];
+}
+/** Commits of a branch, oldest first: one phase each, and code changes come after a red test commit. */
+export declare function checkPhases(commits: readonly Commit[], paths: Paths, opts?: {
+    backfill?: boolean;
+}): PhaseResult;
+export {};

package/dist/workflow/phases.js

@@ -0,0 +1,50 @@
+import { matchesAny } from './glob.js';
+export const PHASES = ['spec', 'arch', 'test', 'feat', 'fix', 'refactor', 'docs', 'chore', 'ci'];
+const PREFIX = new RegExp(`^(${PHASES.join('|')})(?:\\([a-z0-9-]+\\))?!?: \\S`);
+export const phaseOf = (subject) => subject.match(PREFIX)?.[1];
+const TESTS = ['**/test/**', '**/*.test.ts', '**/*.spec.ts'];
+/** What each phase may change. */
+function allowed(phase, file, paths) {
+    const feature = matchesAny(file, paths.features);
+    const model = matchesAny(file, paths.architecture);
+    if (phase === 'spec')
+        return feature;
+    if (phase === 'arch')
+        return model;
+    if (phase === 'test')
+        return matchesAny(file, [...paths.steps, ...TESTS, ...paths.unitTests]);
+    return !feature && !model;
+}
+/** Commits of a branch, oldest first: one phase each, and code changes come after a red test commit. */
+export function checkPhases(commits, paths, opts = {}) {
+    const issues = [];
+    const redFeatures = new Set();
+    let lastTest;
+    let redAt;
+    let needsRed = false;
+    for (const c of commits) {
+        const short = `${c.sha.slice(0, 7)} ${c.subject}`;
+        const phase = phaseOf(c.subject);
+        if (!phase) {
+            issues.push(`${short}: start the subject with one of ${PHASES.map((p) => `${p}:`).join(' ')}`);
+            continue;
+        }
+        for (const f of c.files)
+            if (!allowed(phase, f, paths))
+                issues.push(`${short}: ${f} is outside the ${phase} phase`);
+        if (phase === 'spec' || phase === 'test')
+            for (const f of c.files)
+                if (matchesAny(f, paths.features))
+                    redFeatures.add(f);
+        if (phase === 'test')
+            lastTest = c;
+        if ((phase === 'feat' || phase === 'fix') && c.files.some((f) => matchesAny(f, paths.source)) && !redAt) {
+            needsRed = true;
+            redAt = lastTest;
+        }
+    }
+    if (needsRed && !opts.backfill && (!redAt || !redFeatures.size))
+        issues.push('a feat: or fix: commit changes code with no test: commit before it. Show the scenarios red first');
+    return { issues, redAt: opts.backfill ? undefined : redAt, redFeatures: [...redFeatures] };
+}
+//# sourceMappingURL=phases.js.map

package/dist/workflow/phases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phases.js","sourceRoot":"","sources":["../../src/workflow/phases.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAU,CAAC;AAE1G,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAsB,CAAC;AAI5F,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAE7D,kCAAkC;AAClC,SAAS,OAAO,CAAC,KAAY,EAAE,IAAY,EAAE,KAAY;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC;AAC5B,CAAC;AAUD,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,OAA0B,EAAE,KAAY,EAAE,OAA+B,EAAE;IACrG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,QAA4B,CAAC;IACjC,IAAI,KAAyB,CAAC;IAC9B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,mCAAmC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC;QACpH,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,MAAM;YAAE,QAAQ,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxG,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IAClH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/workflow/prose.d.ts

