declapract-typescript-ehmpathy 0.49.9 → 0.49.11

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/best-practice/.github/workflows/.declastruct.yml

@@ -0,0 +1,198 @@
+name: .declastruct
+
+# .what = reusable declastruct plan/apply for a wish, against either a github-app or an
+#   aws-oidc backend. one workflow, two auth models — each auth step fires only when its
+#   creds are supplied.
+# .why = declastruct wishes share the plan->artifact->apply shape regardless of backend;
+#   only the auth differs. github-provider wishes auth via a github-app token; aws-provider
+#   wishes auth via oidc role assumption (with a plan/apply role split — plan readonly, apply
+#   writer) + the ACCESS envar (read by the wish via sdk-environment). the plan is uploaded as
+#   an artifact so apply executes the EXACT plan reviewers saw.
+
+on:
+  workflow_call:
+    inputs:
+      wish-path:
+        type: string
+        description: "the path to the wish declaration"
+        required: true
+      scope:
+        type: string
+        description: "the provider backend this wish targets (github | aws); scopes the plan artifact name"
+        required: true
+      access:
+        type: string
+        description: "the access tier this wish targets (test | prep | prod); read by the wish via sdk-environment as the ACCESS envar (aws wishes), and scopes the plan artifact name so parallel calls do not collide"
+        required: true
+      github-environment-plan:
+        type: string
+        description: "github environment for the plan job (empty = no env gate)"
+      github-environment-apply:
+        type: string
+        description: "github environment for the apply job (empty = no env gate)"
+      allow-apply:
+        type: boolean
+        description: "whether the apply step is enabled. defaults to true on main"
+        default: ${{ github.ref == 'refs/heads/main' }}
+      creds-github-app-owner:
+        type: string
+        required: false
+        description: "github-app wishes: the owner of the github app to generate a token for"
+      creds-github-app-id:
+        type: string
+        required: false
+        description: "github-app wishes: the id of the github app to generate a token for"
+      creds-aws-region:
+        type: string
+        required: false
+        description: "aws wishes: the aws region for oidc auth"
+      creds-aws-role-arn-plan:
+        type: string
+        required: false
+        description: "aws wishes: oidc role arn for the plan job (readonly — DescribeParameters, no kms:Decrypt)"
+      creds-aws-role-arn-apply:
+        type: string
+        required: false
+        description: "aws wishes: oidc role arn for the apply job (writer — PutParameter, kms:Encrypt)"
+    secrets:
+      creds-github-app-private-key:
+        required: false
+        description: "github-app wishes: the private key of the github app to generate a token for"
+
+permissions:
+  id-token: write # required for aws oidc (unused by github-app wishes)
+  contents: read
+
+jobs:
+  install:
+    uses: ./.github/workflows/.install.yml
+
+  plan:
+    runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-plan }}
+    needs: [install]
+    env:
+      ACCESS: ${{ inputs.access }} # aws wishes: sdk-environment getEnvironment reads ACCESS
+    outputs:
+      has-changes-planned: ${{ steps.evaluate-plan.outputs.has-changes-planned }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+          fail-on-cache-miss: true
+
+      - name: get github auth, if creds supplied
+        if: ${{ inputs.creds-github-app-id }}
+        id: github-app-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          owner: ${{ inputs.creds-github-app-owner }}
+          repositories: ${{ github.event.repository.name }}
+          app-id: ${{ inputs.creds-github-app-id }}
+          private-key: ${{ secrets.creds-github-app-private-key }}
+
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn-plan }}
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
+      - name: declastruct plan
+        id: plan
+        run: |
+          set -o pipefail
+          npx declastruct plan --wish ${{ inputs.wish-path }} --into ${{ inputs.wish-path }}.plan.json | tee ./plan.log
+        env:
+          GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}
+
+      - name: evaluate plan
+        id: evaluate-plan
+        run: |
+          # declastruct prints this exact phrase when there is no diff
+          if grep "in sync" ./plan.log
+          then
+            echo "has-changes-planned=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has-changes-planned=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: has changes planned?
+        run: echo "${{ steps.evaluate-plan.outputs.has-changes-planned }}"
+
+      - name: upload plan artifact
+        if: ${{ inputs.allow-apply == true && steps.evaluate-plan.outputs.has-changes-planned == 'true' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: declastruct-${{ inputs.scope }}-${{ inputs.access }}-plan
+          path: |
+            ${{ inputs.wish-path }}.plan.json
+          retention-days: 1
+          include-hidden-files: false
+
+  apply:
+    runs-on: ubuntu-24.04
+    environment: ${{ inputs.github-environment-apply }}
+    needs: [install, plan]
+    if: ${{ inputs.allow-apply == true && needs.plan.outputs.has-changes-planned == 'true' }}
+    env:
+      ACCESS: ${{ inputs.access }} # aws wishes: sdk-environment getEnvironment reads ACCESS
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+          fail-on-cache-miss: true
+
+      - name: extract directory from wish-path
+        id: extract-dir
+        run: echo "wish-dir=$(dirname "${{ inputs.wish-path }}")" >> "$GITHUB_OUTPUT"
+
+      - name: download plan artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: declastruct-${{ inputs.scope }}-${{ inputs.access }}-plan
+          path: ${{ steps.extract-dir.outputs.wish-dir }}
+
+      - name: get github auth, if creds supplied
+        if: ${{ inputs.creds-github-app-id }}
+        id: github-app-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          owner: ${{ inputs.creds-github-app-owner }}
+          repositories: ${{ github.event.repository.name }}
+          app-id: ${{ inputs.creds-github-app-id }}
+          private-key: ${{ secrets.creds-github-app-private-key }}
+
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn-apply }}
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
+      - name: declastruct apply
+        run: |
+          set -o pipefail
+          npx declastruct apply --plan ${{ inputs.wish-path }}.plan.json | tee ./apply.log
+        env:
+          GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/best-practice/.github/workflows/.install.yml

