redlinegate 0.0.1

package/workflows/verify-onboarding.yml

@@ -0,0 +1,115 @@
+# Lives in the Redline source repo. Re-verifies every onboarded repo on a schedule and
+# opens one tracking issue when any of them has drifted — a ruleset edited by hand, a
+# renamed caller job, push protection switched off, artifacts left stale by an ignored
+# sync pull request.
+#
+# Drift is silent by nature: a repository whose gate stopped publishing looks exactly
+# like one whose gate is green and quiet. This loop is what makes the difference visible
+# without anyone going to look.
+#
+# Targets come from registry.json — the same derived register sync uses. A check that
+# genuinely needs a working tree reports `??` rather than passing, so a repository is
+# never reported healthy on the strength of a check that did not run.
+name: Redline Verify Onboarding
+
+on:
+  schedule:
+    - cron: '0 6 * * 2'
+  workflow_dispatch:
+    inputs:
+      only:
+        description: Verify a single repo, as owner/name
+        type: string
+        required: false
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: redline-verify-onboarding
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install
+        run: npm ci
+
+      - name: Build CLI
+        run: npm run build
+
+      - name: Verify every registered repository
+        id: verify
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
+          ONLY: ${{ inputs.only }}
+        run: |
+          set -uo pipefail
+          if [ ! -f registry.json ]; then
+            echo "::error::registry.json is missing — the register has not been derived yet."
+            exit 1
+          fi
+
+          if [ -n "$ONLY" ]; then
+            repos="$ONLY"
+          else
+            # String concatenation rather than a template literal: `${...}` inside
+            # single quotes is ambiguous to a reader and to shellcheck, which
+            # cannot know the braces are JavaScript's. Avoiding the construct
+            # beats suppressing the warning about it.
+            repos=$(node -e 'const r=require("./registry.json");for(const e of r.entries)if(e.host==="github")console.log(e.org+"/"+e.repo)')
+          fi
+
+          : > drift.txt
+          # `set -e` is deliberately NOT on for this loop: a drifted repository
+          # exits non-zero by design, and aborting on the first one would leave
+          # the rest of the estate unverified every week.
+          while read -r repo; do
+            [ -z "$repo" ] && continue
+            echo "--- $repo"
+            if ! node dist/bin/redline.js verify --repo "$repo" 2>&1 | tee /tmp/out.txt; then
+              {
+                echo "### $repo"
+                echo '```'
+                grep -E '^(FAIL|  \?\?)' /tmp/out.txt || cat /tmp/out.txt
+                echo '```'
+              } >> drift.txt
+            fi
+          done <<< "$repos"
+
+          if [ -s drift.txt ]; then
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "drift=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Open or update the drift issue
+        if: steps.verify.outputs.drift == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TITLE: 'Redline: onboarded repositories have drifted'
+        run: |
+          set -euo pipefail
+          # One issue, updated in place. A new issue per run turns a standing
+          # problem into a backlog nobody reads.
+          body=$(cat drift.txt)
+          existing=$(gh issue list --state open --search "$TITLE in:title" --json number --jq '.[0].number // empty')
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "$body"
+          else
+            gh issue create --title "$TITLE" --body "$body"
+          fi
+
+      - name: Summarise
+        if: always()
+        run: |
+          if [ -s drift.txt ]; then cat drift.txt >> "$GITHUB_STEP_SUMMARY";
+          else echo "No drift detected." >> "$GITHUB_STEP_SUMMARY"; fi

package/workflows/weekly-digest.yml

@@ -0,0 +1,78 @@
+# Lives in the redline-metrics repo. Monday-morning stakeholder digest.
+#
+# TEAMS_WEBHOOK_URL must point at a Power Automate "When a Teams webhook request is
+# received" flow. The old Office 365 connector webhooks (the `{"text": "..."}` shape)
+# were retired by Microsoft and silently stop delivering.
+name: Redline Weekly Digest
+
+on:
+  schedule:
+    - cron: '0 7 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  digest:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Count open and stale PRs
+        id: prs
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
+          ORG: ${{ github.repository_owner }}
+        run: |
+          set -euo pipefail
+          cutoff=$(date -u -d '7 days ago' +%Y-%m-%d)
+
+          # gh search caps at 1000 results; --json + jq length would silently truncate.
+          # total_count from the REST search endpoint is exact.
+          count() {
+            gh api -X GET search/issues -f q="$1" -f per_page=1 --jq '.total_count'
+          }
+          open_prs=$(count "org:$ORG is:pr is:open draft:false")
+          stale_prs=$(count "org:$ORG is:pr is:open draft:false updated:<$cutoff")
+
+          echo "open=$open_prs"  >> "$GITHUB_OUTPUT"
+          echo "stale=$stale_prs" >> "$GITHUB_OUTPUT"
+
+      - name: Build Adaptive Card
+        run: |
+          npx --yes "redlinegate@0.0.1" metrics digest \
+            --org "${{ github.repository_owner }}" \
+            --days 7 \
+            --open-prs "${{ steps.prs.outputs.open }}" \
+            --stale-prs "${{ steps.prs.outputs.stale }}" \
+            --seed-scores data/seed-scores.jsonl \
+            --dashboard-url "${{ vars.REDLINE_DASHBOARD_URL }}" \
+            --out digest.json
+
+      - name: Post to Teams
+        env:
+          WEBHOOK: ${{ secrets.TEAMS_WEBHOOK_URL }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${WEBHOOK:-}" ]]; then
+            echo "::error::TEAMS_WEBHOOK_URL is not set — digest built but not delivered."
+            exit 1
+          fi
+          curl -sS --fail-with-body -X POST \
+            -H 'Content-Type: application/json' \
+            --data @digest.json "$WEBHOOK"
+
+      - name: Attach digest to the run
+        if: always()
+        run: |
+          {
+            echo '### Digest payload'
+            echo '```json'
+            cat digest.json 2>/dev/null || echo '{}'
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"