mandrel-platform 0.12.0 → 0.14.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (27) hide show
  1. package/README.md +203 -7
  2. package/config/dependency-cruiser.base.json +121 -0
  3. package/config/edge-security/allowlist.mjs +138 -0
  4. package/config/edge-security/cors-astro.mjs +131 -0
  5. package/config/edge-security/cors-hono.mjs +111 -0
  6. package/config/edge-security/index.mjs +34 -0
  7. package/config/edge-security/rate-limit.mjs +219 -0
  8. package/config/edge-security/security-headers.mjs +148 -0
  9. package/config/knip.base.json +7 -0
  10. package/config/lighthouse.base.json +27 -0
  11. package/config/size-limit.base.json +6 -0
  12. package/config/stryker.base.json +15 -0
  13. package/package.json +23 -2
  14. package/scripts/check-action-pins.mjs +344 -0
  15. package/scripts/check-action-pins.test.mjs +240 -0
  16. package/scripts/check-coverage-threshold.mjs +300 -0
  17. package/scripts/check-coverage-threshold.test.mjs +350 -0
  18. package/scripts/check-destructive-migration.mjs +313 -0
  19. package/scripts/check-destructive-migration.test.mjs +183 -0
  20. package/scripts/check-pin-drift.mjs +361 -17
  21. package/scripts/check-pin-drift.test.mjs +344 -1
  22. package/scripts/edge-security.test.mjs +300 -0
  23. package/scripts/pin-drift-consumers.json +2 -0
  24. package/scripts/platform-repair.mjs +748 -0
  25. package/scripts/platform-repair.test.mjs +458 -0
  26. package/scripts/platform-sync.mjs +0 -0
  27. package/scripts/platform-sync.test.mjs +0 -0
package/scripts/pin-drift-consumers.json CHANGED
@@ -1,6 +1,8 @@
1
1
  {
2
2
  "$comment": "Data-driven consumer registry for scripts/check-pin-drift.mjs (Story #67, MP-12). Each entry is one downstream repo that pins mandrel-platform reusable workflows / composite actions via `uses: dsj1984/mandrel-platform/...@<sha>`. Adding a new consumer is a single object here — the drift checker enumerates `.github/workflows/*` and reads `package.json` in each repo over the GitHub API, extracts every mandrel-platform `uses:` pin plus the `mandrel-platform` npm dependency version, and asserts a single SHA per consumer plus lag (and surface skew between the workflow and npm surfaces) vs the latest mandrel-platform release. `branch` is optional (defaults to the repo's default branch).",
3
+ "$comment_minimumReleaseAge": "Renovate supply-chain hold window (Story #107). For this many time after a platform release, EVERY consumer legitimately lags the new tag because Renovate has not raised the bump PR yet. The checker suppresses lag/skew that is fully explained by this hold (reported as `holding`, not drift) so a fresh release does not page on every consumer. Keep this in lockstep with `minimumReleaseAge` in the shared Renovate preset (default.json) — currently `3 days`. A split pin is a real error and is NEVER suppressed by the hold.",
3
4
  "platformRepo": "dsj1984/mandrel-platform",
5
+ "minimumReleaseAge": "3 days",
4
6
  "consumers": [
5
7
  {
6
8
  "name": "domio",