declapract-typescript-ehmpathy 0.49.13 → 0.49.14

package/dist/workflowJobScopeIdToken.declapract.integration.test.ts

@@ -0,0 +1,236 @@
+import { readFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+import yaml from 'yaml';
+
+import {
+  getAllPathsUnderDir,
+  PRACTICE_TREE_SKIP_DIRS,
+} from './utils/getAllPathsUnderDir';
+
+/**
+ * .what = holds every workflow TEMPLATE under `src/practices` to job-scope oidc (#550 part 2):
+ *           1. a workflow with a job that runs steps carries no workflow-level `id-token`
+ *           2. each job that mints an oidc token declares `id-token: write` at job scope
+ *           3. no job grants `id-token: write` that does not mint one
+ *           4. a job-level `permissions:` block also grants `contents: read`
+ * .why  = a workflow-level `permissions:` block reaches EVERY job in the file. a lint, unit, or
+ *         install job that never touches aws can then mint an oidc token and assume the cloud role,
+ *         and a poisoned action in any of those jobs reaches for it (owasp cicd-sec-3 + cicd-sec-4).
+ *         at job scope the grant reaches only the job that calls `configure-aws-credentials`.
+ * .note = a workflow whose jobs are ALL reusable calls (`uses: ./.github/workflows/<x>`) may keep
+ *         the workflow-level grant: no step of its own can mint the token, and a callee job cannot
+ *         exceed its caller's grant — so the caller must hold it as the upper bound.
+ * .note = a job-level `permissions:` block REPLACES the workflow-level one for that job, it does
+ *         not merge. so the job that gains `id-token: write` must restate `contents: read`, or its
+ *         checkout loses read access in a private repo — assertion 4 holds that.
+ * .note = INTEGRATION by the same rule as `actionPins`: it walks the filesystem, and
+ *         `rule.forbid.unit.remote-boundaries` puts any test that reads the disk in the
+ *         integration suite.
+ */
+
+const REPO_ROOT = join(__dirname, '..');
+const PRACTICES_DIR = join(__dirname, 'practices');
+
+interface WorkflowJob {
+  name: string;
+  runsSteps: boolean;
+  mintsOidc: boolean;
+  permissions: Record<string, string> | null;
+}
+
+interface Workflow {
+  path: string;
+  permissions: Record<string, string> | null;
+  jobs: WorkflowJob[];
+}
+
+/**
+ * .what = whether a step mints an oidc token
+ * .why  = three shapes reach for the token: the aws credentials action, a direct request to the
+ *         runner's token endpoint, and `npm publish --provenance` (npm trusted publish)
+ */
+const isStepOidcMinter = (step: Record<string, unknown>): boolean => {
+  const uses = typeof step['uses'] === 'string' ? step['uses'] : '';
+  const run = typeof step['run'] === 'string' ? step['run'] : '';
+  return (
+    uses.startsWith('aws-actions/configure-aws-credentials@') ||
+    run.includes('ACTIONS_ID_TOKEN_REQUEST') ||
+    run.includes('--provenance')
+  );
+};
+
+/**
+ * .what = a permissions node as a key→value record, or null when absent
+ * .why  = github accepts a map or a shorthand string (`read-all`); a string reads as no map, and
+ *         so does an array, which is no valid permissions shape
+ * .note = a documented cast: a yaml map parses to a plain object of scalars here
