code-foundry 0.32.4 → 0.33.0

package/src/lib/release-policy.mjs

@@ -2,6 +2,7 @@
 
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
+import { isReleasePleaseHead } from './validation-policy.mjs'
 
 const DEFAULT_RELEASE_FILES = new Set([
   '.release-please-manifest.json',
@@ -125,6 +126,56 @@ export function validateReleasePullRequests(prs, changedPathsByPr, allowed) {
   return { valid: errors.length === 0, generated, errors }
 }
 
+/** Files that must change for a generated release PR to count as a version bump. */
+const VERSION_METADATA_FILES = new Set([
+  '.release-please-manifest.json',
+  'package.json',
+  'Cargo.toml',
+  'pyproject.toml',
+  'version.txt',
+])
+
+/**
+ * Strict diff and version policy for the release validation tier. The head
+ * must carry the exact approved Release Please prefix, come from the same
+ * repository, change at least one path, change no unexpected paths, and bump
+ * at least one version-metadata file (or a declared extra file).
+ * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown> }} input
+ * @returns {{ valid: boolean, errors: string[], changedPaths: string[] }}
+ */
+export function validateGeneratedReleaseDiff(input) {
+  const { headRef = '', headRepo = '', repository = '', changedPaths = [], config = {} } = input
+  /** @type {string[]} */
+  const errors = []
+  if (!isReleasePleaseHead(headRef)) {
+    errors.push(`Head branch ${headRef || '(missing)'} is not a generated Release Please branch.`)
+  }
+  if (!repository || !headRepo) {
+    errors.push('Generated release validation requires both the head and base repository identities.')
+  } else if (headRepo !== repository) {
+    errors.push(`Head repository ${headRepo} is not ${repository}; generated release validation requires a same-repository pull request.`)
+  }
+  const paths = [...new Set(changedPaths.map((path) => String(path).trim()).filter(Boolean))]
+  if (!paths.length) errors.push('Generated release pull request has no changed files.')
+  const unexpected = unexpectedReleasePaths(paths, approvedReleaseFiles(config))
+  if (unexpected.length) errors.push(`Generated release pull request contains unexpected paths: ${unexpected.join(', ')}`)
+  const versionMetadata = new Set(VERSION_METADATA_FILES)
+  addExtraFiles(versionMetadata, config['extra-files'])
+  const packages = config.packages
+  if (packages && typeof packages === 'object' && !Array.isArray(packages)) {
+    for (const [directory, value] of Object.entries(packages)) {
+      const prefix = directory === '.' ? '' : directory.replace(/\/$/, '')
+      if (value && typeof value === 'object' && !Array.isArray(value)) {
+        addExtraFiles(versionMetadata, value['extra-files'], prefix)
+      }
+    }
+  }
+  if (!paths.some((path) => versionMetadata.has(path))) {
+    errors.push('Generated release pull request changes no version metadata.')
+  }
+  return { valid: errors.length === 0, errors, changedPaths: paths }
+}
+
 /**
  * Build a non-destructive release recovery plan from independent release
  * metadata sources.
@@ -166,41 +217,59 @@ function compareVersions(a, b) {
 }
 
