yadflow 2.4.0 → 2.4.2

package/CHANGELOG.md

@@ -1,15 +1,9 @@
-# [2.4.0](https://github.com/abdelrahmannasr/yadflow/compare/v2.3.0...v2.4.0) (2026-06-13)
+## [2.4.2](https://github.com/abdelrahmannasr/yadflow/compare/v2.4.1...v2.4.2) (2026-06-14)
 
 
 ### Bug Fixes
 
-* address CodeRabbit review on PR [#48](https://github.com/abdelrahmannasr/yadflow/issues/48) ([2f182f7](https://github.com/abdelrahmannasr/yadflow/commit/2f182f72b68e226196b6190802771b0e12b585f9))
-
-
-### Features
-
-* add DeepTutor learning layer across all SDLC stages ([bd8d4ea](https://github.com/abdelrahmannasr/yadflow/commit/bd8d4eaaa0258242a62ed1b131f7e3f74506af64))
-* make learning-layer output local-only (never committed or pushed) ([aa8f74e](https://github.com/abdelrahmannasr/yadflow/commit/aa8f74eb61855d3a663810a0c68cf8e37fbedd66))
+* route GitLab CI gate jobs to tag-locked runners via $YAD_RUNNER_TAGS ([a0311c5](https://github.com/abdelrahmannasr/yadflow/commit/a0311c5af647f63968f3f34e8e6e6fa48b7423d8)), closes [#50](https://github.com/abdelrahmannasr/yadflow/issues/50)
 
 # [2.2.0](https://github.com/abdelrahmannasr/yadflow/compare/v2.1.0...v2.2.0) (2026-06-14)
 

package/cli/doctor.mjs

@@ -162,9 +162,43 @@ export function projectChecks(checks, root) {
     }
     if (!registry.repos.length) check(checks, 'repos', 'project', 'warn', 'no code repos registered', 'run `yad setup` to connect one');
   }
+
+  ciTagsChecks(checks, root, hub, registry);
   return { hub, registry };
 }
 
+// GitLab CI runner tags: the wired fragments run docker-image jobs. On instances whose runners are
+// all tag-locked (run_untagged: false), an untagged image job matches no runner and sits `pending`
+// forever — silently blocking the gates (issue #50). A current fragment carries
+// `tags: [$YAD_RUNNER_TAGS]`; warn on any wired GitLab fragment that sets an `image:` but has no
+// `tags:` (an old install, or one hand-reverted by a sync). Pure local read — no API calls.
+export function ciTagsChecks(checks, root, hub, registry) {
+  const untagged = (p) => {
+    try {
+      const txt = fs.readFileSync(p, 'utf8');
+      return /^\s*image:/m.test(txt) && !/^\s*tags:/m.test(txt);
+    } catch { return false; } // absent fragment is not this check's concern
+  };
+  const fragments = [];
+  if (hub?.platform === 'gitlab' && (hub.bridge_enabled === true || hub.bridge === true)) {
+    fragments.push(
+      { scope: 'hub', file: '.gitlab/ci/yad-gate-sync.yml', path: path.join(root, '.gitlab/ci/yad-gate-sync.yml') },
+      { scope: 'hub', file: '.gitlab/ci/yad-verified-commits.yml', path: path.join(root, '.gitlab/ci/yad-verified-commits.yml') },
+    );
+  }
+  for (const repo of registry?.repos || []) {
+    if (repo.platform !== 'gitlab' || !repo.path) continue;
+    fragments.push({ scope: repo.name, file: '.gitlab/ci/yad-checks.yml', path: path.join(path.resolve(root, repo.path), '.gitlab/ci/yad-checks.yml') });
+  }
+  for (const f of fragments) {
+    if (untagged(f.path)) {
+      check(checks, `ci-tags:${f.scope}`, 'project', 'warn',
+        `${f.scope}: ${f.file} runs a docker job with no \`tags:\` [YAD-CI-001]`,
+        'tag-locked runners (run_untagged: false) will strand it at `pending` — run `yad update`, then set the `YAD_RUNNER_TAGS` CI/CD variable');
+    }
+  }
+}
+
 export function epicChecks(checks, root) {
   const epicsDir = path.join(root, 'epics');
   if (!exists(epicsDir)) return;

package/cli/setup.mjs

@@ -1,12 +1,16 @@
 // `yad setup` — the guided, idempotent first-run wizard.
 import path from 'node:path';
 import fs from 'node:fs';
+import os from 'node:os';
 import {
   c, log, step, ok, info, warn, hand, fail, ask, askYesNo, run, has,
   exists, readJSON, writeJSON,
 } from './lib.mjs';
 import { VERSION, IDE_FOLDER_TARGETS, PROJECT_FILES, DESIGN_TOOLS, DESIGN_PRIMARY, TESTING_TOOLS, TESTING_PRIMARY, LEARNING_TOOLS, LEARNING_PRIMARY } from './manifest.mjs';
-import { moduleActions, repoActions, hubActions, authorsActions } from './plan.mjs';
+import {
+  moduleActions, repoActions, hubActions, authorsActions,
+  legacyModuleActions, legacyRepoActions, legacyHubActions,
+} from './plan.mjs';
 
 const ALL_IDES = [...IDE_FOLDER_TARGETS, '.opencode'];
 
