techbro 0.0.0-stage → 0.5.0

package/README.md

@@ -1,3 +1,454 @@
-# Temporary Holding Version
+# techbro
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+techbro is a CLI companion for programmers who build with AI assistance ("vibe
+coding"). It helps AI-assisted code meet the team's standards, much like a
+programmer's review would, and keeps the team's conventions in one shared place.
+Zero runtime dependencies; plain ESM JavaScript.
+
+## Vision and current scope
+
+The goal is broader than reviews: help a programmer start projects the team's
+way, align coding style with the tech team, review work against team standards,
+and eventually push and deploy code safely.
+
+Implemented today:
+
+- Scaffold projects from the company template library (`.project_templates/` in
+  this repository): `project init`, `project list`.
+- Keep shared team state (members and linked projects) in a GitHub repository:
+  `team create|join|list|use|upgrade`, `project link`.
+- Dispatch a team-hosted review workflow for a registered project:
+  `project review`.
+
+- Generate manifests, build in-cluster, deploy, and operate Kubernetes apps with
+  explicit cluster/namespace targets: `kube cluster list|add|use`,
+  `kube check|status|logs|rollout-status|restart|rollback`,
+  `kube generate|build|deploy`. Build and deploy are separate, need `--yes`, and
+  were validated end to end on one internal cluster only; there is no built-in
+  cluster, so set one up first. See the limits in
+  [docs/kubernetes.md](docs/kubernetes.md).
+- Share a cluster with the team: the owner runs `cluster add` once and the
+  credential is stored encrypted (with `TECHBRO_PASSPHRASE`) in the team repo;
+  members run `cluster use`. Validated live once.
+- Check local setup and missing config or secrets: `doctor [--online]`.
+
+Planned, not implemented (no commands exist yet): pushing code through techbro
+and automatically aligning code style with team conventions.
+Do not rely on these until they appear in the command reference below.
+
+For a step-by-step walkthrough from install to first review, see
+[docs/onboarding.md](docs/onboarding.md). Upgrading from an older version: see
+[docs/upgrading.md](docs/upgrading.md).
+
+## Requirements
+
+- Node 20 or newer and npm.
+- git (for `project init` repository setup and `project link` origin detection).
+- Rust toolchain (`cargo`, https://rustup.rs) for the setup step of `project init`.
+- `gh` (logged in) or a `GITHUB_TOKEN` for `team` and `project link` commands.
+
+## Install
+
+The repository is private, so the installer must be fetched with a GitHub token.
+Run `gh auth login` once, then:
+
+```bash
+curl -fsSL -H "Authorization: Bearer $(gh auth token)" \
+  https://raw.githubusercontent.com/mtel-thailand/techbro/main/install.sh | bash
+techbro --version
+```
+
+Without `gh`, use `-H "Authorization: Bearer $GITHUB_TOKEN"` with a token that has
+`repo` scope. An anonymous `curl` returns 404.
+
+The installer downloads this repository from GitHub, bundles the templates, and runs
+`npm install -g`. Running it again reinstalls the latest version and prints
+`updated <old> -> <new>`.
+
+| Variable | Default | Effect |
+| --- | --- | --- |
+| `TECHBRO_SOURCE` | `github` | `github` or `npm` (install `techbro@latest` from the registry) |
+| `TECHBRO_REF` | `main` | git ref to download (github source) |
+| `TECHBRO_REPO` | `mtel-thailand/techbro` | `owner/name` to download |
+| `GITHUB_TOKEN` | `gh auth token` | token for the download |
+
+Uninstall: `npm uninstall -g techbro`. Once published to npm,
+`npx techbro@latest project init my-app` works without installing.
+
+## Quick start
+
+```bash
+# 1. create a team (once per team; needs push access to the GitHub repo)
+techbro team create core --url https://github.com/<owner>/<team-repo>
+
+# 2. scaffold a project
+techbro project init my-app
+cd my-app
+
+# 3. push my-app to its own GitHub repo, then register it with the team
+git remote add origin https://github.com/<owner>/my-app.git
+techbro project link
+
+# 4. run it (two terminals)
+cargo watch -x 'run -p backend'     # http://localhost:8080
+npm run dev:frontend                # http://localhost:5173
+```
+
+Teammates run `techbro team join core --url https://github.com/<owner>/<team-repo>`.