 /**
- * Classify the relationship between main and staging. A fast-forward is safe
- * only when main is the ancestor of staging or staging is the ancestor of main
- * and the intervening main files are release metadata.
- * @param {{ mainSha: string, stagingSha: string, mergeBaseSha?: string, mainChangedPaths?: string[], stagingChangedPaths?: string[], allowed?: Set<string> }} input
+ * Classify the relationship between main and staging using commit-level divergence.
+ * Any non-release main-only commit fails. Any staging-only commit triggers a replay
+ * path so no staging-only work can be silently discarded.
+ * @param {{
+ *   mainSha: string,
+ *   stagingSha: string,
+ *   mainOnlyCommits?: Array<{ sha?: string, changedPaths?: string[] }>,
+ *   stagingOnlyCommits?: Array<{ sha?: string, changedPaths?: string[] }>,
+ *   allowed?: Set<string>,
+ * }} input
  */
 export function classifyReconciliation(input) {
   const {
     mainSha,
     stagingSha,
-    mergeBaseSha = '',
-    mainChangedPaths = [],
-    stagingChangedPaths = [],
+    mainOnlyCommits = [],
+    stagingOnlyCommits = [],
     allowed = approvedReleaseFiles(),
   } = input
   if (!mainSha || !stagingSha) return { action: 'fail', reason: 'Missing branch SHA.' }
   if (mainSha === stagingSha) return { action: 'aligned', reason: 'Branches already point at the same commit.' }
-  if (mainSha === mergeBaseSha) {
-    return { action: 'none', reason: 'staging contains commits that are not on main; no release-only reconciliation is needed.' }
+  const hasIndeterminateMainCommit = mainOnlyCommits.some((commit) => typeof commit.sha !== 'string' || !Array.isArray(commit.changedPaths))
+  if (hasIndeterminateMainCommit) return {
+    action: 'fail',
+    reason: 'Unable to inspect main-only commit metadata.',
   }
-  if (!mainChangedPaths.length && !stagingChangedPaths.length) {
-    return { action: 'aligned', targetSha: mainSha, reason: 'Branches have different history but identical content.' }
+  const hasIndeterminateStagingCommit = stagingOnlyCommits.some((commit) => typeof commit.sha !== 'string' || !Array.isArray(commit.changedPaths))
+  if (hasIndeterminateStagingCommit) return {
+    action: 'fail',
+    reason: 'Unable to inspect staging-only commit metadata.',
   }
-  const unexpectedMain = unexpectedReleasePaths(mainChangedPaths, allowed)
-  const unexpectedStaging = unexpectedReleasePaths(stagingChangedPaths, allowed)
-  if (unexpectedMain.length || unexpectedStaging.length) {
+  const unexpectedMain = unexpectedReleasePaths(
+    [...new Set(mainOnlyCommits.flatMap((commit) => commit.changedPaths || []))],
+    allowed,
+  )
+  if (unexpectedMain.length) {
     return {
       action: 'fail',
-      reason: 'Branch divergence includes repository code or configuration.',
-      unexpected: [...new Set([...unexpectedMain, ...unexpectedStaging])],
+      reason: 'main contains commits that are not release metadata.',
+      unexpected: unexpectedMain,
     }
   }
-  if (stagingSha === mergeBaseSha) {
-    return { action: 'fast-forward', targetSha: mainSha, reason: 'main only added approved release metadata.' }
+  if (stagingOnlyCommits.length) {
+    return {
+      action: 'rebase-staging',
+      targetSha: mainSha,
+      mainOnly: mainOnlyCommits.map((commit) => commit.sha).filter(Boolean),
+      stagingOnly: stagingOnlyCommits.map((commit) => commit.sha).filter(Boolean),
+      reason: 'staging contains unpromoted commits; replay them onto main.',
+    }
   }
-  return { action: 'pull-request', targetSha: mainSha, reason: 'Branches diverged, but only approved release metadata changed.' }
+  if (mainOnlyCommits.length) return { action: 'fast-forward', targetSha: mainSha, reason: 'main only added approved release metadata.' }
+  return { action: 'aligned', targetSha: mainSha, reason: 'Branches have different history but identical content.' }
 }
 
