@workerstack/repo 0.0.0-stage → 0.1.0

package/cli/sync/release-workflow.test.ts

@@ -0,0 +1,192 @@
+import { describe, expect, it } from "vitest";
+import { HEADER, context } from "../fixtures/release-context.ts";
+import { GENERATORS } from "./outputs.ts";
+import { releaseWorkflow } from "./release-workflow.ts";
+
+const PATH = ".github/workflows/release.yml";
+const CHECKOUT = "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1";
+const SETUP_BUN = "oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0";
+const SETUP_NODE = "actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0";
+const PUBLIC = { name: "@acme/app", private: false };
+
+const EXPECTED = `${HEADER}
+name: release
+
+on:
+  push:
+    tags:
+      - "@acme/app@*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to release, e.g. @acme/app@1.0.0"
+        required: true
+
+concurrency:
+  group: release-\${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    name: gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+    env:
+      TAG: \${{ inputs.tag || github.ref_name }}
+      GH_TOKEN: \${{ github.token }}
+    steps:
+      - uses: ${CHECKOUT}
+        with:
+          ref: \${{ inputs.tag || github.ref }}
+          fetch-depth: 0
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - run: bun repo release gate "$TAG"
+
+  publish:
+    name: publish
+    needs: gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      TAG: \${{ inputs.tag || github.ref_name }}
+    steps:
+      - uses: ${CHECKOUT}
+        with:
+          ref: \${{ inputs.tag || github.ref }}
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - uses: ${SETUP_NODE}
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - run: npm install --global npm@12.2.2
+      - run: bun repo release publish "$TAG"
+
+  github:
+    name: github
+    needs: publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    env:
+      TAG: \${{ inputs.tag || github.ref_name }}
+      GH_TOKEN: \${{ github.token }}
+    steps:
+      - uses: ${CHECKOUT}
+        with:
+          ref: \${{ inputs.tag || github.ref }}
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - run: bun repo release github "$TAG"
+`;
+
+const generated = (): string => {
+  const output = releaseWorkflow(context(["release"], PUBLIC)).outputs[0];
+  return output?.kind === "file" ? output.content : "";
+};
+
+/** The text of the job `name`, from its heading to the next job's. */
+const job = (name: string): string => {
+  const rest = generated().split(`\n  ${name}:\n`)[1] ?? "";
+  return rest.split(/\n  [a-z]+:\n/)[0] ?? "";
+};
+
+describe("release workflow", () => {
+  it("is a generator", () => {
+    expect(GENERATORS).toContain(releaseWorkflow);
+  });
+
+  it("writes the whole release.yml for a public root package", () => {
+    expect(releaseWorkflow(context(["release"], PUBLIC))).toEqual({
+      outputs: [{ kind: "file", path: PATH, content: EXPECTED, tracked: true, managed: "whole" }],
+      errors: [],
+    });
+  });
+
+  it.each([
+    ["a private root", { name: "@acme/app", private: true }],
+    ["a root that does not say it is public", { name: "@acme/app" }],
+    ["a root with no name", { private: false }],
+  ])("writes nothing for %s", (_, manifest) => {
+    expect(releaseWorkflow(context(["release"], manifest))).toEqual({ outputs: [], errors: [] });
+  });
+
+  it("writes nothing with the pack off", () => {
+    expect(releaseWorkflow(context(["agents", "standards", "docs"], PUBLIC))).toEqual({ outputs: [], errors: [] });
+  });
+});
+
+describe("release workflow owns its file", () => {
+  it("rewrites a release.yml that has the generated header on its first line", () => {
+    const result = releaseWorkflow(context(["release"], PUBLIC, { [PATH]: `${HEADER}\nname: old\n` }));
+    expect(result.errors).toEqual([]);
+    expect(result.outputs).toHaveLength(1);
+  });
+
+  it("refuses a hand-written release.yml", () => {
+    expect(releaseWorkflow(context(["release"], PUBLIC, { [PATH]: "name: Release\n" }))).toEqual({
+      outputs: [],
+      errors: [".github/workflows/release.yml is hand-written; delete it so repo sync can own it"],
+    });
+  });
+});
+
+describe("release workflow safety", () => {
+  it.each(["gate", "publish", "github"])("checks out the tag in the %s job", (name) => {
+    expect(job(name)).toContain("ref: ${{ inputs.tag || github.ref }}");
+  });
+
+  it("gives gh the token in the gate and github jobs", () => {
+    expect(job("gate")).toContain("GH_TOKEN: ${{ github.token }}");
+    expect(job("github")).toContain("GH_TOKEN: ${{ github.token }}");
+  });
+
+  it("holds no npm token anywhere", () => {
+    expect(generated()).not.toMatch(/NPM_TOKEN|NODE_AUTH_TOKEN|secrets\./);
+  });
+});
+
+describe("release workflow publishing", () => {
+  it("grants id-token: write to the publish job only", () => {
+    expect(generated().match(/id-token: write/g)).toHaveLength(1);
+    expect(job("publish")).toContain("id-token: write");
+  });
+
+  it("pins every action to a 40-character sha", () => {
+    const uses = generated().match(/uses: .*/g) ?? [];
+    expect(uses).toHaveLength(7);
+    for (const line of uses) expect(line).toMatch(/^uses: [\w./-]+@[0-9a-f]{40} # v\d/);
+  });
+});
+
+describe("release workflow triggers", () => {
+  it("runs only on the tag and by hand", () => {
+    const on = generated().split("\njobs:")[0]?.split("\non:\n")[1]?.split("\n\nconcurrency")[0] ?? "";
+    expect(on.match(/^ {2}\w+:/gm)).toEqual(["  push:", "  workflow_dispatch:"]);
+  });
+
+  it("runs the release commands through bun repo, never a root repo.ts", () => {
+    expect(generated().match(/bun repo release \w+/g)).toEqual([
+      "bun repo release gate",
+      "bun repo release publish",
+      "bun repo release github",
+    ]);
+  });
+});