+
+## Command reference
+
+Exit codes: `0` success; `2` no arguments, unknown command, or usage printed
+without a subcommand; `1` any error (message on stderr as `techbro: <message>`).
+
+### `techbro project init [dir]`
+
+Scaffolds a template into `dir` (default: current directory) and makes it runnable.
+
+| Flag | Default | Effect |
+| --- | --- | --- |
+| `-t, --template <name>` | `_default` | template to scaffold (see `project list`) |
+| `-n, --name <app-name>` | slug of the directory name | app name for `package.json`, `.env.example`, `apps/frontend/.env.example` |
+| `-f, --force` | off | allow a non-empty target directory (files overwritten) |
+| `--no-git` | git on | skip `git init -b main` |
+| `--skip-setup` | setup on | scaffold only; install nothing |
+| `--skip-build` | build on | run setup but skip `cargo build -p backend` |
+
+Reads: the template folder. Writes: the copied template, `.techbro.json`, and
+`git init -b main` unless disabled. If `dir` is already inside a git repository,
+git init is skipped and the repository is left as is. Never copied:
+`node_modules`, `target`, `dist`, `.env`, `*.db`, `*.sqlite`, `coverage`,
+`.DS_Store`. Errors: non-empty directory without `--force`, unknown template,
+invalid existing `.techbro.json` (checked before copying).
+
+What setup does (7 steps, 6 with `--skip-build`):
+
+1. Checks `node`, `npm` and `cargo` are on PATH.
+2. Creates `.env` and `apps/frontend/.env` from the `.env.example` files.
+3. `npm ci` in `apps/frontend` (`npm install` if there is no lockfile).
+4. `cargo fetch --locked`.
+5. Installs `sqlx-cli` and `cargo-watch` with `cargo install` if missing.
+6. `bash scripts/db-migrate sqlite` to create `local.db`.
+7. `cargo build -p backend`.
+
+The first run can take several minutes. If a step fails, the scaffold is kept and
+the error shows the command to rerun.
+
+### `techbro project link`
+
+Registers the current project repo in the current team's `projects.json`.
+
+| Flag | Default | Effect |
+| --- | --- | --- |
+| `-u, --url <repo>` | `git remote get-url origin` in the current directory | project repository |
+| `-n, --name <name>` | `.techbro.json` `name`, else repo name | project name |
+
+Checks, in order: a current team exists; the project URL parses; you have read
+access to the project repo; you are listed in the team's `members.json`; the team
+repo has `projects.json`. An entry with the same URL is left alone
+(`already linked`). Otherwise the entry is added by direct write or by issue (see
+Permissions). If `.techbro.json` exists in the current directory, `team` and
+`repo` are set in it (other keys kept); it is never created.
+
+Output: `already linked` | `linked <name> (<url>) to team <team>` |
+`link pending: <issueUrl> (the team workflow will add it)`.
+
+Review config seeding: when you have push access to the team repo, link also adds
+a `projects.<name>` entry to `.github/techbro-review.json` if (and only if) that
+project has none. Existing entries and all other keys are preserved, never
+overwritten; the write uses the file's current sha, so a concurrent change is
+reported as a warning instead of clobbering it. Recognized projects:
+
+- the `_default` template (`.techbro.json` `template` is `_default`, plus
+  `package.json` and `Cargo.toml`): `test` = `{ runtime: "rust-node", install:
+  "npm --prefix apps/frontend ci", command: "npm run check", workdir: "." }`;
+- otherwise, only if `package.json` defines a `test` script: `npm test` on the
+  `node` runtime (`npm ci` install when `package-lock.json` exists).
+
+Both get `security: { failOn: "ERROR" }`, `sonar: { mode: "optional" }` and `duplication: { mode: "required", maxPercent: 10 }`. Existing entries are never rewritten; entries without `duplication` inherit the same default remotely and in `--dry-run`. Anything
+else is not guessed: link warns and you must add the entry by hand. Without push
+access (issue flow) link never changes the config; it prints the proposed entry
+and a team admin must add it. Check readiness with `project review --dry-run`.
+
+What a review runs: Opengrep security rules and jscpd duplication (required by
+default, 10% max; set `duplication.mode: "off"` to opt out, noted in the report, or
+raise `duplication.maxPercent` for legacy projects, which techbro never does
+automatically); Sonar is optional, not required on the server. A scanner that
+errors fails closed. For the `_default` template the configured test command
+(`npm run check`) covers rustfmt, Clippy, ESLint, Prettier and tests. A non-template
+project with only `npm test` runs just that test script; it is not linted.
