domainforge 0.13.0

package/scripts/generate-changelog.sh

@@ -0,0 +1,271 @@
+#!/usr/bin/env bash
+# generate-changelog.sh - Generate changelog entries from git commits
+# Usage: ./scripts/generate-changelog.sh [VERSION] [OPTIONS]
+#
+# Parses conventional commits and updates CHANGELOG.md
+
+set -euo pipefail
+
+# ============================================================================
+# Configuration
+# ============================================================================
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Flags
+DRY_RUN=false
+NO_COMMIT=false
+
+# ============================================================================
+# Helper Functions
+# ============================================================================
+log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
+log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[✗]${NC} $1"; }
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [VERSION] [OPTIONS]
+
+Generate changelog entries from git commits using conventional commit format.
+
+ARGUMENTS:
+    VERSION         Version number for the changelog entry (e.g., 0.7.0)
+                    If not provided, reads from domainforge-core/Cargo.toml
+
+OPTIONS:
+    --dry-run       Show what would be generated without modifying files
+    --no-commit     Update CHANGELOG.md but don't create git commit
+    -h, --help      Show this help message
+
+COMMIT CATEGORIES:
+    feat:       -> 🎉 Added
+    fix:        -> 🐛 Fixed
+    docs:       -> 📚 Documentation
+    refactor:   -> ✨ Changed
+    perf:       -> ⚡ Performance
+    test:       -> 🧪 Testing
+    chore:      -> 🔧 Maintenance
+
+EXAMPLES:
+    $(basename "$0")                      # Generate for current version
+    $(basename "$0") 0.7.0                # Generate for specific version
+    $(basename "$0") --dry-run            # Preview without changes
+EOF
+}
+
+get_last_tag() {
+    git describe --tags --abbrev=0 2>/dev/null || echo ""
+}
+
+get_current_version() {
+    grep -m1 '^version = ' "$PROJECT_ROOT/domainforge-core/Cargo.toml" | sed 's/version = "\(.*\)"/\1/'
+}
+
+# ============================================================================
+# Parse Arguments
+# ============================================================================
+VERSION=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        --no-commit)
+            NO_COMMIT=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            log_error "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+        *)
+            if [[ -z "$VERSION" ]]; then
+                VERSION="$1"
+            fi
+            shift
+            ;;
+    esac
+done
+
+# Default to current version
+if [[ -z "$VERSION" ]]; then
+    VERSION=$(get_current_version)
+fi
+
+# ============================================================================
+# Main
+# ============================================================================
+cd "$PROJECT_ROOT"
+
+echo ""
+echo "=============================================="
+echo "  DomainForge Changelog Generator"
+echo "=============================================="
+echo ""
+
+if $DRY_RUN; then
+    log_warn "DRY RUN MODE - No files will be modified"
+    echo ""
+fi
+
+log_info "Generating changelog for version: $VERSION"
+
+# Get commit range
+LAST_TAG=$(get_last_tag)
+if [[ -n "$LAST_TAG" ]]; then
+    log_info "Commits since tag: $LAST_TAG"
+    COMMIT_RANGE="$LAST_TAG..HEAD"
+else
+    log_warn "No previous tags found, using all commits"
+    COMMIT_RANGE=""
+fi
+
+# Parse commits into categories
+declare -a ADDED=()
+declare -a FIXED=()
+declare -a CHANGED=()
+declare -a DOCS=()
+declare -a OTHER=()
+