package/cli/sync/release-workflow.ts

@@ -0,0 +1,86 @@
+import { lines } from "../scripts/managed-text.ts";
+import type { Generator } from "./outputs.ts";
+import {
+  BUN_STEPS,
+  CHECKOUT_TAG_FULL_STEP,
+  CHECKOUT_TAG_STEP,
+  GATE_ENV,
+  GATE_PERMISSIONS,
+  GATE_TIMEOUT_MINUTES,
+  GITHUB_PERMISSIONS,
+  GITHUB_TIMEOUT_MINUTES,
+  NODE_STEPS,
+  PREAMBLE,
+  PUBLISH_ENV,
+  PUBLISH_PERMISSIONS,
+  PUBLISH_TIMEOUT_MINUTES,
+  RELEASE_HEADER,
+  RELEASE_PATH,
+} from "./release-workflow.constants.ts";
+
+type Job = {
+  id: string;
+  needs?: string;
+  minutes: number;
+  permissions: string;
+  env: string;
+  steps: readonly string[];
+  command: string;
+};
+
+const render = (job: Job): string =>
+  [
+    `  ${job.id}:`,
+    `    name: ${job.id}`,
+    ...(job.needs === undefined ? [] : [`    needs: ${job.needs}`]),
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${job.minutes}`,
+    job.permissions,
+    job.env,
+    "    steps:",
+    ...job.steps,
+    `      - run: bun repo release ${job.command} "$TAG"`,
+  ].join("\n");
+
+const JOBS: readonly Job[] = [
+  {
+    id: "gate",
+    minutes: GATE_TIMEOUT_MINUTES,
+    permissions: GATE_PERMISSIONS,
+    env: GATE_ENV,
+    steps: [CHECKOUT_TAG_FULL_STEP, ...BUN_STEPS],
+    command: "gate",
+  },
+  {
+    id: "publish",
+    needs: "gate",
+    minutes: PUBLISH_TIMEOUT_MINUTES,
+    permissions: PUBLISH_PERMISSIONS,
+    env: PUBLISH_ENV,
+    steps: [CHECKOUT_TAG_STEP, ...BUN_STEPS, ...NODE_STEPS],
+    command: "publish",
+  },
+  {
+    id: "github",
+    needs: "publish",
+    minutes: GITHUB_TIMEOUT_MINUTES,
+    permissions: GITHUB_PERMISSIONS,
+    env: GATE_ENV,
+    steps: [CHECKOUT_TAG_STEP, ...BUN_STEPS],
+    command: "github",
+  },
+];
+
+/** Under the release pack with a public root package, the tracked, whole-file `release.yml`; a hand-written one is refused. */
+export const releaseWorkflow: Generator = (ctx) => {
+  const { name, private: isPrivate } = ctx.workspace.manifest;
+  if (!ctx.config.packs.includes("release") || name === undefined || isPrivate !== false) {
+    return { outputs: [], errors: [] };
+  }
+  const existing = ctx.read(RELEASE_PATH);
+  if (existing !== null && lines(existing)[0] !== RELEASE_HEADER) {
+    return { outputs: [], errors: [`${RELEASE_PATH} is hand-written; delete it so repo sync can own it`] };
+  }
+  const content = `${RELEASE_HEADER}\n${PREAMBLE.replaceAll("%NAME%", name)}\n${JOBS.map(render).join("\n\n")}\n`;
+  return { outputs: [{ kind: "file", path: RELEASE_PATH, content, tracked: true, managed: "whole" }], errors: [] };
+};