+
+Review caller: after the registry and config steps, link installs a tiny
+`.github/workflows/techbro-review.yml` in the project repo that calls the team's
+shared workflow (`<team-owner>/<team-repo>/.github/workflows/techbro-review.yml@main`;
+`@main` is intentional so the team updates reviews centrally). It is always
+delivered through a pull request from branch `techbro/review-caller-v3` on the
+project's default branch, never a direct push. Missing or unmodified-old callers
+are added/updated; a customized caller is kept with a warning; an existing
+branch or PR is reused and manual edits on the branch are not overwritten. Without
+push access to the project repo link reports that a project writer must run it.
+Projects outside the team's organization are unsupported (no caller installed).
+The read-only issue flow installs no caller; rerun link after registration.
+
+### `techbro project review`
+
+Dispatches the team's `techbro-review.yml` workflow for a registered project.
+
+| Flag | Default | Effect |
+| --- | --- | --- |
+| `-u, --url <repo>` | origin of the current directory | registered project |
+| `-r, --ref <ref>` | local `HEAD`, else remote default branch | ref resolved to an immutable SHA |
+| `-t, --team <name>` | current team | team to use |
+| `-p, --project <name>` | none | pick a registered project by name |
+| `-w, --wait` | off | wait (30 min max); exit 1 unless the run succeeds |
+| `--dry-run` | off | read-only preflight; dispatches nothing, writes nothing |
+
+`--dry-run` verifies team membership, registration, project access and the
+workflow file, then shows the effective checks from `.github/techbro-review.json`
+(test command, `security.failOn` ERROR|WARNING|INFO|none, `sonar.mode`
+optional|required|off) and lists missing setup; exit 1 if anything is missing.
+Sonar token/host cannot be inspected, so they are not validated; the remote run is the authoritative gate. A normal review prints the
+same configuration warnings but still dispatches. With `sonar.mode: optional` an
+unavailable Sonar is skipped with a note; an attempted Sonar run that fails is a
+failure. Example: `techbro project review --dry-run`.
+
+Requires team membership, read access to the team repo, write access to the
+project repo, a project registered exactly once in the same organization as the
+team, and the merged caller on the project's default branch. Uncommitted files
+are excluded (warning); the commit must exist on the remote. The project's
+`techbro-review.yml` is dispatched on its default branch with only inputs `sha`
+and `request_id`, matched by run title; the run and the report artifact live in
+the project repo. If the run is not found in time the workflow URL is printed and
+nothing is redispatched. `--dry-run` also checks the caller and the team's
+reusable workflow/action, and warns if the team repo's Actions sharing cannot be
+verified (a team admin must allow organization repositories to use its workflows
+and actions).
+
+Setup (no secrets are provisioned by the CLI; no GitHub App or browser login is
+needed): the review token only reads the project's own repository. Optionally set
+`SONAR_TOKEN` (secret) and `SONAR_HOST_URL` (variable) in the project repo; they
+are passed through the caller. Never put secrets in team repo files. A private
+team repo shares its workflow and action with organization repositories only
+after an admin enables that in its Actions settings.
+
+Coverage figures are project-controlled (the project's own test commands produce them).
+`--wait` exits non-zero when the run fails or is incomplete, tests are not
+configured, the scanner errors, or the quality gate fails; the report artifact is
+still linked. If the 30 minute `--wait` limit passes, the remote run keeps going;
+the run link is printed so you can follow it.
+
+Be aware: the review runs the project's own test commands, i.e. arbitrary source
+code, and anyone who can read the project repo's Actions runs can read the report artifacts. Persistent Sonar is planned; limitations are listed in each
+report, and test commands come from the team review config.
+
+### `techbro team upgrade`
+
+`techbro team upgrade [--team <name>] [--dry-run]` compares the team repo's
+managed review files with this CLI's versions. Missing files are added, unmodified
+old ones updated, current ones skipped; customized files are kept and a
+`<path>.techbro-new` candidate is added for manual merge. `members.json`,
+`projects.json` and `techbro-team.yml` are never touched. Changes go through a PR
+from branch `techbro/upgrade-v5` against the default branch; an open PR and
+existing branch are reused (never reset). `--dry-run` writes nothing. Seed files (config) that exist are never flagged. If the review workflow, action or
+helper is customized, all three are kept and both get `.techbro-new` candidates.