@@ -0,0 +1,2 @@
+/** Problems with the writing rules in one file. With `lines`, only blocks that touch those lines. */
+export declare function checkProse(file: string, text: string, lines?: ReadonlySet<number>): string[];

package/dist/workflow/prose.js

@@ -0,0 +1,113 @@
+const MAX_WORDS = 25;
+/** Inline code and link targets are not prose. */
+const stripInline = (text) => text
+    .replace(/`[^`]*`/g, 'Code')
+    .replace(/\]\([^)]*\)/g, ']')
+    .replace(/<!--.*?-->/g, '')
+    .replace(/https?:\/\/\S+/g, 'link');
+function markdownBlocks(text) {
+    const lines = text.split('\n');
+    const blocks = [];
+    let fence;
+    let comment = false;
+    let para;
+    const flush = () => {
+        if (para)
+            blocks.push(para);
+        para = undefined;
+    };
+    let i = 0;
+    if (lines[0] === '---') {
+        const end = lines.indexOf('---', 1);
+        if (end > 0)
+            i = end + 1;
+    }
+    for (; i < lines.length; i++) {
+        const raw = lines[i];
+        const line = i + 1;
+        const fenceMark = raw.match(/^\s*(`{3,}|~{3,})/)?.[1];
+        if (fence) {
+            if (fenceMark?.startsWith(fence))
+                fence = undefined;
+            continue;
+        }
+        if (fenceMark) {
+            flush();
+            fence = fenceMark;
+            continue;
+        }
+        if (comment || raw.trim().startsWith('<!--')) {
+            comment = !raw.includes('-->');
+            continue;
+        }
+        if (!raw.trim() || (/^\s{4,}\S/.test(raw) && !para)) {
+            flush();
+            continue;
+        }
+        if (/^\s*\|/.test(raw)) {
+            flush();
+            if (!/^\s*\|[\s:|-]+\|\s*$/.test(raw))
+                for (const cell of raw.split('|').slice(1, -1))
+                    blocks.push({ line, lastLine: line, text: cell, label: true });
+            continue;
+        }
+        if (/^\s*#{1,6}\s/.test(raw)) {
+            flush();
+            blocks.push({ line, lastLine: line, text: raw.replace(/^\s*#+\s*/, ''), label: true });
+            continue;
+        }
+        const item = raw.match(/^\s*(?:[-*+]|\d+[.)])\s+(.*)$/);
+        if (item) {
+            flush();
+            para = { line, lastLine: line, text: item[1], label: false };
+            continue;
+        }
+        if (para) {
+            para.text += ` ${raw.trim()}`;
+            para.lastLine = line;
+        }
+        else
+            para = { line, lastLine: line, text: raw.trim().replace(/^>\s*/, ''), label: false };
+    }
+    flush();
+    return blocks;
+}
+function featureBlocks(text) {
+    return text.split('\n').flatMap((raw, i) => {
+        const t = raw.trim();
+        if (!t || t.startsWith('#') || t.startsWith('@'))
+            return [];
+        const label = t.startsWith('|') || /^[A-Za-z ]+:/.test(t);
+        return [{ line: i + 1, lastLine: i + 1, text: t.replace(/^[A-Za-z ]+:\s*/, ''), label }];
+    });
+}
+const words = (sentence) => sentence.split(/\s+/).filter((w) => /[\p{L}\p{N}]/u.test(w)).length;
+/** Problems with the writing rules in one file. With `lines`, only blocks that touch those lines. */
+export function checkProse(file, text, lines) {
+    const blocks = file.endsWith('.feature') ? featureBlocks(text) : markdownBlocks(text);
+    const issues = [];
+    for (const block of blocks) {
+        if (lines) {
+            let touched = false;
+            for (let l = block.line; l <= block.lastLine && !touched; l++)
+                touched = lines.has(l);
+            if (!touched)
+                continue;
+        }
+        const prose = stripInline(block.text);
+        const at = `${file}:${block.line}`;
+        if (prose.includes(';'))
+            issues.push(`${at}: no semicolons. Write two sentences`);
+        if (prose.includes('—'))
+            issues.push(`${at}: no em dashes. Write two sentences or use a colon`);
+        if (block.label)
+            continue;
+        for (const sentence of prose.split(/(?<=[.!?:][*_)"'`]*)\s+(?=[\p{Lu}`*"([])/u)) {
+            const n = words(sentence);
+            if (n > MAX_WORDS)
+                issues.push(`${at}: a sentence has ${n} words. Use ${MAX_WORDS} at most`);
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=prose.js.map

package/dist/workflow/prose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prose.js","sourceRoot":"","sources":["../../src/workflow/prose.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,EAAE,CAAC;AAUrB,kDAAkD;AAClD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACnC,IAAI;KACD,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC;KAC3B,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;KAC5B,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;KAC1B,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAExC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAuB,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC;YAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,EAAE,CAAC;YACR,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;;YAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9F,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAExG,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,KAA2B;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;gBAAE,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO;gBAAE,SAAS;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,eAAe,SAAS,UAAU,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow/red.d.ts