package/cli/sync/release.constants.ts

@@ -0,0 +1,93 @@
+/** The generated header, which must be the first line of a ci.yml sync owns. */
+export const CI_HEADER: string = "# Generated by repo sync. Do not edit.";
+export const CI_PATH: string = ".github/workflows/ci.yml";
+export const E2E_SCRIPT: string = "test:e2e";
+
+/** Action pins, each a full commit SHA with its release as the comment. */
+const CHECKOUT: string = "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1";
+export const UPLOAD: string = "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2";
+export const DOWNLOAD: string = "actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2";
+const SETUP_BUN: string = "oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0";
+
+const OS_LIST: string = "[ubuntu-latest, windows-latest, macos-latest]";
+export const TEST_TIMEOUT_MINUTES: number = 30;
+export const SLOW_TIMEOUT_MINUTES: number = 40;
+
+const ROOT_REFUSAL: string = "CI must run as a non-root user; the suite assumes unprivileged file permissions";
+
+/** The workflow text before the jobs: name, triggers, concurrency and permissions. */
+export const PREAMBLE: string = `name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-\${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:`;
+
+/** The shared checkout, bun and install steps; `fetchDepth` adds full history. */
+export const SETUP_BUN_STEP: string = `      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json`;
+export const CHECKOUT_STEP: string = `      - uses: ${CHECKOUT}`;
+export const CHECKOUT_FULL_STEP: string = `      - uses: ${CHECKOUT}
+        with:
+          fetch-depth: 0`;
+export const INSTALL_STEP: string = "      - run: bun install --frozen-lockfile";
+
+export const NON_ROOT_STEP: string = `      - name: Refuse to run as root
+        if: runner.os != 'Windows'
+        run: |
+          if [ "$(id -u)" = "0" ]; then echo "${ROOT_REFUSAL}"; exit 1; fi`;
+
+export const MATRIX: string = `    runs-on: \${{ matrix.os }}
+    timeout-minutes: %MINUTES%
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_LIST}`;
+
+export const NO_NODE_STEPS: string = `      - name: Remove node
+        run: |
+          sudo rm -f $(which -a node nodejs)
+          sudo rm -rf /opt/hostedtoolcache/node
+          hash -r
+      - name: Assert node is gone
+        run: |
+          if command -v node; then echo "node is still on PATH"; exit 1; fi`;
+
+/** The test job's last steps: the gates write this OS's skip report and it is uploaded, even when a gate failed. */
+export const REPORT_STEPS: string = `      - name: Run the gates and write the skip report
+        shell: bash
+        env:
+          REPORT: ci-report-\${{ runner.os }}.json
+          COVERAGE: \${{ runner.os != 'Linux' && '--no-coverage' || '' }}
+        run: bun repo ci --report "$REPORT" $COVERAGE
+      - uses: ${UPLOAD}
+        if: always()
+        with:
+          name: ci-report-\${{ matrix.os }}
+          path: ci-report-\${{ runner.os }}.json
+          if-no-files-found: error`;
+
+/** The step that checks every commit of the push or pull request; an empty BASE leaves HEAD alone to be checked. */
+export const COMMITS_STEP: string = `      - name: Check every pushed commit
+        env:
+          BASE: \${{ github.event.pull_request.base.sha || github.event.before }}
+        run: bun repo commit-msg --range "$BASE..HEAD"`;
+
+/** The skips job's steps after the install: the per-OS reports are downloaded into one directory and compared. */
+export const SKIPS_STEPS: string = `      - uses: ${DOWNLOAD}
+        with:
+          pattern: ci-report-*
+          merge-multiple: true
+          path: reports
+      - run: bun repo ci skips reports`;