+while IFS= read -r line; do
+    [[ -z "$line" ]] && continue
+    
+    # Extract commit message (format: hash subject)
+    subject="${line#* }"
+    
+    # Categorize by conventional commit prefix
+    case "$subject" in
+        feat:*|feat\(*) 
+            ADDED+=("${subject#feat:} ")
+            ADDED+=("${subject#feat(*)}")
+            ;;
+        fix:*|fix\(*)
+            FIXED+=("${subject#fix:} ")
+            ;;
+        docs:*|docs\(*)
+            DOCS+=("${subject#docs:} ")
+            ;;
+        refactor:*|perf:*|style:*)
+            CHANGED+=("$subject")
+            ;;
+        chore:*|test:*|ci:*|build:*)
+            # Skip maintenance commits from changelog
+            ;;
+        *)
+            # Include non-conventional commits in other
+            if [[ ! "$subject" =~ ^(Merge|chore|test|ci|build) ]]; then
+                OTHER+=("$subject")
+            fi
+            ;;
+    esac
+done < <(git log $COMMIT_RANGE --oneline --no-merges 2>/dev/null || true)
+
+# Generate changelog entry
+DATE=$(date +%Y-%m-%d)
+ENTRY="## [$VERSION] - $DATE"
+ENTRY+="\n"
+
+if [[ ${#ADDED[@]} -gt 0 ]]; then
+    ENTRY+="\n### 🎉 Added\n"
+    for item in "${ADDED[@]}"; do
+        # Clean up the commit message
+        clean_item=$(echo "$item" | sed 's/^[[:space:]]*//' | sed 's/[[:space:]]*$//')
+        [[ -n "$clean_item" ]] && ENTRY+="- $clean_item\n"
+    done
+fi
+
+if [[ ${#CHANGED[@]} -gt 0 ]]; then
+    ENTRY+="\n### ✨ Changed\n"
+    for item in "${CHANGED[@]}"; do
+        clean_item=$(echo "$item" | sed 's/^[a-z]*:[[:space:]]*//')
+        [[ -n "$clean_item" ]] && ENTRY+="- $clean_item\n"
+    done
+fi
+
+if [[ ${#FIXED[@]} -gt 0 ]]; then
+    ENTRY+="\n### 🐛 Fixed\n"
+    for item in "${FIXED[@]}"; do
+        clean_item=$(echo "$item" | sed 's/^[[:space:]]*//' | sed 's/[[:space:]]*$//')
+        [[ -n "$clean_item" ]] && ENTRY+="- $clean_item\n"
+    done
+fi
+
+if [[ ${#DOCS[@]} -gt 0 ]]; then
+    ENTRY+="\n### 📚 Documentation\n"
+    for item in "${DOCS[@]}"; do
+        clean_item=$(echo "$item" | sed 's/^[[:space:]]*//' | sed 's/[[:space:]]*$//')
+        [[ -n "$clean_item" ]] && ENTRY+="- $clean_item\n"
+    done
+fi
+
+# If no categorized commits, add placeholder
+if [[ ${#ADDED[@]} -eq 0 && ${#CHANGED[@]} -eq 0 && ${#FIXED[@]} -eq 0 && ${#DOCS[@]} -eq 0 ]]; then
+    ENTRY+="\n### Added\n- (Add new features here)\n"
+    ENTRY+="\n### Changed\n- (Add changes here)\n"
+    ENTRY+="\n### Fixed\n- (Add bug fixes here)\n"
+fi
+
+ENTRY+="\n"
+
+# Show preview
+echo ""
+log_info "Generated changelog entry:"
+echo "---"
+echo -e "$ENTRY"
+echo "---"
+
+# Update CHANGELOG.md
+if $DRY_RUN; then
+    log_info "Would insert above entry into CHANGELOG.md"
+else
+    if [[ -f "CHANGELOG.md" ]]; then
+        # Find first version heading and insert before it
+        FIRST_VERSION_LINE=$(grep -n "^## \[" CHANGELOG.md | head -1 | cut -d: -f1 || echo "")
+        
+        if [[ -n "$FIRST_VERSION_LINE" ]]; then
+            head -n $((FIRST_VERSION_LINE - 1)) CHANGELOG.md > /tmp/changelog_new.md
+            echo -e "$ENTRY" >> /tmp/changelog_new.md
+            tail -n "+$FIRST_VERSION_LINE" CHANGELOG.md >> /tmp/changelog_new.md
+            mv /tmp/changelog_new.md CHANGELOG.md
+        else
+            # No existing version entries, append
+            echo -e "$ENTRY" >> CHANGELOG.md
+        fi
+        
+        log_success "Updated CHANGELOG.md"
+    else
+        # Create new CHANGELOG.md
+        echo "# Changelog" > CHANGELOG.md
+        echo "" >> CHANGELOG.md
+        echo -e "$ENTRY" >> CHANGELOG.md
+        log_success "Created CHANGELOG.md"
+    fi
+    
+    # Create git commit