@@ -0,0 +1,2 @@
+/** Runs the feature files at `sha` in a temporary worktree. True when at least one package fails. */
+export declare function featuresFailAt(root: string, sha: string, features: readonly string[]): boolean;

package/dist/workflow/red.js

@@ -0,0 +1,36 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { git } from './git.js';
+const run = (cwd, cmd, args) => spawnSync(cmd, args, { cwd, stdio: 'inherit', env: { ...process.env, CI: 'true' } }).status ?? 1;
+/** The nearest directory up from `file` with a package.json, below `root`. */
+function packageOf(root, file) {
+    let dir = path.dirname(path.join(root, file));
+    while (dir !== root && !existsSync(path.join(dir, 'package.json')))
+        dir = path.dirname(dir);
+    return dir;
+}
+/** Runs the feature files at `sha` in a temporary worktree. True when at least one package fails. */
+export function featuresFailAt(root, sha, features) {
+    const dir = mkdtempSync(path.join(tmpdir(), 'synoikia-red-'));
+    try {
+        git(root, 'worktree', 'add', '--detach', dir, sha);
+        if (run(dir, 'pnpm', ['install', '--frozen-lockfile', '--prefer-offline']) !== 0)
+            throw new Error(`pnpm install failed at ${sha.slice(0, 7)}`);
+        const byPackage = new Map();
+        for (const f of features.filter((f) => existsSync(path.join(dir, f)))) {
+            const pkg = packageOf(dir, f);
+            byPackage.set(pkg, [...(byPackage.get(pkg) ?? []), path.relative(pkg, path.join(dir, f))]);
+        }
+        let failed = false;
+        for (const [pkg, files] of byPackage)
+            failed = run(pkg, 'pnpm', ['exec', 'vitest', 'run', ...files]) !== 0 || failed;
+        return failed;
+    }
+    finally {
+        spawnSync('git', ['worktree', 'remove', '--force', dir], { cwd: root });
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=red.js.map

package/dist/workflow/red.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"red.js","sourceRoot":"","sources":["../../src/workflow/red.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAW,EAAE,IAAc,EAAE,EAAE,CACvD,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAEnG,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW,EAAE,QAA2B;IACnF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS;YAClC,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/workflow/secrets.d.ts

@@ -0,0 +1,2 @@
+/** Staged paths that look like credential files, by name rather than content. */
+export declare const credentialPaths: (files: readonly string[]) => string[];

package/dist/workflow/secrets.js

@@ -0,0 +1,5 @@
+const EXAMPLE = /(?:\.|^|\/)(?:example|sample|template)(?:\.[^/]+)?$/;
+const CREDENTIAL = /(?:^|\/)(?:secrets?(?:\.[^/]+)*\.ya?ml|\.env(?:\..+)?|\.dev\.vars(?:\..+)?|[^/]+\.secret(?:\..+)?|[^/]+\.(?:pem|key|p12|pfx)|id_(?:rsa|dsa|ecdsa|ed25519)|\.npmrc|\.netrc)$/;
+/** Staged paths that look like credential files, by name rather than content. */
+export const credentialPaths = (files) => files.filter((f) => !EXAMPLE.test(f) && CREDENTIAL.test(f));
+//# sourceMappingURL=secrets.js.map

package/dist/workflow/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/workflow/secrets.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,qDAAqD,CAAC;AACtE,MAAM,UAAU,GACd,6KAA6K,CAAC;AAEhL,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAwB,EAAE,EAAE,CAC1D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/workflow/security-line.d.ts