@@ -0,0 +1,56 @@
+name: .install
+
+on:
+  workflow_call:
+    outputs:
+      node-modules-cache-key:
+        description: a max(stable) cache key to the node modules of this commit's dependencies
+        value: ${{ jobs.pnpm.outputs.node-modules-cache-key }}
+
+jobs:
+  pnpm:
+    runs-on: ubuntu-24.04
+    outputs:
+      node-modules-cache-key: ${{ steps.cache.outputs.cache-primary-key }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: node-modules deps hash
+        id: deps-hash
+        run: |
+          NODE_VERSION=$(cat .nvmrc | tr -d '[:space:]');
+          echo "NODE_VERSION=$NODE_VERSION"
+          echo "node-version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
+          PACKAGE_DEPS_HASH=$(md5sum pnpm-lock.yaml | awk '{print $1}');
+          echo "PACKAGE_DEPS_HASH=$PACKAGE_DEPS_HASH"
+          echo "package-deps-hash=$PACKAGE_DEPS_HASH" >> "$GITHUB_OUTPUT"
+
+      - name: node-modules cache check
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        id: cache
+        with:
+          path: ./node_modules
+          key: ${{ runner.os }}-node-${{ steps.deps-hash.outputs.node-version }}-pnpm-${{ steps.deps-hash.outputs.package-deps-hash }}
+          lookup-only: true
+
+      - name: node-modules cache miss setup node
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: node-modules cache miss setup pnpm
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+
+      - name: node-modules cache miss install
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: pnpm install --frozen-lockfile
+
+      - name: node-modules cache set
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ steps.cache.outputs.cache-primary-key }}

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/best-practice/.github/workflows/.test.yml

