@the-open-engine/zeroshot 6.7.1 → 6.7.2

package/scripts/release-preflight.js

@@ -7,7 +7,7 @@ const { execFileSync } = require('child_process');
 const RELEASE_ORDER = ['patch', 'minor', 'major'];
 const REQUIRED_PLUGINS = [
   '@semantic-release/commit-analyzer',
-  '@semantic-release/release-notes-generator',
+  './scripts/semantic-release-notes.js',
   '@semantic-release/npm',
   '@semantic-release/github',
 ];
@@ -50,7 +50,6 @@ function analyzeMessage(message) {
   if (breaking) return 'major';
 
   switch (type) {
-    case 'release':
     case 'feat':
       return 'minor';
     case 'fix':
@@ -61,6 +60,14 @@ function analyzeMessage(message) {
   }
 }
 
+function releaseTypeForMessages(messages) {
+  let releaseType = null;
+  for (const message of messages) {
+    releaseType = maxReleaseType(releaseType, analyzeMessage(message));
+  }
+  return releaseType;
+}
+
 function getPluginNames(releaseConfig) {
   return (releaseConfig.plugins || []).map(normalizePlugin);
 }
@@ -68,9 +75,7 @@ function getPluginNames(releaseConfig) {
 function validateReleaseConfig(packageJson) {
   const releaseConfig = packageJson.release;
   if (!releaseConfig || typeof releaseConfig !== 'object') {
-    throw new Error(
-      'package.json#release is required so it takes precedence over stale .releaserc files'
-    );
+    throw new Error('package.json#release is required as the single release configuration');
   }
 
   const branches = Array.isArray(releaseConfig.branches)
@@ -103,6 +108,16 @@ function validateReleaseConfig(packageJson) {
     throw new Error('@semantic-release/npm must publish to npm');
   }
 
+  const analyzerPlugin = releaseConfig.plugins.find(
+    (plugin) => normalizePlugin(plugin) === '@semantic-release/commit-analyzer'
+  );
+  const analyzerOptions = Array.isArray(analyzerPlugin) ? analyzerPlugin[1] || {} : {};
+  if (Array.isArray(analyzerOptions.releaseRules) && analyzerOptions.releaseRules.length > 0) {
+    throw new Error(
+      '@semantic-release/commit-analyzer must use the standard conventional release rules'
+    );
+  }
+
   return pluginNames;
 }
 
@@ -186,10 +201,7 @@ async function prTitleFromMergeQueue() {
 async function releaseSignal() {
   const tag = latestReleaseTag();
   const messages = commitMessagesSince(tag);
-  let releaseType = null;
-  for (const message of messages) {
-    releaseType = maxReleaseType(releaseType, analyzeMessage(message));
-  }
+  let releaseType = releaseTypeForMessages(messages);
 
   let title = prTitleFromEvent();
   if (!title) title = await prTitleFromMergeQueue();
@@ -214,9 +226,8 @@ async function main() {
   if (signal.prTitle) console.log(`Release PR title: ${signal.prTitle}`);
 
   if (!signal.releaseType) {
-    throw new Error(
-      'Release promotion would publish nothing; use a release-worthy PR title/commit'
-    );
+    console.log('Release preflight passed: no publication expected');
+    return;
   }
 
   console.log(`Release preflight passed: ${signal.releaseType}`);
@@ -232,5 +243,6 @@ if (require.main === module) {
 module.exports = {
   analyzeMessage,
   maxReleaseType,
+  releaseTypeForMessages,
   validateReleaseConfig,
 };

