pipecraft 0.47.0 → 0.47.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/templates/workflows/enforce-pr-target.yml.tpl.d.ts.map +1 -1
  2. package/dist/templates/workflows/enforce-pr-target.yml.tpl.js +21 -4
  3. package/dist/templates/workflows/enforce-pr-target.yml.tpl.js.map +1 -1
  4. package/package.json +1 -1
package/dist/templates/workflows/enforce-pr-target.yml.tpl.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"enforce-pr-target.yml.tpl.d.ts","sourceRoot":"","sources":["../../../src/templates/workflows/enforce-pr-target.yml.tpl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,KAAK,aAAa,EAA0B,MAAM,uBAAuB,CAAA;AAMlF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,4CAA4C,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,aAAa,iBAgFxC,CAAA"}
1
+ {"version":3,"file":"enforce-pr-target.yml.tpl.d.ts","sourceRoot":"","sources":["../../../src/templates/workflows/enforce-pr-target.yml.tpl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,KAAK,aAAa,EAA0B,MAAM,uBAAuB,CAAA;AAMlF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,4CAA4C,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,aAAa,iBAiGxC,CAAA"}
package/dist/templates/workflows/enforce-pr-target.yml.tpl.js CHANGED
@@ -71,13 +71,20 @@ export const generate = (ctx) => Promise.resolve(ctx).then(renderTemplate((ctx)
71
71
  if (initialBranch === finalBranch) {
72
72
  return `${ENFORCE_HEADER}name: Enforce PR Target Branch
73
73
 
74
+ # pull_request_target for the same reason as the multi-branch form below: a pull_request run
75
+ # from a first-time contributor waits for approval, and this workflow exists to report the
76
+ # 'check-pr-target' status a branch protection rule may require. Gated behind approval, that
77
+ # status never arrives and the contributor's PR can never merge. This job checks out nothing
78
+ # and 'permissions: {}' leaves it no token.
74
79
  on:
75
- pull_request:
80
+ pull_request_target:
76
81
  types: [opened, edited, synchronize, reopened]
77
82
  # Single-branch flow: '${finalBranch}' is the only branch, so it is the only valid target.
78
83
  branches:
79
84
  - ${finalBranch}
80
85
 
86
+ permissions: {}
87
+
81
88
  jobs:
82
89
  check-pr-target:
83
90
  runs-on: ubuntu-latest
@@ -90,16 +97,26 @@ jobs:
90
97
  }
91
98
  return `${ENFORCE_HEADER}name: Enforce PR Target Branch
92
99
 
100
+ # pull_request_target, not pull_request. GitHub's approval gate applies to pull_request runs
101
+ # from a first-time contributor, and 'github-actions[bot]' is one, so the last promotion hop
102
+ # (the only one whose base is '${finalBranch}') opened an approval-gated run that nobody
103
+ # approves. It expired and reported a failure against every release. pull_request_target runs
104
+ # in the base repository's context and carries no such gate.
105
+ #
106
+ # The usual hazard of pull_request_target is running a fork's code with a write token. This
107
+ # job checks out nothing and runs nothing from the pull request; it reads two ref names and
108
+ # echoes. 'permissions: {}' removes the token as well, so there is nothing left to misuse.
93
109
  on:
94
- pull_request:
110
+ pull_request_target:
95
111
  types: [opened, edited, synchronize, reopened]
96
112
  # Only PRs targeting the final branch matter here (the rule rejects human PRs to it).
97
113
  # Scoping the trigger keeps PipeCraft's own promotion PRs to intermediate branches from
98
- # spawning approval-gated runs at all; the job-level guard below covers promotion PRs
99
- # that do target the final branch.
114
+ # spawning runs at all; the job-level guard below covers the hop that does target it.
100
115
  branches:
101
116
  - ${finalBranch}
102
117
 
118
+ permissions: {}
119
+
103
120
  jobs:
104
121
  check-pr-target:
105
122
  # Skip PipeCraft's own promotion PRs (pipecraft-promote/*). They legitimately target
package/dist/templates/workflows/enforce-pr-target.yml.tpl.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"enforce-pr-target.yml.tpl.js","sourceRoot":"","sources":["../../../src/templates/workflows/enforce-pr-target.yml.tpl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAsB,cAAc,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAElF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAErE,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,yCAAyC,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAkB,EAAE,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CACvB,cAAc,CACZ,CAAC,GAAQ,EAAE,EAAE;IACX,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,WAAW,GAAG,MAAM,EAAE,GAAG,GAAG,CAAA;IAE/D,qFAAqF;IACrF,qFAAqF;IACrF,kEAAkE;IAClE,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,GAAG,cAAc;;;;;6BAKL,WAAW;;UAE9B,WAAW;;;;;;;;0CAQqB,aAAa;uCAChB,aAAa;CACnD,CAAA;IACO,CAAC;IAED,OAAO,GAAG,cAAc;;;;;;;;;;UAUtB,WAAW;;;;;;;;;;kCAUa,WAAW;;sDAES,aAAa,kBAAkB,WAAW;6DACnC,aAAa;;;;;8CAK5B,WAAW,SAAS,aAAa;;;;kCAI7C,aAAa;;0CAEL,aAAa;CACtD,CAAA;AACK,CAAC,EACD,MAAM,CAAC,sBAAsB,CAAC;AAC9B,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,+EAA+E;AAC/E,sCAAsC;AACtC,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CACF,CAAA"}
1
+ {"version":3,"file":"enforce-pr-target.yml.tpl.js","sourceRoot":"","sources":["../../../src/templates/workflows/enforce-pr-target.yml.tpl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAsB,cAAc,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAElF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAErE,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,yCAAyC,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAkB,EAAE,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CACvB,cAAc,CACZ,CAAC,GAAQ,EAAE,EAAE;IACX,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,WAAW,GAAG,MAAM,EAAE,GAAG,GAAG,CAAA;IAE/D,qFAAqF;IACrF,qFAAqF;IACrF,kEAAkE;IAClE,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,GAAG,cAAc;;;;;;;;;;6BAUL,WAAW;;UAE9B,WAAW;;;;;;;;;;0CAUqB,aAAa;uCAChB,aAAa;CACnD,CAAA;IACO,CAAC;IAED,OAAO,GAAG,cAAc;;;;iCAIC,WAAW;;;;;;;;;;;;;;UAclC,WAAW;;;;;;;;;;;;kCAYa,WAAW;;sDAES,aAAa,kBAAkB,WAAW;6DACnC,aAAa;;;;;8CAK5B,WAAW,SAAS,aAAa;;;;kCAI7C,aAAa;;0CAEL,aAAa;CACtD,CAAA;AACK,CAAC,EACD,MAAM,CAAC,sBAAsB,CAAC;AAC9B,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,+EAA+E;AAC/E,sCAAsC;AACtC,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CACF,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pipecraft",
3
- "version": "0.47.0",
3
+ "version": "0.47.2",
4
4
  "description": "Automated CI/CD pipeline generator for trunk-based development. Generates intelligent GitHub Actions workflows with domain-based change detection, semantic versioning, and branch flow management. Full documentation: https://pipecraft.thecraftlab.dev",
5
5
  "license": "MIT",
6
6
  "type": "module",