@@ -0,0 +1,6 @@
+export declare const SECURITY_LINE: RegExp;
+/** A ready PR that changes a security path states its audit on a line of its own. */
+export declare function checkSecurityLine(pr: {
+    draft: boolean;
+    body: string | null;
+}, changed: readonly string[], paths: readonly string[]): string[];

package/dist/workflow/security-line.js

@@ -0,0 +1,14 @@
+import { matchesAny } from './glob.js';
+export const SECURITY_LINE = /^Security audit: \S/m;
+/** A ready PR that changes a security path states its audit on a line of its own. */
+export function checkSecurityLine(pr, changed, paths) {
+    if (pr.draft)
+        return [];
+    const touched = changed.filter((f) => matchesAny(f, paths));
+    if (!touched.length || SECURITY_LINE.test(pr.body ?? ''))
+        return [];
+    return [
+        `this PR changes security paths (${touched.slice(0, 5).join(', ')}${touched.length > 5 ? ', …' : ''}). Add a line "Security audit: <boundary and findings>" or "Security audit: none. <why>" to its description`,
+    ];
+}
+//# sourceMappingURL=security-line.js.map

package/dist/workflow/security-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-line.js","sourceRoot":"","sources":["../../src/workflow/security-line.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAEpD,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAC/B,EAA2C,EAC3C,OAA0B,EAC1B,KAAwB;IAExB,IAAI,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,OAAO;QACL,mCAAmC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,6GAA6G;KACjN,CAAC;AACJ,CAAC"}

package/dist/workflow/sync.d.ts

@@ -0,0 +1,4 @@
+/** The shared workflow files, as repo-relative path → template path. Claude files only for repos that use Claude. */
+export declare function workflowFiles(root: string): Map<string, string>;
+/** Writes the shared files, or with `check` lists the ones that differ. Returns the paths written or out of date. */
+export declare function syncWorkflow(root: string, check?: boolean): string[];

package/dist/workflow/sync.js

@@ -0,0 +1,47 @@
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { TEMPLATES_DIR } from '../repo-root.js';
+const WORKFLOW_DIR = path.join(TEMPLATES_DIR, 'workflow');
+const outName = (name) => (/^_[a-zA-Z]/.test(name) ? `.${name.slice(1)}` : name);
+/** The shared workflow files, as repo-relative path → template path. Claude files only for repos that use Claude. */
+export function workflowFiles(root) {
+    const files = new Map();
+    const walk = (from, to) => {
+        for (const entry of readdirSync(from).sort()) {
+            const src = path.join(from, entry);
+            const dest = path.posix.join(to, outName(entry));
+            if (statSync(src).isDirectory())
+                walk(src, dest);
+            else
+                files.set(dest, src);
+        }
+    };
+    walk(path.join(WORKFLOW_DIR, 'base'), '');
+    if (existsSync(path.join(root, '.claude')))
+        walk(path.join(WORKFLOW_DIR, 'claude'), '');
+    return files;
+}
+/** Writes the shared files, or with `check` lists the ones that differ. Returns the paths written or out of date. */
+export function syncWorkflow(root, check = false) {
+    const changed = [];
+    for (const [rel, src] of workflowFiles(root)) {
+        const dest = path.join(root, rel);
+        if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink())
+            throw new Error(`${rel} is a symlink. Remove it before the sync`);
+        const text = readFileSync(src, 'utf8');
+        if (existsSync(dest) && readFileSync(dest, 'utf8') === text)
+            continue;
+        changed.push(rel);
+        if (check)
+            continue;
+        mkdirSync(path.dirname(dest), { recursive: true });
+        const real = realpathSync(path.dirname(dest));
+        if (path.relative(realpathSync(root), real).startsWith('..'))
+            throw new Error(`${rel} resolves outside the repository`);
+        writeFileSync(dest, text);
+        if (rel.startsWith('.githooks/'))
+            chmodSync(dest, 0o755);
+    }
+    return changed;
+}
+//# sourceMappingURL=sync.js.map

package/dist/workflow/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/workflow/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEzF,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE;QACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;gBAC5C,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAK,GAAG,KAAK;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE;YAC9D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,0CAA0C,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI;YAAE,SAAS;QACtE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK;YAAE,SAAS;QACpB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC;QAC5D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/workflow/tests.d.ts