@@ -181,8 +185,27 @@ export async function runSetup(root, opts = {}) {
     ideTargets = answer.split(',').map((s) => s.trim()).filter(Boolean);
   }
   applyActions(moduleActions(root, ideTargets), { force: true });
+  // Migrate any pre-2.0 install in place: remove the old sdlc-* skill copies in the project's
+  // IDE targets and install their yad-* renames. Without this, setup only ADDED yad-* and left
+  // stale sdlc-* sitting next to them (the rename only ran under `yad update` / `yad check --fix`).
+  applyActions(legacyModuleActions(root, ideTargets), { force: true });
   ok(`module installed into: ${ideTargets.join(', ')}`);
 
+  // Global leftovers: a pre-2.0 install may have put sdlc-* skills in the user's global
+  // ~/.claude/skills (path.join(homedir, '.claude', 'skills', <old>)). The CLI is project-scoped,
+  // so touching the home dir requires an interactive yes — never auto-fire it in SDLC_NONINTERACTIVE
+  // (scripted/CI) mode, where the prompt would otherwise return its default. Silent when there is
+  // nothing to migrate.
+  const globalLegacy = process.env.SDLC_NONINTERACTIVE ? [] : legacyModuleActions(os.homedir(), ['.claude']);
+  if (globalLegacy.length) {
+    if (await askYesNo(`Found ${globalLegacy.length} legacy sdlc-* skill(s) in your global ~/.claude/skills (pre-2.0 install). Migrate them to yad-*?`, true)) {
+      applyActions(globalLegacy, { force: true });
+      ok('migrated global ~/.claude/skills to yad-*');
+    } else {
+      info('left global ~/.claude/skills untouched — re-run `yad setup` or migrate later with `yad update`');
+    }
+  }
+
   // 3. Detect hub platform + roster
   step(3, total, 'Hub platform & reviewer roster');
   const hubPath = path.join(root, PROJECT_FILES.hubConfig);
@@ -299,6 +322,9 @@ export async function runSetup(root, opts = {}) {
   for (const repo of registry.repos) {
     log(`  ${c.bold(repo.name)} ${c.dim(`(${repo.platform})`)}`);
     applyActions(repoActions(root, repo), { force: true });
+    // Migrate pre-2.0 wired CI (marker-owned sdlc-*.yml -> yad-*.yml); a user-authored
+    // same-named file is never touched.
+    applyActions(legacyRepoActions(root, repo), { force: true });
   }
   // the hub: event-driven gate-sync CI, so platform approvals/merges drive `yad gate ci`
   const hubWiring = hubActions(root);
@@ -306,6 +332,7 @@ export async function runSetup(root, opts = {}) {
     log(`  ${c.bold('hub')} ${c.dim('(gate-sync + verified-commits CI)')}`);
     applyActions(hubWiring, { force: true });
   }
+  applyActions(legacyHubActions(root), { force: true });
   // author allowlists for the verified-commits gate (hub + every repo), from the roster emails
   applyActions(authorsActions(root, registry.repos), { force: true });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yadflow",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Yadflow — the gated, team, multi-repo SDLC: author → review → build with a PR-driven review gate and a zero-dependency `yad` CLI (setup, gate, commit, open-pr, repo). A BMAD module + 22 yad-* skills.",
   "type": "module",
   "author": "AbdelRahman Nasr",

package/skills/yad-checks/SKILL.md

@@ -88,6 +88,13 @@ Copy from this skill's `templates/`:
     human to paste (graceful degradation — never guess-edit a pipeline you cannot parse).
   - The legacy standalone `templates/gitlab/.gitlab-ci.yml` is retained only for a clean greenfield repo
     that prefers a single self-contained file; the include path above is the default.
+  - **Tag-locked runners** (`run_untagged: false`, common on self-hosted): the fragment's jobs run a
+    docker image, so set a `YAD_RUNNER_TAGS` CI/CD variable (e.g. `dind_runner`) to route them — the
+    `default:` block emits `tags: [$YAD_RUNNER_TAGS]`. When unset, current GitLab (≥15) drops the
+    empty-expanded tag so the jobs run untagged (gitlab.com shared runners); older versions may
+    strand them `pending`, in which case set the variable to a real tag. The variable lives in
+    project settings, so it survives every `yad` sync. Single value only — `tags: [$VAR]` is one tag
+    equal to the whole variable, not a comma-split.
 
