javi-forge 0.1.0

package/workflows/reusable-build-python.yml

@@ -0,0 +1,159 @@
+# ===========================================
+# Reusable Workflow: Python Build
+# ===========================================
+# Minimal CI for Python projects.
+#
+# Usage:
+#   jobs:
+#     build:
+#       uses: JNZader/project-starter-framework/.github/workflows/reusable-build-python.yml@main
+#       with:
+#         python-version: '3.12'
+# ===========================================
+
+name: Python Build (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        description: 'Python version'
+        required: false
+        default: '3.12'
+        type: string
+      package-manager:
+        description: 'Package manager (pip, poetry, uv)'
+        required: false
+        default: 'pip'
+        type: string
+      run-tests:
+        description: 'Run tests'
+        required: false
+        default: true
+        type: boolean
+      run-lint:
+        description: 'Run linting (ruff)'
+        required: false
+        default: true
+        type: boolean
+      working-directory:
+        description: 'Working directory'
+        required: false
+        default: '.'
+        type: string
+      lint-fail-on-error:
+        description: 'Fail the build if linting fails'
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python ${{ inputs.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ inputs.python-version }}
+          cache: ${{ inputs.package-manager == 'poetry' && 'poetry' || inputs.package-manager == 'pip' && 'pip' || '' }}
+          cache-dependency-path: |
+            **/requirements*.txt
+            **/pyproject.toml
+            **/poetry.lock
+
+      - name: Install uv
+        if: inputs.package-manager == 'uv'
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install Poetry
+        if: inputs.package-manager == 'poetry'
+        uses: snok/install-poetry@v1
+
+      - name: Install dependencies (pip)
+        if: inputs.package-manager == 'pip'
+        run: |
+          python -m pip install --upgrade pip
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt; fi
+
+      - name: Install dependencies (poetry)
+        if: inputs.package-manager == 'poetry'
+        run: poetry install
+
+      - name: Install dependencies (uv)
+        if: inputs.package-manager == 'uv'
+        run: uv sync
+
+      - name: Install dev tools
+        if: inputs.package-manager == 'pip'
+        run: pip install --quiet ruff mypy pytest
+
+      - name: Install dev tools (poetry)
+        if: inputs.package-manager == 'poetry'
+        run: poetry run pip install --quiet ruff mypy pytest
+
+      - name: Install dev tools (uv)
+        if: inputs.package-manager == 'uv'
+        run: uv pip install --quiet ruff mypy pytest
+
+      - name: Lint (ruff)
+        if: inputs.run-lint
+        continue-on-error: ${{ !inputs.lint-fail-on-error }}
+        env:
+          PKG_MGR: ${{ inputs.package-manager }}
+        run: |
+          if [ "$PKG_MGR" = "uv" ]; then
+            uv run ruff check .
+          else
+            ruff check .
+          fi
+
+      - name: Type check
+        if: hashFiles('mypy.ini') != '' || hashFiles('setup.cfg') != '' || hashFiles('pyproject.toml') != ''
+        continue-on-error: true
+        env:
+          PKG_MGR: ${{ inputs.package-manager }}
+        run: |
+          if [ "$PKG_MGR" = "uv" ]; then
+            uv run mypy . --ignore-missing-imports
+          else
+            mypy . --ignore-missing-imports
+          fi
+
+      - name: Test
+        if: inputs.run-tests
+        env:
+          PKG_MGR: ${{ inputs.package-manager }}
+        run: |
+          if [ "$PKG_MGR" = "poetry" ]; then
+            poetry run pytest
+          elif [ "$PKG_MGR" = "uv" ]; then
+            uv run pytest
+          else
+            pytest
+          fi
+
+      - name: Upload test results
+        if: inputs.run-tests && always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-python
+          path: |
+            htmlcov/
+            .coverage
+            junit.xml
+            test-results/
+          retention-days: 7
+          if-no-files-found: ignore

