coderifts 8.5.0 → 8.6.1

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 8.6.1 - 2026-09-09
+
+The generated strict workflow pins contract-gate v0.9.2 (12a2673), following the gate release.
+
+
+## 8.6.0 - 2026-09-08
+
+- `--check` recognizes the SHA-pinned strict workflow (`coderifts/contract-gate@<40-hex>`, not only `@v0`), with states MISSING / PRESENT_UNPINNED / PRESENT_STALE / PRESENT_CURRENT; strict `--check` passes only PRESENT_CURRENT, and a generate-then-check round-trip exits 0.
+- The generated strict workflow pins contract-gate v0.9.1 (df9d6a5), not the stale v0.9.0.
+
+
 ## 8.5.0 - 2026-09-07
 
 The generated check-summary reads the rulesets API when there is no classic branch protection (a ruleset-governed repo no longer reports protection_not_configured). The quickstart's Atomic example carries the issuer-grant keyring. The strict workflow template pins contract-gate at d1c348d (v0.9.0), the current gate commit.

package/dist/.build-source-sha

@@ -1,5 +1,5 @@
 {
   "$comment": "GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.",
-  "sha256": "e9cca5e219ca1bc43448406afaae8ac9b4bd5f61dcbb880967393ea37575b354",
+  "sha256": "d6989104c6fcc12b512fc6dee0dd50970cd88364d9e2bec09c6c50fb019c5f14",
   "file_count": 49
 }