+    if ! $NO_COMMIT; then
+        git add CHANGELOG.md
+        git commit -m "docs: update changelog for v$VERSION" --quiet
+        log_success "Created commit: docs: update changelog for v$VERSION"
+    fi
+fi
+
+echo ""
+echo "=============================================="
+log_success "Changelog generation complete"
+echo "=============================================="

package/scripts/generate-release-notes.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+# generate-release-notes.sh - Generate GitHub release notes
+# Usage: ./scripts/generate-release-notes.sh [VERSION] [OPTIONS]
+#
+# Extracts content from CHANGELOG.md and generates RELEASE_NOTES.md
+
+set -euo pipefail
+
+# ============================================================================
+# Configuration
+# ============================================================================
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Flags
+DRY_RUN=false
+
+# ============================================================================
+# Helper Functions
+# ============================================================================
+log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
+log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[✗]${NC} $1"; }
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [VERSION] [OPTIONS]
+
+Generate GitHub release notes from CHANGELOG.md.
+
+ARGUMENTS:
+    VERSION         Version number (e.g., 0.7.0)
+                    If not provided, reads from domainforge-core/Cargo.toml
+
+OPTIONS:
+    --dry-run       Show what would be generated without creating file
+    -h, --help      Show this help message
+
+OUTPUT:
+    Creates RELEASE_NOTES.md with:
+    - Version header
+    - What's Changed section (from CHANGELOG)
+    - Breaking Changes (if any BREAKING CHANGE: footers found)
+    - Contributors list
+
+EXAMPLES:
+    $(basename "$0")              # Generate for current version
+    $(basename "$0") 0.7.0        # Generate for specific version
+    $(basename "$0") --dry-run    # Preview without creating file
+EOF
+}
+
+get_current_version() {
+    grep -m1 '^version = ' "$PROJECT_ROOT/domainforge-core/Cargo.toml" | sed 's/version = "\(.*\)"/\1/'
+}
+
+get_last_tag() {
+    git describe --tags --abbrev=0 2>/dev/null || echo ""
+}
+
+# ============================================================================
+# Parse Arguments
+# ============================================================================
+VERSION=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --dry-run)
+            DRY_RUN=true
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            log_error "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+        *)
+            if [[ -z "$VERSION" ]]; then
+                VERSION="$1"
+            fi
+            shift
+            ;;
+    esac
+done
+
+if [[ -z "$VERSION" ]]; then
+    VERSION=$(get_current_version)
+fi
+
+# ============================================================================
+# Main
+# ============================================================================
+cd "$PROJECT_ROOT"
+
+echo ""
+echo "=============================================="
+echo "  DomainForge Release Notes Generator"
+echo "=============================================="
+echo ""
+
+if $DRY_RUN; then
+    log_warn "DRY RUN MODE - No files will be created"
+    echo ""
+fi
+
+log_info "Generating release notes for version: $VERSION"
+
+DATE=$(date +%Y-%m-%d)
+
+# Start building release notes
+NOTES="# Release v$VERSION ($DATE)\n\n"
+
+# Extract changelog section for this version
+if [[ -f "CHANGELOG.md" ]]; then
+    log_info "Extracting changes from CHANGELOG.md..."