+ */
+const asPermissionsRecord = (node: unknown): Record<string, string> | null =>
+  node && typeof node === 'object' && !Array.isArray(node)
+    ? (node as Record<string, string>)
+    : null;
+
+/**
+ * .what = the jobs and grants of one workflow, read from its text
+ * .why  = pure, so the defective-corpus case below exercises the same parse the walk uses
+ */
+const asWorkflowFromText = (input: { path: string; text: string }): Workflow => {
+  const parsed = yaml.parse(input.text) ?? {};
+  const jobs = (parsed.jobs ?? {}) as Record<string, Record<string, unknown>>;
+  return {
+    path: input.path,
+    permissions: asPermissionsRecord(parsed.permissions),
+    jobs: Object.entries(jobs).map(([name, job]) => {
+      const steps = Array.isArray(job['steps'])
+        ? (job['steps'] as Record<string, unknown>[])
+        : [];
+      return {
+        name,
+        runsSteps: steps.length > 0,
+        mintsOidc: steps.some(isStepOidcMinter),
+        permissions: asPermissionsRecord(job['permissions']),
+      };
+    }),
+  };
+};
+
+/**
+ * .what = every workflow template under the practice tree
+ */
+const getAllWorkflowTemplates = (): Workflow[] =>
+  getAllPathsUnderDir({ dir: PRACTICES_DIR, skip: PRACTICE_TREE_SKIP_DIRS })
+    .filter((path) => path.includes('/.github/workflows/') && /\.ya?ml$/.test(path))
+    .sort()
+    .map((path) =>
+      asWorkflowFromText({
+        path: relative(REPO_ROOT, path),
+        text: readFileSync(path, 'utf-8'),
+      }),
+    );
+
+/**
+ * .what = the four reports, each a list of offenders named `<path> :: <job>`
+ * .why  = one transformer the real walk and the defective corpus both read, so the red state a
+ *         maintainer meets is the same text the green state proves empty
+ */
+const asIdTokenScopeReports = (input: { workflows: Workflow[] }) => ({
+  workflowScopeGrants: input.workflows
+    .filter((flow) => flow.jobs.some((job) => job.runsSteps))
+    .filter((flow) => flow.permissions?.['id-token'] !== undefined)
+    .map((flow) => flow.path),
+  mintersWithoutGrant: input.workflows.flatMap((flow) =>
+    flow.jobs
+      .filter((job) => job.mintsOidc && job.permissions?.['id-token'] !== 'write')
+      .map((job) => `${flow.path} :: ${job.name}`),
+  ),
+  grantsWithoutMinter: input.workflows.flatMap((flow) =>
+    flow.jobs
+      .filter((job) => job.permissions?.['id-token'] === 'write' && !job.mintsOidc)
+      .map((job) => `${flow.path} :: ${job.name}`),
+  ),
+  jobBlocksWithoutContentsRead: input.workflows.flatMap((flow) =>
+    flow.jobs
+      .filter((job) => job.permissions !== null && job.permissions['contents'] !== 'read')
+      .map((job) => `${flow.path} :: ${job.name}`),
+  ),
+});
+
+/**
+ * .what = one line per job that holds `id-token: write` — the map a reviewer reads
+ */
+const asIdTokenGrantTable = (input: { workflows: Workflow[] }): string[] =>
+  input.workflows.flatMap((flow) =>
+    flow.jobs
+      .filter((job) => job.permissions?.['id-token'] === 'write')
+      .map((job) => `${flow.path} :: ${job.name}`),
+  );
+
+describe('workflow templates grant id-token at job scope (#550)', () => {
+  given('[case1] every workflow template under src/practices', () => {