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "8.5.0",
+      version: "8.6.1",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -231520,10 +231520,10 @@ var require_gate_pin = __commonJS({
   "src/generated/gate-pin.json"(exports2, module2) {
     module2.exports = {
       repo: "coderifts/contract-gate",
-      sha: "d1c348dc2047cf53de5834961563b206d7d7bbd7",
-      tag: "v0.9.0",
+      sha: "12a2673d9bf094a1a97cb1387348018332a5c33f",
+      tag: "v0.9.2",
       resolved_from: "https://github.com/coderifts/contract-gate refs/tags/v0",
-      resolved_at: "2026-09-07T07:06:00Z",
+      resolved_at: "2026-09-09T18:05:11Z",
       note: "STRICT template pins this full commit SHA (GitHub: only a full SHA is immutable). v0 is a tag we move on every release, so it is NOT a pin. Re-run scripts/generate-gate-pin.js on each gate release; Dependabot bumps adopters."
     };
   }
@@ -231554,6 +231554,7 @@ var require_contract_gate_workflow = __commonJS({
     "use strict";
     var fs = require("fs");
     var path = require("path");
+    var yaml = require_js_yaml();
     var WORKFLOW_REL = ".github/workflows/coderifts.yml";
     var GATE_ACTION = "coderifts/contract-gate@v0";
     var GATE_PIN = require_gate_pin();
@@ -231743,16 +231744,71 @@ jobs:
       writeFile(dest, body);
       return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0 };
     }
-    function workflowPresent(outDir, deps = {}) {
+    var WORKFLOW_STATES = Object.freeze({
+      MISSING: "MISSING",
+      PRESENT_CURRENT: "PRESENT_CURRENT",
+      PRESENT_STALE: "PRESENT_STALE",
+      PRESENT_UNPINNED: "PRESENT_UNPINNED"
+    });
+    var SHA_RE = /^[0-9a-f]{40}$/i;
+    var GATE_USES_RE = /^\s*-?\s*uses:\s*coderifts\/contract-gate@([0-9a-f]{40}|v[^\s#]+)/m;
+    function parseGateUsesRef(uses) {
+      const raw = String(uses || "").trim();
+      const at = raw.lastIndexOf("@");
+      if (at <= 0) return null;
+      if (raw.slice(0, at) !== "coderifts/contract-gate") return null;
+      return raw.slice(at + 1);
+    }
+    function extractContractGateRef(body) {
+      try {
+        const doc = yaml.load(String(body || ""));
+        const jobs = doc && doc.jobs && typeof doc.jobs === "object" ? doc.jobs : {};
+        for (const job of Object.values(jobs)) {
+          if (!job || typeof job !== "object" || !Array.isArray(job.steps)) continue;
+          for (const step of job.steps) {
+            if (!step || typeof step !== "object" || step.uses == null) continue;
+            const ref = parseGateUsesRef(step.uses);
+            if (ref) return ref;
+          }
+        }
+      } catch {
+      }
+      const m = String(body || "").match(GATE_USES_RE);
+      return m ? m[1] : null;
+    }
+    function workflowState(outDir, deps = {}) {
       const exists = deps.exists || fs.existsSync.bind(fs);
       const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const expected = GATE_PIN.sha;
+      const empty = { state: WORKFLOW_STATES.MISSING, ref: null, sha: null, expected };
       const fp = path.join(outDir, WORKFLOW_REL);
-      if (!exists(fp)) return false;
+      if (!exists(fp)) return empty;
+      let body;
       try {
-        return readFile(fp).includes(GATE_ACTION);
+        body = readFile(fp);
       } catch {
-        return false;
+        return empty;
       }
+      const ref = extractContractGateRef(body);
+      if (!ref) return empty;
+      if (SHA_RE.test(ref)) {
+        const sha = ref.toLowerCase();
+        return {
+          state: sha === expected ? WORKFLOW_STATES.PRESENT_CURRENT : WORKFLOW_STATES.PRESENT_STALE,
+          ref,
+          sha,
+          expected
+        };
+      }
+      return { state: WORKFLOW_STATES.PRESENT_UNPINNED, ref, sha: null, expected };
+    }
+    function workflowPresent(outDir, deps = {}) {
+      return workflowState(outDir, deps).state !== WORKFLOW_STATES.MISSING;
+    }
+    function workflowCheckOk(state, strict) {
+      if (state === WORKFLOW_STATES.MISSING) return false;
+      if (strict) return state === WORKFLOW_STATES.PRESENT_CURRENT;
+      return true;
     }
     module2.exports = {
       WORKFLOW_REL,
@@ -231766,7 +231822,11 @@ jobs:
       pinnedActionRef,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
-      workflowPresent
+      workflowPresent,
+      workflowState,
+      workflowCheckOk,
+      extractContractGateRef,
+      WORKFLOW_STATES
     };
   }
 });
@@ -235063,9 +235123,13 @@ var require_init_agents = __commonJS({
     var {
       WORKFLOW_REL,
       GATE_ACTION,
+      GATE_ACTION_STRICT,
+      GATE_PIN,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
-      workflowPresent
+      workflowState,
+      workflowCheckOk,
+      WORKFLOW_STATES
     } = require_contract_gate_workflow();
     var { writeAtomicV2, CONFIG_REL, WIRING_REL } = require_atomic_v2();
     if (process.env.NO_COLOR) chalk.level = 0;
@@ -235075,7 +235139,7 @@ var require_init_agents = __commonJS({
     1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json / .vscode/mcp.json)
     2. generated agent rule files (reuses agent-setup)
     3. host hook (Claude Code / VS Code Copilot via .claude/settings.json; Cursor via .cursor/hooks.json)
-    4. .github/workflows/coderifts.yml (coderifts/contract-gate@v0)
+    4. .github/workflows/coderifts.yml (default @v0; --strict pins coderifts/contract-gate@<40-hex>)
 