+    
+    # Find the section for this version
+    CHANGELOG_SECTION=$(awk -v version="$VERSION" '
+        /^## \[/ {
+            if (found) exit;
+            if ($0 ~ "\\[" version "\\]") found=1;
+        }
+        found { print }
+    ' CHANGELOG.md | tail -n +2)
+    
+    if [[ -n "$CHANGELOG_SECTION" ]]; then
+        NOTES+="## What's Changed\n\n"
+        NOTES+="$CHANGELOG_SECTION\n"
+    else
+        log_warn "No changelog section found for version $VERSION"
+        NOTES+="## What's Changed\n\n"
+        NOTES+="See [CHANGELOG.md](./CHANGELOG.md) for details.\n\n"
+    fi
+else
+    log_warn "CHANGELOG.md not found"
+    NOTES+="## What's Changed\n\n"
+    NOTES+="See commit history for details.\n\n"
+fi
+
+# Check for breaking changes in commits
+LAST_TAG=$(get_last_tag)
+if [[ -n "$LAST_TAG" ]]; then
+    BREAKING_CHANGES=$(git log "$LAST_TAG..HEAD" --grep="BREAKING CHANGE" --pretty=format:"- %s" 2>/dev/null || true)
+    
+    if [[ -n "$BREAKING_CHANGES" ]]; then
+        NOTES+="## ⚠️ Breaking Changes\n\n"
+        NOTES+="$BREAKING_CHANGES\n\n"
+    fi
+fi
+
+# Get contributors
+log_info "Collecting contributors..."
+if [[ -n "$LAST_TAG" ]]; then
+    CONTRIBUTORS=$(git log "$LAST_TAG..HEAD" --format="%an" 2>/dev/null | sort -u | head -20 || true)
+else
+    CONTRIBUTORS=$(git log --format="%an" -20 2>/dev/null | sort -u | head -10 || true)
+fi
+
+if [[ -n "$CONTRIBUTORS" ]]; then
+    NOTES+="## Contributors\n\n"
+    while IFS= read -r contributor; do
+        [[ -n "$contributor" ]] && NOTES+="- @$contributor\n"
+    done <<< "$CONTRIBUTORS"
+    NOTES+="\n"
+fi
+
+# Add links
+NOTES+="## Links\n\n"
+NOTES+="- [Full Changelog](./CHANGELOG.md)\n"
+NOTES+="- [Documentation](./docs/)\n"
+
+if [[ -n "$LAST_TAG" ]]; then
+    NOTES+="- [Compare with previous version](https://github.com/GodSpeedAI/DomainForge/compare/$LAST_TAG...v$VERSION)\n"
+fi
+
+# Preview or write
+echo ""
+log_info "Generated release notes:"
+echo "---"
+echo -e "$NOTES"
+echo "---"
+
+if $DRY_RUN; then
+    log_info "Would write above content to RELEASE_NOTES.md"
+else
+    echo -e "$NOTES" > RELEASE_NOTES.md
+    log_success "Created RELEASE_NOTES.md"
+fi
+
+echo ""
+echo "=============================================="
+log_success "Release notes generation complete"
+echo "=============================================="

package/scripts/lint_release_security.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Lint release workflows for publish safety and security."""
+import sys
+from pathlib import Path
+
+try:
+    import yaml
+except ImportError:
+    print("PyYAML is required: pip install pyyaml")
+    sys.exit(1)
+
+
+def lint_release_security(path):
+    errors = []
+    try:
+        with open(path) as f:
+            wf = yaml.safe_load(f)
+    except Exception as e:
+        return [f"{path.name}: failed to parse YAML: {e}"]
+
+    if wf is None:
+        return []
+
+    for job_name, job in wf.get("jobs", {}).items():
+        steps = job.get("steps", [])
+        for i, step in enumerate(steps):
+            run = step.get("run", "")
+            name = step.get("name", step.get("uses", "unnamed"))
+
+            if isinstance(run, str) and "curl" in run:
+                piped = run.split("|")[-1].strip() if "|" in run else ""
+                if piped.endswith("sh") or piped.endswith("bash"):
+                    if "sha256" not in run.lower() and "checksum" not in run.lower():
+                        errors.append(
+                            f"{path.name}:{job_name}/step[{i}]: "
+                            f"curl | sh without checksum verification"
+                        )
+
+            if step.get("continue-on-error"):
+                name_lower = str(name).lower()
+                run_lower = str(run).lower()
+                if "publish" in name_lower or "publish" in run_lower or "release" in name_lower:
+                    errors.append(
+                        f"{path.name}:{job_name}/step[{i}]: "
+                        f"continue-on-error on publish/release step '{name}'"
+                    )
+
+            if isinstance(run, str) and "publish" in run.lower():
+                if "|| echo" in run or "|| true" in run:
+                    if "already" not in run.lower() and "skip" not in run.lower():
+                        errors.append(