+    const scene = useBeforeAll(() => {
+      const workflows = getAllWorkflowTemplates();
+      return { workflows, reports: asIdTokenScopeReports({ workflows }) };
+    });
+
+    when('[t0] the walk itself is checked', () => {
+      then('it reaches the oidc minters -- if red, the walk reaches no aws-auth job at all', () => {
+        const minters = scene.workflows.flatMap((flow) =>
+          flow.jobs.filter((job) => job.mintsOidc),
+        );
+        expect(minters.length).toBeGreaterThan(0);
+      });
+    });
+
+    when('[t1] each workflow is read for its grants', () => {
+      then(
+        'no workflow with step jobs grants id-token at workflow scope -- if red, move the grant down to the jobs that mint the token',
+        () => {
+          expect(scene.reports.workflowScopeGrants).toEqual([]);
+        },
+      );
+
+      then(
+        'each job that mints an oidc token grants id-token at job scope -- if red, add `permissions: { contents: read, id-token: write }` to that job',
+        () => {
+          expect(scene.reports.mintersWithoutGrant).toEqual([]);
+        },
+      );
+
+      then(
+        'no job grants id-token that does not mint one -- if red, drop the grant from that job',
+        () => {
+          expect(scene.reports.grantsWithoutMinter).toEqual([]);
+        },
+      );
+
+      then(
+        'each job-level permissions block restates contents: read -- if red, a job-level block replaces the workflow one, so add `contents: read`',
+        () => {
+          expect(scene.reports.jobBlocksWithoutContentsRead).toEqual([]);
+        },
+      );
+
+      then('the grant table reads as declared', () => {
+        expect(asIdTokenGrantTable({ workflows: scene.workflows })).toMatchSnapshot();
+      });
+    });
+  });
+
+  given('[case2] a corpus that is defective on purpose', () => {
+    const text = [
+      'on:',
+      '  workflow_call:',
+      'permissions:',
+      '  id-token: write',
+      '  contents: read',
+      'jobs:',
+      '  lint:',
+      '    runs-on: ubuntu-24.04',
+      '    permissions:',
+      '      id-token: write',
+      '    steps:',
+      '      - run: npm run test:lint',
+      '  deploy:',
+      '    runs-on: ubuntu-24.04',
+      '    steps:',
+      '      - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4',
+    ].join('\n');
+
+    when('[t0] the corpus is read the way the walk reads a real one', () => {
+      const workflows = [asWorkflowFromText({ path: 'demo/.github/workflows/.demo.yml', text })];
+
+      then('each report names its offender -- the text a maintainer meets on red', () => {
+        const reports = asIdTokenScopeReports({ workflows });
+        expect(reports.workflowScopeGrants).toEqual(['demo/.github/workflows/.demo.yml']);
+        expect(reports.mintersWithoutGrant).toEqual(['demo/.github/workflows/.demo.yml :: deploy']);
+        expect(reports.grantsWithoutMinter).toEqual(['demo/.github/workflows/.demo.yml :: lint']);
+        expect(reports.jobBlocksWithoutContentsRead).toEqual([
+          'demo/.github/workflows/.demo.yml :: lint',
+        ]);
+        expect(reports).toMatchSnapshot();
+      });
+    });
+  });
+});