package/scripts/release-recovery.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+function run(command, args, options = {}) {
+  return execFileSync(command, args, {
+    encoding: 'utf8',
+    stdio: options.stdio || ['ignore', 'pipe', 'pipe'],
+    ...options,
+  }).trim();
+}
+
+function parseReleaseTag(tag) {
+  const match = String(tag || '').match(/^v(\d+\.\d+\.\d+)$/);
+  if (!match) throw new Error('release_tag must match vX.Y.Z');
+  return match[1];
+}
+
+function validateCommit(commit) {
+  if (!/^[0-9a-f]{40}$/.test(String(commit || ''))) {
+    throw new Error('release_commit must be a full lowercase commit SHA');
+  }
+  return commit;
+}
+
+function verifyImmutableSource(tag, commit) {
+  run('git', ['show-ref', '--verify', `refs/tags/${tag}`]);
+  const head = run('git', ['rev-parse', 'HEAD']);
+  const tagCommit = run('git', ['rev-list', '-n', '1', `refs/tags/${tag}`]);
+  if (head !== commit || tagCommit !== commit) {
+    throw new Error('checkout, protected tag, and release_commit must reference the same commit');
+  }
+  run('git', ['merge-base', '--is-ancestor', commit, 'origin/main']);
+}
+
+function npmPackageMetadata(name, version) {
+  const result = spawnSync(
+    'npm',
+    ['view', `${name}@${version}`, 'version', 'gitHead', 'dist.attestations', '--json'],
+    { encoding: 'utf8' }
+  );
+  if (result.status === 0) return JSON.parse(result.stdout);
+  if (/\bE404\b|is not in this registry|No match found/i.test(result.stderr || '')) return null;
+  throw new Error(`npm registry lookup failed: ${(result.stderr || result.stdout).trim()}`);
+}
+
+function verifyExistingNpmVersion(metadata, version, commit) {
+  if (metadata.version !== version) {
+    throw new Error(`npm returned ${metadata.version}; expected ${version}`);
+  }
+  if (metadata.gitHead !== commit) {
+    throw new Error(`npm gitHead ${metadata.gitHead || '(missing)'} does not match ${commit}`);
+  }
+  if (!metadata['dist.attestations']?.provenance) {
+    throw new Error('npm package exists without a provenance attestation');
+  }
+}
+
+function recoverNpm(name, version, commit) {
+  const existing = npmPackageMetadata(name, version);
+  if (existing) {
+    verifyExistingNpmVersion(existing, version, commit);
+    console.log(`${name}@${version} already exists with matching provenance; nothing to recover`);
+    return;
+  }
+
+  run('npm', ['version', version, '--no-git-tag-version', '--allow-same-version']);
+  run('npm', ['publish', '--access', 'public', '--provenance'], { stdio: 'inherit' });
+
+  const published = npmPackageMetadata(name, version);
+  if (!published) throw new Error(`${name}@${version} was not visible after publication`);
+  verifyExistingNpmVersion(published, version, commit);
+  console.log(`Recovered ${name}@${version}`);
+}
+
+function releaseExists(tag) {
+  const result = spawnSync('gh', ['release', 'view', tag], { encoding: 'utf8' });
+  if (result.status === 0) return true;
+  if (/release not found|HTTP 404/i.test(`${result.stdout}\n${result.stderr}`)) return false;
+  throw new Error(`GitHub Release lookup failed: ${(result.stderr || result.stdout).trim()}`);
+}
+
+function recoverGithubRelease(tag, commit, version) {
+  if (releaseExists(tag)) {
+    console.log(`GitHub Release ${tag} already exists; nothing to recover`);
+    return;
+  }
+
+  const notesPath = path.join(process.cwd(), 'docs', 'releases', `${tag}.md`);
+  const args = ['release', 'create', tag, '--verify-tag', '--target', commit, '--title', tag];
+  if (fs.existsSync(notesPath)) {
+    args.push('--notes-file', notesPath);
+  } else {
+    args.push('--generate-notes');
+    const tags = run('git', [
+      'tag',
+      '--list',
+      'v[0-9]*',
+      '--merged',
+      `${commit}^`,
+      '--sort=-version:refname',
+    ])
+      .split(/\r?\n/)
+      .filter(Boolean);
+    if (tags[0]) args.push('--notes-start-tag', tags[0]);
+  }
+
+  run('gh', args, { stdio: 'inherit' });
+  if (!releaseExists(tag)) throw new Error(`GitHub Release ${tag} was not created`);
+  console.log(`Recovered GitHub Release ${tag} for ${version}`);
+}
+
+function main() {
+  const action = process.env.RECOVERY_ACTION;
+  if (!['recover-npm', 'recover-github-release'].includes(action)) {
+    throw new Error('RECOVERY_ACTION must be recover-npm or recover-github-release');
+  }
+
+  const tag = process.env.RELEASE_TAG;
+  const commit = validateCommit(process.env.RELEASE_COMMIT);
+  const version = parseReleaseTag(tag);
+  verifyImmutableSource(tag, commit);
+
+  const packageJson = require('../package.json');
+  if (action === 'recover-npm') {
+    recoverNpm(packageJson.name, version, commit);
+  } else {
+    recoverGithubRelease(tag, commit, version);
+  }
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`Release recovery failed: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  npmPackageMetadata,
+  parseReleaseTag,
+  releaseExists,
+  validateCommit,
+  verifyExistingNpmVersion,
+};