@@ -0,0 +1,380 @@
+name: .test
+
+on:
+  workflow_call:
+    inputs:
+      creds-aws-role-arn:
+        description: "creds for aws, specifies the role to assume via oidc. if not provided, aws auth is skipped"
+        required: false
+        type: string
+      creds-aws-region:
+        description: "creds for aws, specifies the region. defaults to us-east-1"
+        required: false
+        type: string
+        default: "us-east-1"
+
+permissions:
+  id-token: write # required for oidc
+  contents: read
+
+jobs:
+  # install the dependencies
+  install:
+    uses: ./.github/workflows/.install.yml
+
+  # run tests in parallel
+  test-commits:
+    runs-on: ubuntu-24.04
+    needs: [install, test-shards-omit]
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0 # we need all commits to test:commits
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      - name: test:commits
+        run: npm run test:commits
+
+  test-types:
+    runs-on: ubuntu-24.04
+    needs: [install, test-shards-omit]
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      - name: build
+        run: npm run build # build before test:types, to ensure .dist/ artifacts are importable for blackbox tests
+
+      - name: test:types
+        run: npm run test:types
+
+  test-format:
+    runs-on: ubuntu-24.04
+    needs: [install, test-shards-omit]
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: set terraform version
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      - name: test:format
+        run: npm run test:format
+
+  test-lint:
+    runs-on: ubuntu-24.04
+    needs: [install, test-shards-omit]
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      - name: test:lint
+        run: npm run test:lint
+
+  test-unit:
+    runs-on: ubuntu-24.04
+    needs: [install, test-shards-omit]
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      - name: test:unit
+        run: THOROUGH=true npm run test:unit
+
+  # shard setup job
+  enshard:
+    name: enshard
+    runs-on: ubuntu-24.04
+    outputs:
+      integration-matrix: ${{ steps.integration.outputs.matrix }}
+      integration-patterns: ${{ steps.integration.outputs.patterns }}
+      acceptance-matrix: ${{ steps.acceptance.outputs.matrix }}
+      acceptance-patterns: ${{ steps.acceptance.outputs.patterns }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          sparse-checkout: |
+            jest.integration.shards.jsonc
+            jest.acceptance.shards.jsonc
+            .github/actions/test-shards-setup
+          sparse-checkout-cone-mode: false
+
+      - name: setup integration shards
+        id: integration
+        uses: ./.github/actions/test-shards-setup
+        with:
+          config-file: jest.integration.shards.jsonc
+          test-type: integration
+
+      - name: setup acceptance shards
+        id: acceptance
+        uses: ./.github/actions/test-shards-setup
+        with:
+          config-file: jest.acceptance.shards.jsonc
+          test-type: acceptance
+
+  # placeholder job for github actions visualization alignment
+  # note: github actions has no column position controls;
+  #       this job pushes test-* jobs one column right to align with test-shards-* column
+  test-shards-omit:
+    runs-on: ubuntu-24.04
+    needs: [install]
+    steps:
+      - run: echo "👌 placeholder for column alignment"
+
+  # shard runner jobs
+  test-shards-integration:
+    runs-on: ubuntu-24.04
+    needs: [install, enshard]
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: ${{ fromJson(needs.enshard.outputs.integration-matrix) }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      # .why = keyrack.yml can extend other manifests via symlinks (e.g., .agent/repo=ehmpathy/role=mechanic/keyrack.yml)
+      #        prepare:rhachet creates these symlinks so keyrack.source() can hydrate extended keys
+      - name: prepare:rhachet
+        run: npm run prepare:rhachet --if-present
+
+      # .why = keyrack firewall translates and validates secrets before tests run
+      #        - filters to declared keys in keyrack.yml
+      #        - translates mechanisms (e.g., GitHub App → ghs_* token)