 - Ensure `<repo>/package.json` defines `lint`, `build`, `test` scripts (see `references/check-gates.md`
   for the canonical scripts). **Only ADD a missing script; never overwrite an existing one.**

package/skills/yad-checks/templates/gitlab/yad-checks.gitlab-ci.yml

@@ -11,6 +11,14 @@
 # colliding with the host project's own job names.
 default:
   image: node:20
+  # Runner selection. These jobs need a docker/dind executor; on instances whose runners are all
+  # tag-locked (run_untagged: false) an untagged image job never starts. Set the YAD_RUNNER_TAGS
+  # CI/CD variable (Settings → CI/CD → Variables, e.g. `dind_runner`) to route them — it lives in
+  # project settings, so it survives every `yad` sync. When unset, current GitLab (>=15) drops the
+  # empty-expanded tag so the job runs untagged (gitlab.com shared runners); some older versions
+  # instead strand it `pending` — if so, set the variable to a real tag. Single value only:
+  # `tags: [$VAR]` is one tag equal to the whole variable, not a comma-split.
+  tags: [$YAD_RUNNER_TAGS]
 
 .sdlc_mr_only:
   rules:

package/skills/yad-checks/templates/gitlab/yad-verified-commits.gitlab-ci.yml

@@ -12,6 +12,11 @@
 # Job name is yad-hub-prefixed so it can coexist with the code-repo fragment in one pipeline.
 yad-hub-verified-commits:
   needs: []
+  # Runner selection: set the YAD_RUNNER_TAGS CI/CD variable (e.g. `dind_runner`) to route this
+  # docker job on instances whose runners are tag-locked (run_untagged: false) — it lives in
+  # project Settings → CI/CD → Variables, so it survives every `yad` sync. When unset, current
+  # GitLab (>=15) runs the job untagged; older versions may strand it — set a real tag if so.
+  tags: [$YAD_RUNNER_TAGS]
   image: node:20
   variables:
     GIT_DEPTH: "0" # full history so the gate can diff against the target branch

package/skills/yad-hub-bridge/SKILL.md

@@ -89,6 +89,14 @@ remains valid and is the fallback whenever CI cannot push.
      `SDLC_GATE_TOKEN` project-access-token variable (`read_api` + `write_repository`). GitLab fires no
      pipeline on an approval alone, so the schedule is the path that picks approvals up (≤ ~15 min
      latency); MR events and the merge are near-immediate.
+   - **If your runners are tag-locked** (`run_untagged: false`, common on self-hosted): set a
+     `YAD_RUNNER_TAGS` CI/CD variable (e.g. `dind_runner`) so the docker-image `yad-gate-sync` job
+     is routed to a runner — otherwise it sits `pending` forever. The fragment emits
+     `tags: [$YAD_RUNNER_TAGS]`. When unset, current GitLab (≥15) drops the empty-expanded tag so the
+     job runs untagged (gitlab.com shared runners); older versions may strand it `pending`, in which
+     case set the variable to a real tag. The variable lives in project settings, so it survives
+     every `yad` sync. Single value only — `tags: [$VAR]` is one tag equal to the whole variable,
+     not a comma-split.
 3. Commit the workflow to the hub. GitHub needs nothing else — the ephemeral `github.token` reads the
    PR and pushes the ledger. If the default branch is protected, see the workflow header for the
    bypass / PAT options; until then the run fails visibly and manual `yad gate sync` still works.

package/skills/yad-hub-bridge/templates/gitlab/yad-gate-sync.gitlab-ci.yml

@@ -31,6 +31,11 @@ variables:
 
 yad-gate-sync:
   needs: []
+  # Runner selection: set the YAD_RUNNER_TAGS CI/CD variable (e.g. `dind_runner`) to route this
+  # docker job on instances whose runners are tag-locked (run_untagged: false) — it lives in
+  # project Settings → CI/CD → Variables, so it survives every `yad` sync. When unset, current
+  # GitLab (>=15) runs the job untagged; older versions may strand it — set a real tag if so.
+  tags: [$YAD_RUNNER_TAGS]
   image: node:20
   rules:
     # MR-event path: fires on MR open / push to the review branch — NOT on approval (see header).