package/dist/workflowPrBuild.declapract.integration.test.ts

@@ -0,0 +1,240 @@
+import { readFileSync } from 'node:fs';
+import { basename, join, relative } from 'node:path';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+import yaml from 'yaml';
+
+import {
+  getAllPathsUnderDir,
+  PRACTICE_TREE_SKIP_DIRS,
+} from './utils/getAllPathsUnderDir';
+
+/**
+ * .what = holds the pr gate the practices emit to the production build (#678) and to the
+ *         evaluation suite (#669):
+ *           1. every workflow a push or a pull request triggers, that runs a test, also runs
+ *              `npm run build` somewhere in its call closure
+ *           2. in `.test.yml`, each job that runs a test kind which imports the built artifact
+ *              (types, integration, acceptance, evaluation) runs `npm run build` in an earlier step
+ *           3. `.test.yml` runs `npm run test:evaluation --if-present`
+ * .why  = #678 asked for a `test:build` pr job so a build break surfaces before deploy. the pr gate
+ *         already runs the same `npm run build` the deploy runs (`test-types`, and every shard), so a
+ *         new job would only duplicate it. what the issue needs is that the coverage cannot regress
+ *         — a template edit that drops the build step must go red here, not in a deploy.
+ * .note = the closure follows local `uses: ./.github/workflows/<x>` refs by basename, the same
+ *         resolution `workflowCallerCalleeReconciliation` uses: a consumer receives one `<x>.yml`.
+ * .note = INTEGRATION by the same rule as `actionPins`: it reads the disk.
+ */
+
+const REPO_ROOT = join(__dirname, '..');
+const PRACTICES_DIR = join(__dirname, 'practices');
+
+/**
+ * .what = the test kinds that import the built artifact, so they owe a build step before them
+ */
+const TEST_KINDS_ON_BUILD = ['types', 'integration', 'acceptance', 'evaluation'];
+
+interface Step {
+  run: string;
+}
+
+interface Job {
+  name: string;
+  uses: string | null;
+  steps: Step[];
+}
+
+interface Workflow {
+  path: string;
+  base: string;
+  triggers: string[];
+  jobs: Job[];
+}
+
+/**
+ * .what = the trigger names of a workflow, across the yaml `on:` key gotcha
+ * .why  = a yaml 1.1 parser folds `on:` to the boolean key `true`, so both reads are tried
+ */
+const asTriggerNames = (parsed: Record<string, unknown>): string[] => {
+  const on = parsed['on'] ?? parsed[true as unknown as string];
+  if (typeof on === 'string') return [on];
+  if (Array.isArray(on)) return on as string[];
+  return on && typeof on === 'object' ? Object.keys(on) : [];
+};
+
+const asWorkflowFromText = (input: { path: string; text: string }): Workflow => {
+  const parsed = (yaml.parse(input.text) ?? {}) as Record<string, unknown>;
+  const jobs = (parsed['jobs'] ?? {}) as Record<string, Record<string, unknown>>;
+  return {
+    path: input.path,
+    base: basename(input.path),
+    triggers: asTriggerNames(parsed),
+    jobs: Object.entries(jobs).map(([name, job]) => ({
+      name,
+      uses: typeof job['uses'] === 'string' ? job['uses'] : null,
+      steps: (Array.isArray(job['steps']) ? (job['steps'] as Record<string, unknown>[]) : []).map(
+        (step) => ({ run: typeof step['run'] === 'string' ? step['run'] : '' }),
+      ),
+    })),
+  };
+};
+
+const getAllWorkflowTemplates = (): Workflow[] =>
+  getAllPathsUnderDir({ dir: PRACTICES_DIR, skip: PRACTICE_TREE_SKIP_DIRS })
+    .filter((path) => path.includes('/.github/workflows/') && /\.ya?ml$/.test(path))
+    .sort()
+    .map((path) =>
+      asWorkflowFromText({ path: relative(REPO_ROOT, path), text: readFileSync(path, 'utf-8') }),
+    );
+
+const isRunBuild = (run: string): boolean => /\bnpm run build\b/.test(run);
+const isRunTest = (run: string): boolean => /\bnpm run test:/.test(run);
+const isRunTestOfKind = (input: { run: string; kind: string }): boolean =>
+  new RegExp(`\\bnpm run test:${input.kind}\\b`).test(input.run);
+
+/**
+ * .what = every step run in a workflow and the local workflows it calls, transitively
+ */
+const getAllRunsInClosure = (input: {
+  workflow: Workflow;
+  byBase: Map<string, Workflow>;
+  seen: Set<string>;
+}): string[] => {
+  if (input.seen.has(input.workflow.base)) return [];
+  input.seen.add(input.workflow.base);
+  return input.workflow.jobs.flatMap((job) => {
+    const callee = /^\.\/\.github\/workflows\/(.+)$/.exec(job.uses ?? '')?.[1];
+    const calleeFound = callee ? input.byBase.get(callee) : undefined;
+    const runsCallee = calleeFound
+      ? getAllRunsInClosure({ workflow: calleeFound, byBase: input.byBase, seen: input.seen })
+      : [];
+    return [...job.steps.map((step) => step.run), ...runsCallee];
+  });
+};
+
+/**