+      #        - blocks dangerous patterns (ghp_*, AKIA*, etc.)
+      #        - exports to $GITHUB_ENV with mask applied
+      - name: keyrack firewall
+        run: npx rhachet keyrack firewall --env test --from 'json(env://SECRETS_JSON)' --into github.actions
+        env:
+          SECRETS_JSON: ${{ toJSON(secrets) }}
+
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn }}
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
+      - name: start:testdb
+        run: npm run start:testdb --if-present
+
+      - name: start:livedb:prep
+        run: npm run start:livedb:prep --if-present
+
+      - name: build
+        run: npm run build
+
+      - name: test:integration (explicit ${{ matrix.shard.index }})
+        if: matrix.shard.type == 'explicit'
+        run: |
+          set -eu
+          patterns='${{ join(matrix.shard.patterns, '|') }}'
+          THOROUGH=true npm run test:integration -- --testPathPatterns="$patterns" --json --outputFile=jest-results.json
+
+      - name: test:integration (dynamic ${{ matrix.shard.shard }}/${{ matrix.shard.total }})
+        if: matrix.shard.type == 'dynamic'
+        run: |
+          set -eu
+          exclude='${{ needs.enshard.outputs.integration-patterns }}'
+          if [[ -n "$exclude" ]]; then
+            THOROUGH=true npm run test:integration -- --testPathIgnorePatterns="$exclude" --shard=${{ matrix.shard.shard }}/${{ matrix.shard.total }} --json --outputFile=jest-results.json
+          else
+            THOROUGH=true npm run test:integration -- --shard=${{ matrix.shard.shard }}/${{ matrix.shard.total }} --json --outputFile=jest-results.json
+          fi
+
+      - name: report slow tests
+        if: always() && hashFiles('jest-results.json') != ''
+        run: |
+          set -eu
+          jq -r '.testResults[] | select(.perfStats.runtime != null) | "\(.name):\(.perfStats.runtime)"' jest-results.json | while IFS=: read -r name runtime; do
+            seconds=$((runtime / 1000))
+            if [[ $seconds -ge 30 ]]; then
+              echo "::warning file=${name}::slow test: ${seconds}s"
+            elif [[ $seconds -ge 10 ]]; then
+              echo "::notice file=${name}::test duration: ${seconds}s"
+            fi
+          done
+
+  test-shards-acceptance:
+    runs-on: ubuntu-24.04
+    needs: [install, enshard]
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: ${{ fromJson(needs.enshard.outputs.acceptance-matrix) }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: set node-version
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: get node-modules from cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ./node_modules
+          key: ${{ needs.install.outputs.node-modules-cache-key }}
+
+      # .why = keyrack.yml can extend other manifests via symlinks (e.g., .agent/repo=ehmpathy/role=mechanic/keyrack.yml)
+      #        prepare:rhachet creates these symlinks so keyrack.source() can hydrate extended keys
+      - name: prepare:rhachet
+        run: npm run prepare:rhachet --if-present
+
+      # .why = keyrack firewall translates and validates secrets before tests run
+      #        - filters to declared keys in keyrack.yml
+      #        - translates mechanisms (e.g., GitHub App → ghs_* token)
+      #        - blocks dangerous patterns (ghp_*, AKIA*, etc.)
+      #        - exports to $GITHUB_ENV with mask applied
+      - name: keyrack firewall
+        run: npx rhachet keyrack firewall --env test --from 'json(env://SECRETS_JSON)' --into github.actions
+        env:
+          SECRETS_JSON: ${{ toJSON(secrets) }}
+
+      - name: get aws auth, if creds supplied
+        if: ${{ inputs.creds-aws-role-arn }}
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: ${{ inputs.creds-aws-role-arn }}
+          aws-region: ${{ inputs.creds-aws-region }}
+
+      - name: start:testdb
+        run: npm run start:testdb --if-present
+
+      - name: start:livedb:prep
+        run: npm run start:livedb:prep --if-present
+
+      - name: build
+        run: npm run build
+
+      - name: test:acceptance (explicit ${{ matrix.shard.index }})
+        if: matrix.shard.type == 'explicit'
+        run: |
+          set -eu