+Pushing workflow files needs the `workflow` token scope. `team create` also adds missing
+managed files.
+
+### `techbro project list`
+
+Prints each template name with a description taken from the first `# ` heading of
+its `TEMPLATE.md` (or `README.md`).
+
+### `techbro team create <name> --url <repo>`
+
+Initializes shared state in a GitHub repo and makes the team current.
+
+| Flag | Default | Effect |
+| --- | --- | --- |
+| `-u, --url <repo>` | required | team repository (`https://github.com/o/r`, with `.git` or trailing slash, or `git@github.com:o/r.git`) |
+| `-f, --force` | off | overwrite an existing local team of the same name |
+
+`<name>` must match `[a-z0-9-]+`. Requires push access to the repo; otherwise it
+stops with `no write access to <o/r> as <login>` before writing anything. Writes
+to `main`, skipping files that exist:
+
+- `members.json` (commit `techbro: initialize team members`). If it already
+  exists, owner and members are kept and your login is added if missing
+  (`techbro: add <login> to team members`).
+- `projects.json` (`techbro: initialize team projects`); never modified if present.
+- `.github/workflows/techbro-team.yml` (`techbro: add team workflow`).
+
+Output: `Repository`, `Owner`, `Members`, `Created`, `Updated`, `Current team`.
+Then the team is saved in the global config as current.
+
+### `techbro team join <name> --url <repo>`
+
+Same flags and name rules as `team create`. Needs read access (`no read access to
+<o/r> as <login>` otherwise) and an initialized team repo (`team repo is not
+initialized; run team create`). Output: `Repository: <o/r>`, then one of
+`already a member`, `added <login> to members.json`, or
+`membership pending: <issueUrl> (the team workflow will add you)`, then
+`Current team: <name>`.
+
+### `techbro team list`
+
+One line per saved team: `*` marks the current one, then name and URL.
+
+### `techbro team use <name>`
+
+Makes a saved team current and prints `Current team: <name>`. Errors on an unknown
+name.
+
+### `techbro cluster add|list|use|remove`
+
+Team-shared clusters. The team owner runs `cluster add <name> --kubeconfig <file>
+--context <ctx> --yes` once; techbro encrypts only that context with
+`TECHBRO_PASSPHRASE` and commits it under `clusters/` in the team repo. Members
+run `cluster use <name>` to decrypt it into a private techbro-owned kubeconfig.
+See [docs/kubernetes.md](docs/kubernetes.md#team-shared-clusters-techbro-cluster).
+
+### `techbro doctor [--online] [--json]`
+
+Read-only check of tools, GitHub token, `TECHBRO_PASSPHRASE`, config, team,
+shared cluster kubeconfigs and secret-like tracked files, with a fix per problem.
+Never prints secret values; exits 1 if any check fails.
+
+### `techbro --help`, `--version`
+
+`techbro --help` (also `-h`, `help`) prints the usage; `techbro project --help` and
+`techbro team --help` print per-group usage. `--version` (`-v`) prints the package
+version. With no arguments the usage is printed and the exit code is `2`.
+
+## Files and formats
+
+### `.techbro.json` (project root)
+
+Written by `project init` unless one already exists (an existing JSON object is
+preserved as is):
+
+```json
+{
+  "schemaVersion": 1,
+  "name": "my-app",
+  "template": "_default",
+  "techbroVersion": "0.3.0",
+  "config": {}
+}
+```
+
+`project link` adds `"team": "<team>"` and `"repo": "https://github.com/<o>/<r>"`.
+`config` is reserved and does not affect commands.
+
+### `~/.config/techbro/config.json` (global)
+
+Set `TECHBRO_CONFIG_DIR` to use `$TECHBRO_CONFIG_DIR/config.json` instead. Missing
+file means an empty config; invalid JSON or a wrong shape is an error naming the
+file. Written atomically (temp file plus rename).