 export { DEFAULT_RELEASE_FILES }

package/src/lib/validation-policy.mjs

@@ -0,0 +1,127 @@
+// @ts-check
+
+/**
+ * Tiered validation policy shared by the generated validation caller, the
+ * reusable validation orchestrator, and their deterministic tests.
+ *
+ * The caller classifies every triggering event into exactly one of three
+ * fail-closed modes; the orchestrator's aggregate gate evaluates normalized
+ * job results against a mode-aware truth table. The shell steps embedded in
+ * the generated workflows are thin mirrors of these functions; keep the
+ * workflow YAML and this module in lockstep.
+ */
+
+/** The three validation tiers. */
+export const VALIDATION_MODES = ['fast', 'audit', 'release']
+
+/** Exact branch prefix used by Release Please for generated version pull requests. */
+export const RELEASE_PLEASE_PREFIX = 'release-please--branches--main'
+
+/** Stable aggregate check name emitted by the validation orchestrator's gate job. */
+export const AGGREGATE_CHECK_NAME = 'Validation / Gate'
+/** Job ids owned by the validation orchestrator. */
+export const VALIDATION_JOBS = ['ci', 'test', 'security', 'codeql', 'release-policy']
+
+/** Events that may trigger canonical validation. */
+export const VALIDATION_EVENTS = ['pull_request', 'schedule', 'workflow_dispatch']
+
+/**
+ * True when the head branch is a generated Release Please version branch:
+ * either the exact prefix or the prefix followed by the `--` separator.
+ * Any other string (including prefix lookalikes without the exact boundary)
+ * is not approved.
+ * @param {unknown} headRef
+ * @returns {boolean}
+ */
+export function isReleasePleaseHead(headRef) {
+  if (typeof headRef !== 'string' || headRef.length === 0) return false
+  return headRef === RELEASE_PLEASE_PREFIX || headRef.startsWith(`${RELEASE_PLEASE_PREFIX}--`)
+}
+
+/**
+ * Classify an event into exactly one validation mode, failing closed:
+ * - fast: pull_request targeting staging
+ * - release: pull_request targeting main whose head is the exact approved
+ *   Release Please prefix
+ * - audit: every other pull_request targeting main, plus schedule and
+ *   workflow_dispatch
+ * Unsupported events (for example push) and unsupported base branches are
+ * rejected so canonical validation can never silently run or silently skip.
+ * @param {{ eventName: string, baseRef?: string, headRef?: string }} input
+ * @returns {'fast'|'audit'|'release'}
+ */
+export function classifyValidationMode(input) {
+  const { eventName, baseRef, headRef } = input
+  if (typeof eventName !== 'string' || !VALIDATION_EVENTS.includes(eventName)) {
+    throw new Error(
+      `Unsupported validation event: ${eventName ?? '(missing)'}; canonical validation must not run on this event.`
+    )
+  }
+  if (eventName === 'schedule' || eventName === 'workflow_dispatch') return 'audit'
+  if (typeof baseRef !== 'string' || baseRef.length === 0) {
+    throw new Error('pull_request classification requires base_ref.')
+  }
+  if (typeof headRef !== 'string' || headRef.length === 0) {
+    throw new Error('pull_request classification requires head_ref.')
+  }
+  if (baseRef === 'staging') return 'fast'
+  if (baseRef === 'main') return isReleasePleaseHead(headRef) ? 'release' : 'audit'
+  throw new Error(`Unsupported pull_request base branch: ${baseRef}; expected staging or main.`)
+}
+
+/** @type {Record<'fast'|'audit'|'release', string[]>} */
+const REQUIRED_JOBS_BY_MODE = {
+  fast: ['ci', 'test'],
+  audit: ['ci', 'test', 'security', 'codeql'],
+  release: ['release-policy'],
+}
+
+/**
+ * Job ids that the aggregate gate requires for a mode. Expected skips never
+ * appear here: anything outside the returned list is not part of the gate.
+ * @param {string} mode
+ * @returns {string[]}
+ */
+export function requiredValidationJobs(mode) {
+  const jobs = REQUIRED_JOBS_BY_MODE[/** @type {'fast'|'audit'|'release'} */ (mode)]
+  if (!jobs) {
+    throw new Error(
+      `Unknown validation mode: ${mode ?? '(missing)'}; expected one of ${VALIDATION_MODES.join(', ')}.`
+    )
+  }
+  return [...jobs]
+}
+
+/**
+ * Evaluate the aggregate gate for one mode against normalized job results.
+ * Only jobs required for the mode are consulted, so expected skips of
+ * non-required jobs never fail the gate. Every required job must report
+ * exactly `success`; failure, cancellation, an unexpected skip, a missing
+ * result, or an unknown result fails the gate (fail closed).
+ * @param {{ mode: string, results?: Record<string, string | null | undefined> }} input
+ * @returns {{ valid: boolean, required: string[], failures: Array<{ job: string, result: string }> }}
+ */
+export function evaluateValidationGate(input) {
+  const { mode, results = {} } = input
+  let required
+  try {
+    required = requiredValidationJobs(mode)
+  } catch (error) {
+    return {
+      valid: false,
+      required: [],
+      failures: [{ job: 'mode', result: error instanceof Error ? error.message : String(error) }],
+    }
+  }
+  /** @type {Array<{ job: string, result: string }>} */
+  const failures = []
+  for (const job of required) {
+    const result = results[job]
+    if (result === 'success') continue
+    failures.push({
+      job,
+      result: result === undefined || result === null ? 'missing' : String(result),
+    })
+  }
+  return { valid: failures.length === 0, required, failures }
+}

package/src/runtime.mjs

@@ -6,6 +6,8 @@ import { resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
 import { configured, readConfig } from './lib/config.mjs'
+import { classifyValidationMode, evaluateValidationGate } from './lib/validation-policy.mjs'
+import { readReleaseConfig, validateGeneratedReleaseDiff } from './lib/release-policy.mjs'
 
 const root = process.cwd()
 const config = readConfig(resolve(root, '.github/code-foundry.yml'))
@@ -43,6 +45,57 @@ function readPackage() {
   try { return JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) } catch { return null }
 }
 