package/workflows/reusable-build-rust.yml

@@ -0,0 +1,135 @@
+# ===========================================
+# Reusable Workflow: Rust Build
+# ===========================================
+# Minimal CI for Rust projects.
+#
+# Usage:
+#   jobs:
+#     build:
+#       uses: JNZader/project-starter-framework/.github/workflows/reusable-build-rust.yml@main
+# ===========================================
+
+name: Rust Build (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      toolchain:
+        description: 'Rust toolchain (stable, beta, nightly)'
+        required: false
+        default: 'stable'
+        type: string
+      run-tests:
+        description: 'Run tests'
+        required: false
+        default: true
+        type: boolean
+      run-clippy:
+        description: 'Run clippy linter'
+        required: false
+        default: true
+        type: boolean
+      run-fmt:
+        description: 'Check formatting'
+        required: false
+        default: true
+        type: boolean
+      working-directory:
+        description: 'Working directory'
+        required: false
+        default: '.'
+        type: string
+      cargo-args:
+        description: 'Additional cargo arguments'
+        required: false
+        default: ''
+        type: string
+      lint-fail-on-error:
+        description: 'Fail the build if linting fails'
+        required: false
+        default: true
+        type: boolean
+      upload-binary:
+        description: 'Upload release binary as artifact'
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate inputs
+        env:
+          ARGS: ${{ inputs.cargo-args }}
+        run: |
+          if echo "$ARGS" | grep -qE '[;|&$`(){}<>'"'"'"]'; then
+            echo "::error::Invalid characters in input arguments. Shell metacharacters are not allowed."
+            exit 1
+          fi
+
+      - name: Setup Rust ${{ inputs.toolchain }}
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master 2024-12
+        with:
+          toolchain: ${{ inputs.toolchain }}
+          components: clippy, rustfmt
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
+        with:
+          workspaces: ${{ inputs.working-directory }}
+
+      - name: Check formatting
+        if: inputs.run-fmt
+        run: cargo fmt --all -- --check
+
+      - name: Build
+        env:
+          CARGO_ARGS: ${{ inputs.cargo-args }}
+        run: cargo build --release $CARGO_ARGS
+
+      - name: Clippy
+        if: inputs.run-clippy
+        continue-on-error: ${{ !inputs.lint-fail-on-error }}
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Test
+        if: inputs.run-tests
+        env:
+          CARGO_ARGS: ${{ inputs.cargo-args }}
+        run: cargo test --all-features $CARGO_ARGS
+
+      - name: Build release binary
+        if: inputs.upload-binary
+        env:
+          CARGO_ARGS: ${{ inputs.cargo-args }}
+        run: cargo build --release $CARGO_ARGS
+
+      - name: Upload binary
+        if: inputs.upload-binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-binary
+          path: |
+            ${{ inputs.working-directory }}/target/release/*
+            !${{ inputs.working-directory }}/target/release/.fingerprint
+            !${{ inputs.working-directory }}/target/release/build
+            !${{ inputs.working-directory }}/target/release/deps
+            !${{ inputs.working-directory }}/target/release/examples
+            !${{ inputs.working-directory }}/target/release/incremental
+            !${{ inputs.working-directory }}/target/release/.cargo-lock
+            !${{ inputs.working-directory }}/target/release/*.d
+          retention-days: 7
+          if-no-files-found: ignore

package/workflows/reusable-docker.yml

@@ -0,0 +1,120 @@
+# ===========================================
+# Reusable Workflow: Docker Build & Push
+# ===========================================
+# Build and push to GitHub Container Registry.
+#
+# Usage:
+#   jobs:
+#     docker:
+#       uses: JNZader/project-starter-framework/.github/workflows/reusable-docker.yml@main
+#       with:
+#         dockerfile: './Dockerfile'
+# ===========================================
+
+name: Docker (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      dockerfile:
+        description: 'Path to Dockerfile'
+        required: false
+        default: './Dockerfile'
+        type: string
+      context:
+        description: 'Docker build context'
+        required: false
+        default: '.'
+        type: string
+      image-name:
+        description: 'Image name (defaults to repo name)'
+        required: false
+        default: ''
+        type: string
+      platforms:
+        description: 'Target platforms'
+        required: false
+        default: 'linux/amd64'
+        type: string
+      push:
+        description: 'Push to registry'
+        required: false
+        default: true
+        type: boolean
+      build-args:
+        description: 'Docker build arguments'
+        required: false
+        default: ''
+        type: string
+
+jobs:
+  docker:
+    name: Docker
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate inputs
+        env:
+          BUILD_ARGS: ${{ inputs.build-args }}
+        run: |
+          if [ -n "$BUILD_ARGS" ] && echo "$BUILD_ARGS" | grep -qE '[;|&$`(){}<>]'; then
+            echo "::error::Invalid characters in build-args input."
+            exit 1
+          fi
+
+      - name: Set image name
+        id: image
+        env:
+          INPUT_IMAGE_NAME: ${{ inputs.image-name }}
+        run: |
+          if [ -n "$INPUT_IMAGE_NAME" ]; then
+            echo "name=$INPUT_IMAGE_NAME" >> "$GITHUB_OUTPUT"
+          else
+            echo "name=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup QEMU
+        if: contains(inputs.platforms, ',')
+        uses: docker/setup-qemu-action@v3
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        if: inputs.push
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.image.outputs.name }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ inputs.context }}
+          file: ${{ inputs.dockerfile }}
+          platforms: ${{ inputs.platforms }}
+          push: ${{ inputs.push }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: ${{ inputs.build-args }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