+
+```json
+{
+  "schemaVersion": 1,
+  "currentTeam": "core",
+  "teams": {
+    "core": { "url": "https://github.com/<o>/<r>", "owner": "<login>", "addedAt": "<ISO time>" }
+  }
+}
+```
+
+### `members.json` (team repo, `main`)
+
+```json
+{ "schemaVersion": 1, "team": "core", "owner": "<login>", "members": ["<login>"] }
+```
+
+### `projects.json` (team repo, `main`)
+
+```json
+{
+  "schemaVersion": 1,
+  "projects": [
+    {
+      "name": "my-app",
+      "url": "https://github.com/<o>/my-app",
+      "template": "_default",
+      "linkedBy": "<login>",
+      "linkedAt": "<ISO time>"
+    }
+  ]
+}
+```
+
+`template` is `null` when the project has no `.techbro.json`.
+
+### `.github/workflows/techbro-team.yml` (team repo)
+
+Created by `team create`. Triggers on issues `opened` and `reopened`; permissions
+`contents: write` and `issues: write`; each job has a 5 minute timeout. Issue
+fields reach the scripts only through environment variables.
+
+- Job `join` (label `techbro-join`, body `{"schemaVersion":1,"action":"join","login":"<you>"}`).
+- Job `link` (label `techbro-link`, body `{"schemaVersion":1,"action":"link","login":"<you>","project":{...}}`).
+
+Each job: verifies the issue author is a collaborator (read, triage, write,
+maintain or admin; otherwise comments and closes), checks the body `login` equals
+the issue author, updates the JSON file, commits as `github-actions[bot]`, pushes
+to `main`, comments, and closes the issue. If the push fails (protected `main`) it
+comments that the change must be made manually and the job fails. The result is
+asynchronous: the CLI returns `pending` and the change lands when the workflow
+runs. Issues must be enabled on the team repo for this path.
+
+## Permissions model
+
+Token: `GITHUB_TOKEN` if set, else `gh auth token`; otherwise the command fails
+with `set GITHUB_TOKEN or run gh auth login`. The token is never printed.
+
+| Command | GitHub permission needed | Path |
+| --- | --- | --- |
+| `team create` | push on team repo | direct write to `main` only (shared workflow written last) |
+| `team join` | read on team repo | push: direct write to `members.json`; read only: issue `techbro-join` + workflow |
+| `project link` | read on project repo, membership in team, read on team repo | push on team repo: direct write to `projects.json`; read only: issue `techbro-link` + workflow |
+| `project link` (caller) | push on project repo | PR on the project repo, never a direct push |
+| `project review` | membership, read on team repo, write on project repo | dispatch on the project repo |
+| `team list`, `team use` | none (local config only) | none |
+
+An open request issue created by you is reused instead of opening a duplicate.
+
+## Templates
+
+Templates are tracked in `.project_templates/` at the repository root. On `npm pack` /
+`npm publish`, `prepack` (`npm run sync`) copies them into `templates/`
+(gitignored). `.gitignore` and `.dockerignore` are stored as `_gitignore` /
+`_dockerignore` because npm renames `.gitignore` in packages; `init` restores the
+real names. In a repository checkout (no `templates/` folder) the CLI reads
+`./.project_templates` directly, so no sync is needed.
+
+To add a template, create `.project_templates/<name>/` with a `TEMPLATE.md` whose
+first line is a `# ` heading. It shows up in `project list` and works with
+`project init --template <name>`.
+
+## Troubleshooting
+
+- `curl` returns 404 on install: the repo is private; send a token (see Install).
+- `missing on PATH: cargo`: install Rust from https://rustup.rs, or use
+  `--skip-setup`.
+- `main may be protected`: the push to `main` was rejected. Allow the token to
+  bypass protection, or make the change by hand in a pull request.
+- `issues are disabled on <o/r>`: enable Issues on the team repo, or ask the owner
+  to add you.
+- `<login> is not a member of team <name>; run techbro team join`: join first.
+- `no origin remote; pass --url`: add a remote (`git remote add origin <url>`) or
+  pass `--url`.
+- `no current team`: run `team create`, `team join` or `team use`.
+- `project init` inside an existing git repository prints "existing repository,
+  left as is" and does not run `git init`.
+
+## Development
+
+```bash
+npm test            # node --test, no network
+npm pack --dry-run  # check what gets published
+npm publish
+```
+
+Bump `version` in `package.json` for every release; `techbroVersion` in new
+`.techbro.json` files and `techbro --version` come from it.

package/assets/baseline-rules.yml

@@ -0,0 +1,60 @@
+rules:
+  - id: techbro.js.eval
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: eval of dynamic code
+    pattern: eval(...)