package/scripts/semantic-release-notes.js

@@ -0,0 +1,44 @@
+const fs = require('fs');
+const path = require('path');
+
+function curatedNotesPath(cwd, version) {
+  return path.join(cwd, 'docs', 'releases', `v${version}.md`);
+}
+
+function readCuratedNotes(cwd, version) {
+  const notesPath = curatedNotesPath(cwd, version);
+  if (!fs.existsSync(notesPath)) return null;
+
+  const notes = fs.readFileSync(notesPath, 'utf8').trim();
+  if (!notes) {
+    throw new Error(`Curated release notes are empty: ${notesPath}`);
+  }
+  return `${notes}\n`;
+}
+
+async function conventionalNotes(pluginConfig, context) {
+  const generator = await import('@semantic-release/release-notes-generator');
+  return generator.generateNotes(pluginConfig.conventional || {}, context);
+}
+
+async function generateNotesWithFallback(pluginConfig, context, fallback = conventionalNotes) {
+  const version = context.nextRelease?.version;
+  if (!version) throw new Error('nextRelease.version is required to generate release notes');
+
+  const curated = readCuratedNotes(context.cwd || process.cwd(), version);
+  if (curated) return curated;
+  const generated = await fallback(pluginConfig, context);
+  return generated;
+}
+
+async function generateNotes(pluginConfig, context) {
+  const notes = await generateNotesWithFallback(pluginConfig, context);
+  return notes;
+}
+
+module.exports = {
+  curatedNotesPath,
+  generateNotes,
+  generateNotesWithFallback,
+  readCuratedNotes,
+};

package/scripts/setup-merge-queue.sh

@@ -1,75 +1,79 @@
 #!/bin/bash
-# Setup GitHub merge queue and branch protection for zeroshot
-# Run once after creating the repo or to update settings
 
-set -e
+set -euo pipefail
 
 REPO="the-open-engine/zeroshot"
+MAIN_RULESET_NAME="Protect main trunk"
+TAG_RULESET_NAME="Make release tags immutable"
 
-echo "╔═══════════════════════════════════════════════════════════════════╗"
-echo "║  Setting up merge queue for $REPO                         ║"
-echo "╚═══════════════════════════════════════════════════════════════════╝"
-echo ""
-
-# Check gh is authenticated
 if ! gh auth status &>/dev/null; then
-  echo "❌ ERROR: Not authenticated with GitHub CLI"
-  echo "   Run: gh auth login"
+  echo "ERROR: Authenticate GitHub CLI with: gh auth login"
   exit 1
 fi
 
-# Check we have admin access
-if ! gh api "repos/$REPO" --jq '.permissions.admin' | grep -q true; then
-  echo "❌ ERROR: You need admin access to $REPO"
+if [[ "$(gh api "repos/$REPO" --jq '.permissions.admin')" != "true" ]]; then
+  echo "ERROR: Repository admin access is required"
   exit 1
 fi
 
-echo "✓ Authenticated with admin access"
-echo ""
-
-# ============================================================================
-# Configure 'dev' branch protection (merge target)
-# ============================================================================
-
-echo "→ Configuring 'dev' branch protection..."
-
-gh api --method PUT "repos/$REPO/branches/dev/protection" \
-  --input - <<EOF
-{
-  "required_status_checks": {
-    "strict": true,
-    "contexts": ["check", "install-matrix (ubuntu-latest, 20)", "install-matrix (macos-latest, 20)"]
-  },
-  "enforce_admins": false,
-  "required_pull_request_reviews": null,
-  "restrictions": null,
-  "allow_force_pushes": false,
-  "allow_deletions": false,
-  "required_linear_history": true,
-  "required_conversation_resolution": false
+upsert_ruleset() {
+  local name="$1"
+  local payload="$2"
+  local id
+  id="$(gh api "repos/$REPO/rulesets" --jq ".[] | select(.name == \"$name\") | .id" | head -1)"
+  if [[ -n "$id" ]]; then
+    gh api --method PUT "repos/$REPO/rulesets/$id" --input "$payload" >/dev/null
+  else
+    gh api --method POST "repos/$REPO/rulesets" --input "$payload" >/dev/null
+  fi
 }
-EOF
-
-echo "✓ 'dev' branch protection configured"
 
-# Enable merge queue for dev branch
-echo "→ Enabling merge queue for 'dev' branch..."
+main_payload="$(mktemp)"
+tag_payload="$(mktemp)"
+trap 'rm -f "$main_payload" "$tag_payload"' EXIT
 
-# Note: Merge queue requires GitHub Enterprise or public repos with Actions
-# Using the ruleset API which supports merge queue
-gh api --method POST "repos/$REPO/rulesets" \
-  --input - <<EOF 2>/dev/null || echo "   (ruleset may already exist)"
+cat > "$main_payload" <<'JSON'
 {
-  "name": "dev-merge-queue",
+  "name": "Protect main trunk",
   "target": "branch",
   "enforcement": "active",
   "conditions": {
     "ref_name": {
-      "include": ["refs/heads/dev"],
+      "include": ["refs/heads/main"],
       "exclude": []
     }
   },
   "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "required_linear_history"},
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "dismissal_restriction": {
+          "enabled": false,
+          "allowed_actors": []
+        },
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "allowed_merge_methods": ["squash"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {"context": "required", "integration_id": 15368},
+          {"context": "semantic", "integration_id": 15368}
+        ]
+      }
+    },
     {
       "type": "merge_queue",
       "parameters": {
@@ -82,49 +86,34 @@ gh api --method POST "repos/$REPO/rulesets" \
         "min_entries_to_merge_wait_minutes": 1
       }
     }
-  ]
+  ],
+  "bypass_actors": []
 }
-EOF
-
-echo "✓ Merge queue enabled for 'dev'"
+JSON
 