+          patterns='${{ join(matrix.shard.patterns, '|') }}'
+          THOROUGH=true npm run test:acceptance -- --testPathPatterns="$patterns" --json --outputFile=jest-results.json
+
+      - name: test:acceptance (dynamic ${{ matrix.shard.shard }}/${{ matrix.shard.total }})
+        if: matrix.shard.type == 'dynamic'
+        run: |
+          set -eu
+          exclude='${{ needs.enshard.outputs.acceptance-patterns }}'
+          if [[ -n "$exclude" ]]; then
+            THOROUGH=true npm run test:acceptance -- --testPathIgnorePatterns="$exclude" --shard=${{ matrix.shard.shard }}/${{ matrix.shard.total }} --json --outputFile=jest-results.json
+          else
+            THOROUGH=true npm run test:acceptance -- --shard=${{ matrix.shard.shard }}/${{ matrix.shard.total }} --json --outputFile=jest-results.json
+          fi
+
+      - name: report slow tests
+        if: always() && hashFiles('jest-results.json') != ''
+        run: |
+          set -eu
+          jq -r '.testResults[] | select(.perfStats.runtime != null) | "\(.name):\(.perfStats.runtime)"' jest-results.json | while IFS=: read -r name runtime; do
+            seconds=$((runtime / 1000))
+            if [[ $seconds -ge 30 ]]; then
+              echo "::warning file=${name}::slow test: ${seconds}s"
+            elif [[ $seconds -ge 10 ]]; then
+              echo "::notice file=${name}::test duration: ${seconds}s"
+            fi
+          done
+
+  # union job: aggregates shard results into single status for pr merge constraints
+  test-integration:
+    runs-on: ubuntu-24.04
+    needs: [install, enshard, test-shards-integration]
+    if: always() && needs.install.result == 'success' && needs.enshard.result == 'success'
+    steps:
+      - name: report shard results
+        run: |
+          set -eu
+          if [[ "${{ needs.test-shards-integration.result }}" == "success" ]]; then
+            echo "👌 all integration test shards passed"
+          else
+            echo "::error::some integration test shards failed"
+            exit 1
+          fi
+
+  # union job: aggregates shard results into single status for pr merge constraints
+  test-acceptance-locally:
+    runs-on: ubuntu-24.04
+    needs: [install, enshard, test-shards-acceptance]
+    if: always() && needs.install.result == 'success' && needs.enshard.result == 'success'
+    steps:
+      - name: report shard results
+        run: |
+          set -eu
+          if [[ "${{ needs.test-shards-acceptance.result }}" == "success" ]]; then
+            echo "👌 all acceptance test shards passed"
+          else
+            echo "::error::some acceptance test shards failed"
+            exit 1
+          fi

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/best-practice/.github/workflows/.test.yml.declapract.ts

@@ -0,0 +1,15 @@
+import { FileCheckType, type FileFixFunction } from 'declapract';
+
+/**
+ * .what = validates .test.yml matches the template exactly
+ * .why = keyrack firewall handles secrets at runtime; no build-time injection needed
+ */
+export const check = FileCheckType.EQUALS;
+
+/**
+ * .what = replaces .test.yml with the template content
+ * .why = ensures workflow has firewall step for keyrack secrets
+ */
+export const fix: FileFixFunction = async (_contents, context) => {
+  return { contents: context.declaredFileContents ?? '' };
+};

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/best-practice/.github/workflows/release.yml

@@ -0,0 +1,32 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  please-release:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: get github token
+        id: github-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          app-id: ${{ vars.RHELEASE_APP_ID }}
+          private-key: ${{ secrets.RHELEASE_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.github-token.outputs.token }} # enables git push with app token
+
+      - name: please release
+        uses: ./.github/actions/please-release
+        with:
+          github-token: ${{ steps.github-token.outputs.token }}
+          commit-message: ${{ github.event.head_commit.message }}
+          commit-sha: ${{ github.sha }}
+          repository: ${{ github.repository }}