+/** @param {string} task */
+function validation(task) {
+  if (task === 'mode') {
+    writeOutput('mode', classifyValidationMode({
+      eventName: process.env.FOUNDRY_EVENT_NAME ?? '',
+      baseRef: process.env.FOUNDRY_BASE_REF ?? '',
+      headRef: process.env.FOUNDRY_HEAD_REF ?? '',
+    }))
+    return
+  }
+  if (task === 'gate') {
+    const mode = process.env.FOUNDRY_MODE ?? ''
+    const gate = evaluateValidationGate({
+      mode,
+      results: {
+        ci: process.env.FOUNDRY_CI,
+        test: process.env.FOUNDRY_TEST,
+        security: process.env.FOUNDRY_SECURITY,
+        codeql: process.env.FOUNDRY_CODEQL,
+        'release-policy': process.env.FOUNDRY_RELEASE_POLICY,
+      },
+    })
+    if (gate.valid) {
+      console.log(`Validation gate passed for ${mode} mode.`)
+      return
+    }
+    for (const failure of gate.failures) console.error(`::error::${failure.job}: ${failure.result}`)
+    process.exitCode = 1
+    return
+  }
+  if (task === 'release_diff') {
+    const baseSha = process.env.FOUNDRY_BASE_SHA ?? ''
+    const changedPaths = baseSha ? capture('git', ['diff', '--name-only', `${baseSha}...HEAD`]).split(/\r?\n/) : []
+    const result = validateGeneratedReleaseDiff({
+      headRef: process.env.FOUNDRY_HEAD_REF ?? '',
+      headRepo: process.env.FOUNDRY_HEAD_REPO ?? '',
+      repository: process.env.FOUNDRY_REPOSITORY ?? '',
+      changedPaths,
+      config: readReleaseConfig(root),
+    })
+    if (!result.valid) {
+      for (const error of result.errors) console.error(`::error::${error}`)
+      process.exitCode = 1
+      return
+    }
+    console.log(`Release policy passed: ${result.changedPaths.length} approved changed path(s).`)
+    return
+  }
+  throw new Error(`Unknown validation task: ${task || '(missing)'}`)
+}
+
 /** @param {string} key @param {unknown} value */
 function writeOutput(key, value) {
   const line = `${key}=${typeof value === 'string' ? value : JSON.stringify(value)}\n`
@@ -347,6 +400,7 @@ try {
   else if (area === 'security') security(task, ecosystem)
   else if (area === 'codeql') codeql()
   else if (area === 'profile') printProfile(task)
+  else if (area === 'validation') validation(task)
   else if (area === 'pre-commit') preCommit()
   else throw new Error(`Unknown runtime command: ${area || '(missing)'}`)
 } catch (error) {

package/.github/workflows/ci_self-ci.yml

@@ -1,21 +0,0 @@
-name: Code Foundry
-
-on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [main, staging]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  ci:
-    name: CI
-    uses: ./.github/workflows/ci.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit

package/.github/workflows/codeql_self-ci.yml

@@ -1,29 +0,0 @@
-name: Code Foundry
-
-on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [main, staging]
-  schedule:
-    - cron: '31 6 * * 1'
-  workflow_dispatch:
-
-permissions:
-  actions: read
-  contents: read
-  packages: read
-  security-events: write
-
-jobs:
-  codeql:
-    name: CodeQL
-    uses: ./.github/workflows/codeql.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-      rust-shards: '["all"]'
-      rust-threads: '1'
-      rust-max-parallel: 1
-    secrets: inherit

package/.github/workflows/security_self-ci.yml

@@ -1,21 +0,0 @@
-name: Code Foundry
-
-on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [main, staging]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  security:
-    name: Security
-    uses: ./.github/workflows/security.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-slim
-    secrets: inherit

package/.github/workflows/test_self-ci.yml

@@ -1,22 +0,0 @@
-name: Code Foundry
-
-on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [main, staging]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test
-    uses: ./.github/workflows/test.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-      unit-runner: ubuntu-slim
-    secrets: inherit