+ * .what = the pr-gate workflows that run a test but never the build, in their closure
+ */
+const asWorkflowsTestedUnbuilt = (input: { workflows: Workflow[] }): string[] => {
+  const byBase = new Map(input.workflows.map((flow) => [flow.base, flow]));
+  return input.workflows
+    .filter((flow) => flow.triggers.some((name) => name === 'push' || name === 'pull_request'))
+    .filter((flow) => {
+      const runs = getAllRunsInClosure({ workflow: flow, byBase, seen: new Set() });
+      return runs.some(isRunTest) && !runs.some(isRunBuild);
+    })
+    .map((flow) => flow.path);
+};
+
+/**
+ * .what = the jobs that run a build-bound test kind with no build in an earlier step
+ */
+const asJobsTestedBeforeBuild = (input: { workflow: Workflow }): string[] =>
+  input.workflow.jobs
+    .filter((job) => {
+      const runs = job.steps.map((step) => step.run);
+      const firstTest = runs.findIndex((run) =>
+        TEST_KINDS_ON_BUILD.some((kind) => isRunTestOfKind({ run, kind })),
+      );
+      if (firstTest === -1) return false;
+      return !runs.slice(0, firstTest).some(isRunBuild);
+    })
+    .map((job) => `${input.workflow.path} :: ${job.name}`);
+
+describe('the pr gate runs the production build (#678) and the evaluation suite (#669)', () => {
+  given('[case1] every workflow template under src/practices', () => {
+    const scene = useBeforeAll(() => {
+      const workflows = getAllWorkflowTemplates();
+      const testYml = workflows.find(
+        (flow) => flow.base === '.test.yml' && flow.path.includes('/cicd-common/'),
+      );
+      return { workflows, testYml };
+    });
+
+    when('[t0] the walk itself is checked', () => {
+      then('it reaches the cicd-common .test.yml -- if red, the walk reaches no pr gate', () => {
+        expect(scene.testYml).toBeDefined();
+      });
+    });
+
+    when('[t1] each pr-gate workflow is followed through its calls', () => {
+      then(
+        'each one that runs a test also runs `npm run build` -- if red, restore the build step the deploy relies on',
+        () => {
+          expect(asWorkflowsTestedUnbuilt({ workflows: scene.workflows })).toEqual([]);
+        },
+      );
+    });
+
+    when('[t2] the jobs of .test.yml are read', () => {
+      then(
+        'each job that runs a build-bound test builds first -- if red, add `npm run build` before that test step',
+        () => {
+          expect(asJobsTestedBeforeBuild({ workflow: scene.testYml! })).toEqual([]);
+        },
+      );
+
+      then('a job runs the evaluation suite, a no-op where the command is absent (#669)', () => {
+        const runs = scene.testYml!.jobs.flatMap((job) => job.steps.map((step) => step.run));
+        expect(runs).toContain('npm run test:evaluation --if-present');
+      });
+
+      then('the jobs that build, in order, read as declared', () => {
+        expect(
+          scene.testYml!.jobs
+            .filter((job) => job.steps.some((step) => isRunBuild(step.run)))
+            .map((job) => job.name),
+        ).toMatchSnapshot();
+      });
+    });
+  });
+
+  given('[case2] a corpus that is defective on purpose', () => {
+    const caller = [
+      'on:',
+      '  push:',
+      'jobs:',
+      '  suite:',
+      '    uses: ./.github/workflows/.demo-test.yml',
+    ].join('\n');
+    const callee = [
+      'on:',
+      '  workflow_call:',
+      'jobs:',
+      '  test-types:',
+      '    runs-on: ubuntu-24.04',
+      '    steps:',
+      '      - run: npm run test:types',
+      '      - run: npm run build',
+    ].join('\n');
+
+    when('[t0] the corpus is read the way the walk reads a real one', () => {
+      const workflows = [
+        asWorkflowFromText({ path: 'demo/.github/workflows/test.yml', text: caller }),
+        asWorkflowFromText({ path: 'demo/.github/workflows/.demo-test.yml', text: callee }),
+      ];
+
+      then('a build after the test reads as a test before the build', () => {
+        expect(asJobsTestedBeforeBuild({ workflow: workflows[1]! })).toEqual([
+          'demo/.github/workflows/.demo-test.yml :: test-types',
+        ]);
+      });
+
+      then('a closure with no build at all is named by its trigger workflow', () => {
+        const unbuilt = [
+          workflows[0]!,
+          asWorkflowFromText({
+            path: 'demo/.github/workflows/.demo-test.yml',
+            text: callee.replace('      - run: npm run build\n', '').replace(
+              '      - run: npm run build',
+              '',
+            ),
+          }),
+        ];
+        expect(asWorkflowsTestedUnbuilt({ workflows: unbuilt })).toEqual([
+          'demo/.github/workflows/test.yml',
+        ]);
+      });
+    });
+  });
+});