@@ -0,0 +1,2 @@
+/** New test files must be pure-function unit tests. Behavior is specified in feature files. */
+export declare const unlistedTests: (added: readonly string[], unitTests: readonly string[]) => string[];

package/dist/workflow/tests.js

@@ -0,0 +1,6 @@
+import { matchesAny } from './glob.js';
+/** New test files must be pure-function unit tests. Behavior is specified in feature files. */
+export const unlistedTests = (added, unitTests) => added
+    .filter((f) => /\.(?:test|spec)\.[cm]?[jt]sx?$/.test(f) && !matchesAny(f, unitTests))
+    .map((f) => `${f}: a new test file must be a pure-function unit test (${unitTests.join(', ')}). Specify behavior in a feature file`);
+//# sourceMappingURL=tests.js.map

package/dist/workflow/tests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../src/workflow/tests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAwB,EAAE,SAA4B,EAAE,EAAE,CACtF,KAAK;KACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KACpF,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,wDAAwD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC1H,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synoikia/create-plugin",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Create Synoikia plugin repositories and plugins, then build, check and publish them",
   "license": "MIT",
   "repository": {
@@ -31,6 +31,8 @@
   ],
   "dependencies": {
     "@clack/prompts": "^1.8.1",
+    "@cucumber/gherkin": "^42.0.1",
+    "@cucumber/messages": "^34.2.1",
     "esbuild": "^0.28.2",
     "yaml": "^2.9.1",
     "@synoikia/plugin-sdk": "^0.5.0"

package/templates/repo/base/package.json

@@ -14,11 +14,22 @@
     "test": "pnpm -r --filter './plugins/*' test",
     "lint": "eslint .",
     "format": "prettier --write .",
-    "format:check": "prettier --check ."
+    "format:check": "prettier --check .",
+    "workflow": "synoikia-plugin workflow",
+    "hooks:install": "synoikia-plugin workflow hooks install"
   },
   "synoikia": {
     "repository": "{{repository}}",
-    "name": "{{repoName}}"
+    "name": "{{repoName}}",
+    "workflow": {
+      "securityPaths": [
+        "plugins/*/manifest.json",
+        "plugins/*/plugin.yaml",
+        "plugins/*/src/**",
+        "**/package.json",
+        ".github/workflows/**"
+      ]
+    }
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/templates/repo/claude/CLAUDE.md

@@ -15,6 +15,10 @@ Plugins for [Synoikia](https://github.com/via-justa/synoikia-core). Authoring gu
 
 Policy data (locks, splits, sensitive params and results, confirm literals, guidance) goes in `plugin.yaml`; only decisions that need logic go in `src/`. `plugin.yaml` is validated and inlined at build time, so rebuild before e2e tests.
 
+## Workflow
+
+Every change is built spec first and test first, one slice at a time. The rules are in `docs/workflow.md`. Start every task that changes the repo with the `change-workflow` skill. Write prose by the `technical-writing` skill.
+
 ## Commands
 
 Node 22.12+, pnpm 10.
@@ -24,6 +28,8 @@ pnpm new                                   # add a plugin (see the add-plugin sk
 pnpm lint && pnpm format:check && pnpm typecheck && pnpm test   # what CI runs
 pnpm --filter ./plugins/<id> test          # one plugin: check, build, unit + e2e
 pnpm check                                 # manifests, plugin.yaml and versions
+pnpm hooks:install                         # once per clone: the workflow's git hooks
+pnpm workflow pre-push                     # the workflow checks CI runs
 ```
 
 ## Rules that break releases or installs
@@ -35,4 +41,4 @@ pnpm check                                 # manifests, plugin.yaml and versions
 
 ## Security review
 
-Before opening a PR that touches a plugin's `manifest.json`, `plugin.yaml`, `src/` or dependencies, or `.github/workflows/`, run the `security-reviewer` subagent on the diff and address its findings.
+Run the `security-reviewer` subagent on the diff before a PR that touches these paths: a plugin's `manifest.json`, `plugin.yaml`, `src/` or dependencies, and `.github/workflows/`. Address its findings. Put its `Security audit:` line in the PR description.