   --hosts <list>   claude, cursor, copilot, or all (default: all)
   --no-hook        Skip host hook install
@@ -235195,6 +235259,9 @@ ${USAGE}`
       if (options.workflow === false) return false;
       return true;
     }
+    function wantStrictWorkflow(options) {
+      return !!(options.strict || options.atomicV2);
+    }
     function padVerb(verb) {
       return String(verb).padEnd(7, " ");
     }
@@ -235239,7 +235306,8 @@ ${USAGE}`
         }
       }
       const workflowWanted = wantWorkflow(options);
-      const wfPresent = workflowWanted && workflowPresent(outDir, fsDeps);
+      const wf = workflowWanted ? workflowState(outDir, fsDeps) : { state: WORKFLOW_STATES.MISSING, ref: null, sha: null, expected: GATE_PIN.sha };
+      const wfOk = !workflowWanted || workflowCheckOk(wf.state, wantStrictWorkflow(options));
       const atomicWanted = options.atomicV2 === true;
       const atomicMissing = [];
       const atomicPresent = [];
@@ -235259,8 +235327,12 @@ ${USAGE}`
         },
         workflow: {
           wanted: workflowWanted,
-          present: wfPresent,
-          missing: workflowWanted && !wfPresent ? [WORKFLOW_REL] : []
+          present: wfOk,
+          state: workflowWanted ? wf.state : null,
+          ref: wf.ref || null,
+          sha: wf.sha || null,
+          expected: wf.expected,
+          missing: workflowWanted && !wfOk ? [WORKFLOW_REL] : []
         },
         atomicV2: {
           wanted: atomicWanted,
@@ -235268,7 +235340,7 @@ ${USAGE}`
           missing: atomicMissing
         }
       };
-      const missingCount = mcpMissing.length + rulesMissing.length + hooksMissing.length + (workflowWanted && !wfPresent ? 1 : 0) + atomicMissing.length;
+      const missingCount = mcpMissing.length + rulesMissing.length + hooksMissing.length + (workflowWanted && !wfOk ? 1 : 0) + atomicMissing.length;
       return {
         exitCode: missingCount === 0 ? 0 : 1,
         pieces,
@@ -235299,7 +235371,16 @@ ${USAGE}`
       if (!pieces.workflow.wanted) {
         log("  CI workflow:   skipped  (--no-workflow)");
       } else {
-        log(pieces.workflow.present ? `  CI workflow:   present  (${WORKFLOW_REL})` : `  CI workflow:   missing  (${WORKFLOW_REL})`);
+        const st = pieces.workflow.state || WORKFLOW_STATES.MISSING;
+        let detail = WORKFLOW_REL;
+        if (st === WORKFLOW_STATES.PRESENT_CURRENT && pieces.workflow.sha) {
+          detail = `${WORKFLOW_REL} @ ${pieces.workflow.sha}${GATE_PIN.tag ? ` # ${GATE_PIN.tag}` : ""}`;
+        } else if (st === WORKFLOW_STATES.PRESENT_STALE && pieces.workflow.sha) {
+          detail = `pinned ${pieces.workflow.sha.slice(0, 12)}\u2026; current ${String(pieces.workflow.expected || "").slice(0, 12)}\u2026`;
+        } else if (st === WORKFLOW_STATES.PRESENT_UNPINNED && pieces.workflow.ref) {
+          detail = `coderifts/contract-gate@${pieces.workflow.ref}`;
+        }
+        log(`  CI workflow:   ${st}  (${detail})`);
       }
       if (pieces.atomicV2 && pieces.atomicV2.wanted) {
         const st = pieces.atomicV2.missing.length === 0 ? "present" : "missing";
@@ -235426,12 +235507,13 @@ ${USAGE}`
       if (!wantWorkflow(options)) {
         items.push({ section: "workflow", action: "skip", relPath: WORKFLOW_REL, note: "--no-workflow" });
       } else {
-        const r = writeContractGateWorkflow({ outDir, dryRun, strict: !!options.strict, ...fsDeps });
+        const strictWf = wantStrictWorkflow(options);
+        const r = writeContractGateWorkflow({ outDir, dryRun, strict: strictWf, ...fsDeps });
         items.push({
           section: "workflow",
           action: r.action,
           relPath: r.relPath,
-          note: r.action === "create" ? options.strict ? `${GATE_ACTION} (STRICT require-verified-monitoring + require-grant; cr.exec.v2)` : GATE_ACTION : r.reason
+          note: r.action === "create" ? strictWf ? `${GATE_ACTION_STRICT} (STRICT require-verified-monitoring + require-grant; cr.exec.v2)` : GATE_ACTION : r.reason
         });
       }
       if (options.atomicV2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "8.5.0",
+  "version": "8.6.1",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",