package/cli/sync/release.test.ts

@@ -0,0 +1,187 @@
+import { describe, expect, it } from "vitest";
+import { HEADER, context } from "../fixtures/release-context.ts";
+import { type SyncContext } from "./outputs.ts";
+import { release } from "./release.ts";
+import type { PackageJson } from "./workspace.ts";
+
+const CI_PATH = ".github/workflows/ci.yml";
+
+const CHECKOUT = "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1";
+const SETUP_BUN = "oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0";
+const UPLOAD = "actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2";
+const DOWNLOAD = "actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2";
+
+const HEAD = `${HEADER}
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-\${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (\${{ matrix.os }})
+    runs-on: \${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: ${CHECKOUT}
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - name: Refuse to run as root
+        if: runner.os != 'Windows'
+        run: |
+          if [ "$(id -u)" = "0" ]; then echo "CI must run as a non-root user; the suite assumes unprivileged file permissions"; exit 1; fi
+      - run: bun install --frozen-lockfile
+      - name: Run the gates and write the skip report
+        shell: bash
+        env:
+          REPORT: ci-report-\${{ runner.os }}.json
+          COVERAGE: \${{ runner.os != 'Linux' && '--no-coverage' || '' }}
+        run: bun repo ci --report "$REPORT" $COVERAGE
+      - uses: ${UPLOAD}
+        if: always()
+        with:
+          name: ci-report-\${{ matrix.os }}
+          path: ci-report-\${{ runner.os }}.json
+          if-no-files-found: error
+
+  commits:
+    name: commits
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: ${CHECKOUT}
+        with:
+          fetch-depth: 0
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - name: Check every pushed commit
+        env:
+          BASE: \${{ github.event.pull_request.base.sha || github.event.before }}
+        run: bun repo commit-msg --range "$BASE..HEAD"
+
+  skips:
+    name: skips
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: ${CHECKOUT}
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - uses: ${DOWNLOAD}
+        with:
+          pattern: ci-report-*
+          merge-multiple: true
+          path: reports
+      - run: bun repo ci skips reports
+
+  no-node:
+    name: no-node
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: ${CHECKOUT}
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - name: Remove node
+        run: |
+          sudo rm -f $(which -a node nodejs)
+          sudo rm -rf /opt/hostedtoolcache/node
+          hash -r
+      - name: Assert node is gone
+        run: |
+          if command -v node; then echo "node is still on PATH"; exit 1; fi
+      - run: bun install --frozen-lockfile
+      - run: bun repo ci
+`;
+
+const NO_NODE_SHALLOW = `    steps:
+      - uses: ${CHECKOUT}
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - name: Remove node`;
+const NO_NODE_FULL = NO_NODE_SHALLOW.replace(
+  `- uses: ${CHECKOUT}`,
+  `- uses: ${CHECKOUT}\n        with:\n          fetch-depth: 0`,
+);
+
+const E2E_IN_NO_NODE = `      - run: bun run test:e2e
+`;
+
+const E2E_JOB = `
+  e2e:
+    name: e2e (\${{ matrix.os }})
+    runs-on: \${{ matrix.os }}
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: ${CHECKOUT}
+        with:
+          fetch-depth: 0
+      - uses: ${SETUP_BUN}
+        with:
+          bun-version-file: package.json
+      - run: bun install --frozen-lockfile
+      - run: bun run test:e2e
+`;
+
+const lookup = (ctx: SyncContext) => release(ctx).outputs[0];
+
+describe("release", () => {
+  it("writes the whole tracked ci.yml without an e2e job when the root has no test:e2e script", () => {
+    expect(release(context(["release"]))).toEqual({
+      outputs: [{ kind: "file", path: CI_PATH, content: HEAD, tracked: true, managed: "whole" }],
+      errors: [],
+    });
+  });
+
+  it("adds the e2e step and job when the root has a test:e2e script", () => {
+    const manifest: PackageJson = { scripts: { "test:e2e": "vitest" } };
+    expect(lookup(context(["release"], manifest))).toEqual({
+      kind: "file",
+      path: CI_PATH,
+      content: HEAD.replace(NO_NODE_SHALLOW, NO_NODE_FULL) + E2E_IN_NO_NODE + E2E_JOB,
+      tracked: true,
+      managed: "whole",
+    });
+  });
+
+  it("ignores a scripts field that is not an object with a test:e2e string", () => {
+    expect(lookup(context(["release"], { scripts: "nope" }))).toMatchObject({ content: HEAD });
+    expect(lookup(context(["release"], { scripts: { "test:e2e": 1 } }))).toMatchObject({ content: HEAD });
+    expect(lookup(context(["release"], { scripts: null }))).toMatchObject({ content: HEAD });
+  });
+
+  it("never uses setup-node", () => {
+    const manifest: PackageJson = { scripts: { "test:e2e": "vitest" } };
+    const output = lookup(context(["release"], manifest));
+    expect(output?.kind === "file" && output.content.includes("setup-node")).toBe(false);
+  });
+});