+  - id: techbro.js.new-function
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: dynamic Function constructor
+    pattern: new Function(...)
+  - id: techbro.py.eval
+    languages: [python]
+    severity: ERROR
+    message: eval of dynamic code
+    pattern: eval(...)
+  - id: techbro.py.subprocess-shell
+    languages: [python]
+    severity: WARNING
+    message: subprocess with shell=True
+    pattern: subprocess.$F(..., shell=True, ...)
+  - id: techbro.any.private-key
+    languages: [regex]
+    severity: ERROR
+    message: private key material in source
+    pattern-regex: '-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----'
+  - id: techbro.any.aws-access-key
+    languages: [regex]
+    severity: ERROR
+    message: AWS access key id in source
+    pattern-regex: '\b(AKIA|ASIA)[0-9A-Z]{16}\b'
+  - id: techbro.any.github-token
+    languages: [regex]
+    severity: ERROR
+    message: GitHub token in source
+    pattern-regex: '\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}\b|\bgithub_pat_[A-Za-z0-9_]{50,255}\b'
+  - id: techbro.any.slack-token
+    languages: [regex]
+    severity: ERROR
+    message: Slack token in source
+    pattern-regex: '\bxox[abprs]-[A-Za-z0-9-]{10,100}\b'
+  - id: techbro.rust.shell-command
+    languages: [rust]
+    severity: ERROR
+    message: shell invocation via sh -c
+    pattern-either:
+      - pattern: Command::new("sh").arg("-c")
+      - pattern: Command::new("bash").arg("-c")
+      - pattern: Command::new("sh").args(["-c", ...])
+      - pattern: Command::new("bash").args(["-c", ...])
+  - id: techbro.rust.unsafe-block
+    languages: [rust]
+    severity: WARNING
+    message: unsafe block
+    pattern: unsafe { ... }
+  - id: techbro.rust.unwrap
+    languages: [rust]
+    severity: INFO
+    message: unwrap on Option/Result
+    pattern: $X.unwrap()

package/assets/caller-workflow.yml

@@ -0,0 +1,26 @@
+name: techbro review
+run-name: review ${{ inputs.request_id }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: Commit sha to review (40 hex)
+        required: true
+        type: string
+      request_id:
+        description: Request UUID
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    uses: __TEAM__/.github/workflows/techbro-review.yml@main
+    with:
+      sha: ${{ inputs.sha }}
+      request_id: ${{ inputs.request_id }}
+    secrets:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

package/assets/review-action.yml

@@ -0,0 +1,27 @@
+name: techbro review helper
+description: Stage the trusted techbro helper, rules and team data from this team repository.
+inputs:
+  expect-version:
+    description: Managed version the calling workflow was rendered for
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Stage trusted files
+      shell: bash
+      env:
+        EXPECT: ${{ inputs.expect-version }}
+      run: |
+        set -euo pipefail
+        a="$GITHUB_ACTION_PATH"
+        t="$a/../.."
+        v() { head -n1 "$1" | sed -n 's/^[#/]* techbro-managed v\([0-9][0-9]*\) .*/\1/p'; }
+        for f in "$a/action.yml" "$t/techbro/review.mjs" "$t/techbro/rules/baseline.yml" "$t/workflows/techbro-review.yml"; do
+          [ -f "$f" ] && [ ! -L "$f" ] || { echo "missing or unsafe trusted file" >&2; exit 1; }
+          [ "$(v "$f")" = "$EXPECT" ] || { echo "managed version mismatch (expected v$EXPECT); run techbro team upgrade" >&2; exit 1; }
+        done
+        mkdir -p "$GITHUB_WORKSPACE/ctl" "$GITHUB_WORKSPACE/team"
+        cp "$t/techbro/review.mjs" "$GITHUB_WORKSPACE/ctl/review.mjs"
+        cp -R "$t/techbro/rules" "$GITHUB_WORKSPACE/ctl/rules"
+        cp "$t/../projects.json" "$t/../members.json" "$GITHUB_WORKSPACE/team/"
+        if [ -f "$t/techbro-review.json" ]; then cp "$t/techbro-review.json" "$GITHUB_WORKSPACE/team/"; fi

package/assets/review-config.json

@@ -0,0 +1,4 @@
+{
+  "schemaVersion": 1,
+  "projects": {}
+}