+                            f"{path.name}:{job_name}/step[{i}]: "
+                            f"publish failure masked by || echo/|| true in '{name}'"
+                        )
+
+            env_block = step.get("env", {})
+            uses = step.get("uses", "")
+            is_build = isinstance(run, str) and any(
+                kw in run for kw in ["cargo build", "npm run build", "wasm-pack build"]
+            )
+            is_publish = isinstance(run, str) and "publish" in run.lower()
+            if is_build and not is_publish:
+                token_keys = [k for k in env_block if "token" in k.lower() or "key" in k.lower()]
+                if token_keys:
+                    errors.append(
+                        f"{path.name}:{job_name}/step[{i}]: "
+                        f"secret env ({', '.join(token_keys)}) exposed during build step '{name}'"
+                    )
+
+    return errors
+
+
+def main():
+    workflows_dir = Path(".github/workflows")
+    if not workflows_dir.exists():
+        print("No .github/workflows directory found")
+        sys.exit(0)
+
+    all_errors = []
+    for wf in sorted(workflows_dir.glob("*.yml")):
+        all_errors.extend(lint_release_security(wf))
+    for wf in sorted(workflows_dir.glob("*.yaml")):
+        all_errors.extend(lint_release_security(wf))
+
+    if all_errors:
+        print("Release security lint FAILURES:")
+        for e in all_errors:
+            print(f"  - {e}")
+        sys.exit(1)
+    else:
+        print("All release security lints passed")
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/lint_release_workflows.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Lint release workflows for security best practices."""
+import sys
+from pathlib import Path
+
+try:
+    import yaml
+except ImportError:
+    print("PyYAML is required: pip install pyyaml")
+    sys.exit(1)
+
+
+def lint_workflow(path):
+    errors = []
+    try:
+        with open(path) as f:
+            wf = yaml.safe_load(f)
+    except Exception as e:
+        return [f"{path.name}: failed to parse YAML: {e}"]
+
+    if wf is None:
+        return []
+
+    for job_name, job in wf.get("jobs", {}).items():
+        steps = job.get("steps", [])
+        for i, step in enumerate(steps):
+            run = step.get("run", "")
+            name = step.get("name", step.get("uses", "unnamed"))
+
+            if step.get("continue-on-error"):
+                run_lower = str(run).lower()
+                name_lower = str(name).lower()
+                if "publish" in name_lower or "publish" in run_lower:
+                    errors.append(
+                        f"{path.name}:{job_name}/step[{i}]: "
+                        f"continue-on-error on publish step '{name}'"
+                    )
+
+            if isinstance(run, str) and "curl" in run:
+                piped = run.split("|")[-1].strip() if "|" in run else ""
+                if piped.endswith("sh") or "sops" in run:
+                    if "sha256" not in run.lower() and "checksum" not in run.lower():
+                        errors.append(
+                            f"{path.name}:{job_name}/step[{i}]: "
+                            f"curl download without checksum verification"
+                        )
+
+            if isinstance(run, str) and "npm install" in run:
+                if "--frozen" not in run and "npm ci" not in run:
+                    if "release" in path.name:
+                        errors.append(
+                            f"{path.name}:{job_name}/step[{i}]: "
+                            f"unfrozen npm install in release workflow"
+                        )
+
+    return errors
+
+
+def main():
+    workflows_dir = Path(".github/workflows")
+    if not workflows_dir.exists():
+        print("No .github/workflows directory found")
+        sys.exit(0)
+
+    all_errors = []
+    for wf in sorted(workflows_dir.glob("*.yml")):
+        all_errors.extend(lint_workflow(wf))
+    for wf in sorted(workflows_dir.glob("*.yaml")):
+        all_errors.extend(lint_workflow(wf))
+
+    if all_errors:
+        print("Release workflow lint FAILURES:")
+        for e in all_errors:
+            print(f"  - {e}")
+        sys.exit(1)
+    else:
+        print("All release workflow lints passed")
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()