package/package.json

@@ -2,7 +2,8 @@
   "name": "declapract-typescript-ehmpathy",
   "author": "ehmpathy",
   "description": "declapract best practices declarations for typescript",
-  "version": "0.49.13",
+  "private": false,
+  "version": "0.49.14",
   "license": "MIT",
   "main": "src/index.js",
   "repository": "ehmpathy/declapract-typescript-ehmpathy",
@@ -17,7 +18,6 @@
     "biome:nested:hide": "mv src/practices/lint/best-practice/biome.jsonc src/practices/lint/best-practice/_biome.jsonc 2>/dev/null || true",
     "biome:nested:restore": "mv src/practices/lint/best-practice/_biome.jsonc src/practices/lint/best-practice/biome.jsonc 2>/dev/null || true",
     "fix:format:biome": "npm run biome:nested:hide && biome check --write; EXIT=$?; npm run biome:nested:restore; exit $EXIT",
-    "fix:format:terraform": "terraform fmt -recursive",
     "fix:format": "npm run fix:format:biome",
     "fix:lint": "npm run biome:nested:hide && biome check --write; EXIT=$?; npm run biome:nested:restore; exit $EXIT",
     "fix": "npm run fix:format && npm run fix:lint",
@@ -77,21 +77,25 @@
     "esbuild-register": "3.6.0",
     "husky": "8.0.3",
     "jest": "30.2.0",
-    "rhachet": "1.47.5",
+    "rhachet": "1.49.2",
     "rhachet-brains-anthropic": "0.4.3",
-    "rhachet-brains-fireworksai": "0.1.7",
+    "rhachet-brains-fireworksai": "0.2.3",
+    "rhachet-brains-openrouter": "0.1.3",
     "rhachet-brains-xai": "0.3.3",
-    "rhachet-roles-bhrain": "0.37.0",
+    "rhachet-roles-bhrain": "0.39.3",
     "rhachet-roles-bhrowser": "0.1.0",
-    "rhachet-roles-bhuild": "0.21.36",
-    "rhachet-roles-ehmpathy": "1.38.12",
+    "rhachet-roles-bhuild": "0.23.2",
+    "rhachet-roles-ehmpathy": "1.39.5",
     "rhachet-roles-ghlitch": "0.3.0",
     "rhachet-roles-rhachet": "0.1.7",
+    "sdk-aws-lambda": "0.7.2",
+    "sdk-environment": "0.1.5",
     "tsc-alias": "1.8.10",
     "tsx": "4.20.6",
     "type-fns": "1.21.2",
     "typescript": "5.4.5",
-    "yalc": "1.0.0-pre.53"
+    "yalc": "1.0.0-pre.53",
+    "zod": "4.4.3"
   },
   "config": {
     "commitizen": {

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/__snapshots__/ssm-cicd-param-names.declapract.integration.test.ts.snap

@@ -1,10 +0,0 @@
-// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
-
-exports[`persist-with-rds ssm cicd param names are slash-path, tierless given: [case1] the two cicd credentials when: [t0] resources.parameters.ts is read then: the emitted cicd + crud param-name lines match snapshot: ssm cicd + crud param names 1`] = `
-[
-  "*         with NO tier segment — \`parameter/<star>/svc-<star>/database/role/cicd/for-plan/<star>\`",
-  "secret({ name: \`\${namespace}.database.role.crud.password\` }),",
-  "name: \`/@declapract{variable.organizationName}/@declapract{variable.projectName}/database/role/cicd/for-plan/password\`,",
-  "name: \`/@declapract{variable.organizationName}/@declapract{variable.projectName}/database/role/cicd/for-apply/password\`,",
-]
-`;

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/bad-practices/with-connection-in-input/src/utils/database/withDatabaseConnection.ts

@@ -1,3 +0,0 @@
-import { FileCheckType } from 'declapract';
-
-export const check = FileCheckType.EXISTS; // if a file exists with this path pattern, then it's bad practice

package/dist/.test/assets/cicd-service/declarations/practices/persist-with-rds/ssm-cicd-param-names.declapract.integration.test.ts