package/cli/sync/release.ts

@@ -0,0 +1,112 @@
+import { lines } from "../scripts/managed-text.ts";
+import type { Generator, SyncContext } from "./outputs.ts";
+import {
+  CHECKOUT_FULL_STEP,
+  CHECKOUT_STEP,
+  CI_HEADER,
+  CI_PATH,
+  COMMITS_STEP,
+  E2E_SCRIPT,
+  INSTALL_STEP,
+  MATRIX,
+  NON_ROOT_STEP,
+  NO_NODE_STEPS,
+  PREAMBLE,
+  REPORT_STEPS,
+  SETUP_BUN_STEP,
+  SKIPS_STEPS,
+  SLOW_TIMEOUT_MINUTES,
+  TEST_TIMEOUT_MINUTES,
+} from "./release.constants.ts";
+
+const matrix = (minutes: number) => MATRIX.replace("%MINUTES%", String(minutes));
+
+/** Whether the root manifest's `scripts` has a string `name`. */
+export function hasScript(ctx: SyncContext, name: string): boolean {
+  const scripts: unknown = ctx.workspace.manifest.scripts;
+  if (typeof scripts !== "object" || scripts === null) return false;
+  return typeof Reflect.get(scripts, name) === "string";
+}
+
+const testJob = () =>
+  [
+    "  test:",
+    "    name: test (${{ matrix.os }})",
+    matrix(TEST_TIMEOUT_MINUTES),
+    "    steps:",
+    CHECKOUT_STEP,
+    SETUP_BUN_STEP,
+    NON_ROOT_STEP,
+    INSTALL_STEP,
+    REPORT_STEPS,
+  ].join("\n");
+
+const commitsJob = () =>
+  [
+    "  commits:",
+    "    name: commits",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${TEST_TIMEOUT_MINUTES}`,
+    "    steps:",
+    CHECKOUT_FULL_STEP,
+    SETUP_BUN_STEP,
+    INSTALL_STEP,
+    COMMITS_STEP,
+  ].join("\n");
+
+const skipsJob = () =>
+  [
+    "  skips:",
+    "    name: skips",
+    "    needs: test",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${TEST_TIMEOUT_MINUTES}`,
+    "    steps:",
+    CHECKOUT_STEP,
+    SETUP_BUN_STEP,
+    INSTALL_STEP,
+    SKIPS_STEPS,
+  ].join("\n");
+
+const noNodeJob = (e2e: boolean) =>
+  [
+    "  no-node:",
+    "    name: no-node",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${SLOW_TIMEOUT_MINUTES}`,
+    "    steps:",
+    e2e ? CHECKOUT_FULL_STEP : CHECKOUT_STEP,
+    SETUP_BUN_STEP,
+    NO_NODE_STEPS,
+    INSTALL_STEP,
+    "      - run: bun repo ci",
+    ...(e2e ? [`      - run: bun run ${E2E_SCRIPT}`] : []),
+  ].join("\n");
+
+const e2eJob = () =>
+  [
+    "  e2e:",
+    "    name: e2e (${{ matrix.os }})",
+    matrix(SLOW_TIMEOUT_MINUTES),
+    "    defaults:",
+    "      run:",
+    "        shell: bash",
+    "    steps:",
+    CHECKOUT_FULL_STEP,
+    SETUP_BUN_STEP,
+    INSTALL_STEP,
+    `      - run: bun run ${E2E_SCRIPT}`,
+  ].join("\n");
+
+/** Under the release pack, the tracked, whole-file `.github/workflows/ci.yml`; a hand-written one is refused. */
+export const release: Generator = (ctx) => {
+  if (!ctx.config.packs.includes("release")) return { outputs: [], errors: [] };
+  const existing = ctx.read(CI_PATH);
+  if (existing !== null && lines(existing)[0] !== CI_HEADER) {
+    return { outputs: [], errors: [`${CI_PATH} is hand-written; delete it so repo sync can own it`] };
+  }
+  const e2e = hasScript(ctx, E2E_SCRIPT);
+  const jobs = [testJob(), commitsJob(), skipsJob(), noNodeJob(e2e), ...(e2e ? [e2eJob()] : [])];
+  const content = `${CI_HEADER}\n${PREAMBLE}\n${jobs.join("\n\n")}\n`;
+  return { outputs: [{ kind: "file", path: CI_PATH, content, tracked: true, managed: "whole" }], errors: [] };
+};