-# ============================================================================
-# Configure 'main' branch protection (release branch)
-# ============================================================================
-
-echo "→ Configuring 'main' branch protection..."
-
-gh api --method PUT "repos/$REPO/branches/main/protection" \
-  --input - <<EOF
+cat > "$tag_payload" <<'JSON'
 {
-  "required_status_checks": {
-    "strict": true,
-    "contexts": ["check", "install-matrix (ubuntu-latest, 20)", "install-matrix (macos-latest, 20)"]
-  },
-  "enforce_admins": false,
-  "required_pull_request_reviews": {
-    "required_approving_review_count": 1,
-    "dismiss_stale_reviews": true,
-    "require_code_owner_reviews": false
+  "name": "Make release tags immutable",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/v*"],
+      "exclude": []
+    }
   },
-  "restrictions": null,
-  "allow_force_pushes": false,
-  "allow_deletions": false,
-  "required_linear_history": true,
-  "required_conversation_resolution": false
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"}
+  ],
+  "bypass_actors": []
 }
-EOF
+JSON
 
-echo "✓ 'main' branch protection configured"
+upsert_ruleset "$MAIN_RULESET_NAME" "$main_payload"
+upsert_ruleset "$TAG_RULESET_NAME" "$tag_payload"
 
-# ============================================================================
-# Configure repository settings
-# ============================================================================
-
-echo "→ Configuring repository settings..."
-
-gh api --method PATCH "repos/$REPO" \
-  --input - <<EOF
+gh api --method PATCH "repos/$REPO" --input - <<'JSON' >/dev/null
 {
   "allow_squash_merge": true,
   "allow_merge_commit": false,
@@ -134,37 +123,34 @@ gh api --method PATCH "repos/$REPO" \
   "delete_branch_on_merge": true,
   "allow_auto_merge": true
 }
-EOF
-
-echo "✓ Repository settings configured"
-
-# ============================================================================
-# Summary
-# ============================================================================
-
-echo ""
-echo "╔═══════════════════════════════════════════════════════════════════╗"
-echo "║  ✓ Merge queue setup complete!                                    ║"
-echo "╚═══════════════════════════════════════════════════════════════════╝"
-echo ""
-echo "Workflow:"
-echo "  feature-branch (local)"
-echo "  ↓"
-echo "  pre-push hook → lint + typecheck (~5s)"
-echo "  ↓"
-echo "  push to origin/feature-branch"
-echo "  ↓"
-echo "  gh pr create --base dev"
-echo "  ↓"
-echo "  CI runs tests on PR branch"
-echo "  ↓"
-echo "  gh pr merge --auto --squash → enters merge queue"
-echo "  ↓"
-echo "  Queue rebases PR on latest dev + runs CI again"
-echo "  ↓"
-echo "  Merge to dev (only if CI passes on rebased code)"
-echo ""
-echo "Release workflow:"
-echo "  gh pr create --base main --head dev --title \"Release\""
-echo "  → CI passes → merge → semantic-release publishes"
-echo ""
+JSON
+
+gh api --method PUT "repos/$REPO/environments/release" --input - <<'JSON' >/dev/null
+{
+  "deployment_branch_policy": {
+    "protected_branches": false,
+    "custom_branch_policies": true
+  }
+}
+JSON
+
+if ! gh api "repos/$REPO/environments/release/deployment-branch-policies" \
+  --jq '.branch_policies[] | select(.name == "main") | .id' | grep -q .; then
+  gh api --method POST "repos/$REPO/environments/release/deployment-branch-policies" \
+    -f name=main -f type=branch >/dev/null
+fi
+
+gh variable set RELEASE_AUTOMATION_ENABLED --repo "$REPO" --body false
+
+if gh api "repos/$REPO/branches/main/protection" >/dev/null 2>&1; then
+  gh api --method DELETE "repos/$REPO/branches/main/protection"
+fi
+
+while IFS= read -r ruleset_id; do
+  [[ -n "$ruleset_id" ]] && gh api --method DELETE "repos/$REPO/rulesets/$ruleset_id"
+done < <(
+  gh api "repos/$REPO/rulesets" \
+    --jq '.[] | select(.name == "dev-merge-queue" or .name == "main-merge-queue") | .id'
+)
+
+echo "Configured protected main trunk, merge queue, immutable release tags, and disabled release automation."