@@ -1,73 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { given, then, when } from 'test-fns';
-
-/**
- * .what = clamps that the ssm-off-terraform wish declares the two cicd credentials as SLASH paths
- *         with NO tier segment, while the crud credential keeps its dotted tier-scoped name.
- * .why  = the prod plan role pins its ONE `kms:Decrypt` exception to a slash arn
- *         (`parameter/*​/svc-*​/database/role/cicd/for-plan/*`) that needs literal `/` separators
- *         and omits a tier (the aws ACCOUNT separates prep from prod, never the name). a dotted
- *         name cannot match that arn, so the plan role gets ciphertext or a denial, forever, and
- *         a repo does not find out until prod (#591). the shipped `ahbode/svc-home-services` proved
- *         the slash form; this clamp ports it into the practice so no consumer inherits the dotted
- *         cicd name again. crud is pinned by NO policy, so it keeps its dotted name and this clamp
- *         leaves it alone.
- * .teeth = revert either cicd entry to the dotted `${namespace}.database.role.cicd.for-plan.password`
- *          form and the slash-present case reddens; the no-dotted-cicd case reddens too.
- * .note = `.declapract.test.ts` = this repo's UNIT-test marker; at the practice ROOT (not under
- *         best-practice/), so it is neither loaded as a declaration nor copied to a consumer.
- */
-
-// anchor on __dirname, not process.cwd(): a nested `jest src/practices/...` run has a different cwd.
-// from this file (src/practices/persist-with-rds/) the best-practice tree is one segment down.
-const paramsPath = join(
-  __dirname,
-  'best-practice/provision/aws/resources.parameters.ts',
-);
-
-describe('persist-with-rds ssm cicd param names are slash-path, tierless', () => {
-  const source = readFileSync(paramsPath, 'utf8');
-
-  given('[case1] the two cicd credentials', () => {
-    when('[t0] resources.parameters.ts is read', () => {
-      then('for-plan is a slash path, byte-identical to the iam pin', () => {
-        expect(source).toContain('/database/role/cicd/for-plan/password');
-      });
-
-      then('for-apply is a slash path', () => {
-        expect(source).toContain('/database/role/cicd/for-apply/password');
-      });
-
-      then('neither cicd name is dotted (a dotted name cannot match the arn pin)', () => {
-        expect(source).not.toContain('.database.role.cicd.for-plan');
-        expect(source).not.toContain('.database.role.cicd.for-apply');
-      });
-
-      then('the cicd slash path carries no tier segment (project joins /database directly)', () => {
-        // /{org}/{project}/database/... — a tier segment would split project from database
-        expect(source).toContain('projectName}/database/role/cicd/for-plan/password');
-        expect(source).not.toContain('${slug}/database/role/cicd');
-      });
-
-      // the emitted param-name lines are the caller-faced contract: snapshot them so a reword that
-      // keeps the slash tokens green (a re-templated prefix, a moved tier segment) reddens a vibecheck.
-      then('the emitted cicd + crud param-name lines match snapshot', () => {
-        const nameLines = source
-          .split('\n')
-          .filter((line) => line.includes('database/role/cicd') || line.includes('database.role.'))
-          .map((line) => line.trim());
-        expect(nameLines).toMatchSnapshot('ssm cicd + crud param names');
-      });
-    });
-  });
-
-  given('[case2] the crud credential', () => {
-    when('[t0] resources.parameters.ts is read', () => {
-      then('crud keeps its dotted tier-scoped name (no policy pins it)', () => {
-        expect(source).toContain('${namespace}.database.role.crud.password');
-      });
-    });
-  });
-});

package/dist/.test/assets/expo/declarations/practices/cicd-app-react-native-expo/best-practice/.github/workflows/test.yml

@@ -1,25 +0,0 @@
-name: test
-
-on:
-  workflow_call:
-  push:
-    branches-ignore:
-      - 'main' # exclude main branch, since deploy workflow triggers on main, and calls the test workflow inside of it already
-    tags-ignore:
-      - v* # exclude tags, since deploy workflow triggers on tags, and calls the test workflow inside of it already
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
-  cancel-in-progress: true #  cancel workflows for non-latest commits
-
-permissions:
-  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
-  contents: read
-
-jobs:
-  suite:
-    uses: ./.github/workflows/.test.yml
-    with:
-      creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
-    secrets: inherit # keyrack firewall in .test.yml filters to declared keys

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/best-practice/.github/workflows/test.yml

@@ -1,25 +0,0 @@
-name: test
-
-on:
-  workflow_call:
-  push:
-    branches-ignore:
-      - 'main' # exclude main branch, since deploy workflow triggers on main, and calls the test workflow inside of it already
-    tags-ignore:
-      - v* # exclude tags, since deploy workflow triggers on tags, and calls the test workflow inside of it already
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
-  cancel-in-progress: true #  cancel workflows for non-latest commits
-
-permissions:
-  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
-  contents: read
-
-jobs:
-  suite:
-    uses: ./.github/workflows/.test.yml
-    with:
-      creds-aws-region: us-east-1
-      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
-    secrets: inherit # keyrack firewall in .test.yml filters to declared keys

package/dist/.test/assets/expo-fullusecase/declarations/practices/conventional-commits/best-practice/.husky/check.commit.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-if command -v node > /dev/null 2>&1 && [ -x ./node_modules/.bin/commitlint ]; then
-    ./node_modules/.bin/commitlint --edit "$1"
-else
-    echo "🟡 commitlint not available, wont check commit message"
-fi