package/workflows/reusable-ghagga-review.yml

@@ -0,0 +1,165 @@
+# ===========================================
+# Reusable Workflow: GHAGGA AI Code Review
+# ===========================================
+# Triggers AI-powered code review on PRs using GHAGGA.
+#
+# Usage:
+#   jobs:
+#     review:
+#       uses: JNZader/project-starter-framework/.github/workflows/reusable-ghagga-review.yml@main
+#       with:
+#         ghagga-url: ${{ vars.GHAGGA_URL }}
+#       secrets:
+#         ghagga-token: ${{ secrets.GHAGGA_TOKEN }}
+# ===========================================
+
+name: GHAGGA Review (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      ghagga-url:
+        description: 'URL of GHAGGA instance (Supabase Edge Function)'
+        required: true
+        type: string
+      review-mode:
+        description: 'Review mode: simple, workflow, or consensus'
+        required: false
+        default: 'simple'
+        type: string
+      skip-draft:
+        description: 'Skip review on draft PRs'
+        required: false
+        default: true
+        type: boolean
+      file-patterns:
+        description: 'Glob patterns to include (comma-separated, e.g. "src/**,lib/**")'
+        required: false
+        default: '**'
+        type: string
+      exclude-patterns:
+        description: 'Glob patterns to exclude (comma-separated)'
+        required: false
+        default: '**/*.md,**/*.txt,**/package-lock.json,**/yarn.lock,**/pnpm-lock.yaml'
+        type: string
+    secrets:
+      ghagga-token:
+        description: 'Authentication token for GHAGGA API'
+        required: true
+
+jobs:
+  review:
+    name: AI Code Review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+
+    # Skip draft PRs if configured
+    if: ${{ !inputs.skip-draft || !github.event.pull_request.draft }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get PR diff
+        id: diff
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Get changed files
+          CHANGED_FILES=$(gh pr diff "$PR_NUMBER" --name-only)
+          DELIMITER_FILES=$(openssl rand -hex 16)
+          echo "changed_files<<$DELIMITER_FILES" >> "$GITHUB_OUTPUT"
+          echo "$CHANGED_FILES" >> "$GITHUB_OUTPUT"
+          echo "$DELIMITER_FILES" >> "$GITHUB_OUTPUT"
+
+          # Get diff content
+          DIFF=$(gh pr diff "$PR_NUMBER")
+          # Truncate if too large (max 100KB)
+          if [ ${#DIFF} -gt 102400 ]; then
+            DIFF="${DIFF:0:102400}... [truncated]"
+          fi
+          DELIMITER_DIFF=$(openssl rand -hex 16)
+          echo "diff<<$DELIMITER_DIFF" >> "$GITHUB_OUTPUT"
+          echo "$DIFF" >> "$GITHUB_OUTPUT"
+          echo "$DELIMITER_DIFF" >> "$GITHUB_OUTPUT"
+
+      - name: Trigger GHAGGA review
+        id: review
+        env:
+          GHAGGA_URL: ${{ inputs.ghagga-url }}
+          GHAGGA_TOKEN: ${{ secrets.ghagga-token }}
+          PR_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          REVIEW_MODE: ${{ inputs.review-mode }}
+          FILE_PATTERNS: ${{ inputs.file-patterns }}
+          EXCLUDE_PATTERNS: ${{ inputs.exclude-patterns }}
+        run: |
+          RESPONSE=""
+          for attempt in 1 2 3; do
+            RESPONSE=$(curl -fsSL \
+              -X POST "${GHAGGA_URL}/functions/v1/review" \
+              -H "Authorization: Bearer ${GHAGGA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "$(jq -n \
+                --arg repo "$PR_REPO" \
+                --argjson number "$PR_NUMBER" \
+                --arg head_sha "$PR_HEAD_SHA" \
+                --arg base "$PR_BASE_REF" \
+                --arg head "$PR_HEAD_REF" \
+                --arg title "$PR_TITLE" \
+                --arg mode "$REVIEW_MODE" \
+                --arg patterns "$FILE_PATTERNS" \
+                --arg exclude "$EXCLUDE_PATTERNS" \
+                '{repository: $repo, pull_request_number: $number, head_sha: $head_sha, base_branch: $base, head_branch: $head, title: $title, review_mode: $mode, file_patterns: $patterns, exclude_patterns: $exclude}')") && break
+            echo "::warning::GHAGGA API attempt $attempt failed, retrying..."
+            sleep $((attempt * 5))
+          done
+
+          DELIMITER_RESP=$(openssl rand -hex 16)
+          echo "response<<$DELIMITER_RESP" >> "$GITHUB_OUTPUT"
+          echo "$RESPONSE" >> "$GITHUB_OUTPUT"
+          echo "$DELIMITER_RESP" >> "$GITHUB_OUTPUT"
+
+          # Check if review was successful
+          STATUS=$(echo "$RESPONSE" | jq -r '.status // "error"')
+          if [ "$STATUS" = "error" ]; then
+            echo "::warning::GHAGGA review returned an error"
+            echo "$RESPONSE" | jq -r '.message // "Unknown error"'
+          else
+            echo "Review triggered successfully"
+          fi
+
+      - name: Post review summary
+        if: always()
+        uses: actions/github-script@v7
+        env:
+          REVIEW_RESPONSE: ${{ steps.review.outputs.response }}
+        with:
+          script: |
+            const response = process.env.REVIEW_RESPONSE;
+            let parsed;
+            try {
+              parsed = JSON.parse(response);
+            } catch {
+              console.log('Could not parse GHAGGA response');
+              return;
+            }
+
+            if (parsed.status === 'completed' && parsed.summary) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: `### GHAGGA AI Review\n\n${parsed.summary}\n\n---\n*Review mode: ${parsed.review_mode || 'simple'}*`
+              });
+            }

package/workflows/reusable-release.yml

@@ -0,0 +1,91 @@
+# ===========================================
+# Reusable Workflow: Semantic Release
+# ===========================================
+# Automatic versioning based on conventional commits.
+#
+# Usage:
+#   jobs:
+#     release:
+#       uses: JNZader/project-starter-framework/.github/workflows/reusable-release.yml@main
+#       secrets:
+#         token: ${{ secrets.GITHUB_TOKEN }}
+# ===========================================
+
+name: Release (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      dry-run:
+        description: 'Dry run'
+        required: false
+        default: false
+        type: boolean
+      node-version:
+        description: 'Node.js version'
+        required: false
+        default: '22'
+        type: string
+    secrets:
+      token:
+        description: 'GitHub token with contents:write permission'
+        required: true
+      npm-token:
+        description: 'NPM token for package publishing (optional)'
+        required: false
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version }}
+          cache: 'npm'
+
+      - name: Cache semantic-release
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: semantic-release-${{ runner.os }}-${{ hashFiles('.releaserc*') }}
+          restore-keys: semantic-release-${{ runner.os }}-
+
+      - name: Install semantic-release
+        run: |
+          npm install -g semantic-release \
+            @semantic-release/commit-analyzer \
+            @semantic-release/release-notes-generator \
+            @semantic-release/changelog \
+            @semantic-release/git \
+            @semantic-release/github \
+            conventional-changelog-conventionalcommits
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.token }}
+          NPM_TOKEN: ${{ secrets.npm-token }}
+          DRY_RUN: ${{ inputs.dry-run }}
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+        run: |
+          if [ "$DRY_RUN" == "true" ]; then
+            npx semantic-release --dry-run
+          else
+            npx semantic-release
+          fi