hyperi-ci 2.7.0__tar.gz → 2.7.2__tar.gz

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/.github/workflows/_release-tail.yml

@@ -70,6 +70,10 @@ on:
         type: string
         default: "stable"
         description: "Rust toolchain (only used when language=rust)"
+      submodules:
+        type: string
+        default: ""
+        description: "Space-separated submodule paths to init before the container build (e.g. 'schemas'), so a Dockerfile can bake submodule content. Empty (default) inits nothing."
 
 env:
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
@@ -108,6 +112,12 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
 
+      - name: Init submodules
+        if: ${{ inputs.submodules != '' }}
+        env:
+          SUBMODULES: ${{ inputs.submodules }}
+        run: git submodule update --init --depth 1 $SUBMODULES
+
       - name: Install uv
         # Needed to run the resolve step below. Cheap, no Docker Hub —
         # so a library never pays the Buildx/Docker-Hub cost (issue #33).

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/.github/workflows/ci.yml

@@ -70,6 +70,33 @@ jobs:
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages -- dogfoods the same job
+    # the reusable <lang>-ci.yml workflows now ship. Deliberately NOT gated on
+    # plan.outputs.run-checks: it must validate what actually reaches main on
+    # EVERY merge, not only publish-worthy pushes. Fatal on push to main (what
+    # lands); advisory on pull_request. Runs the LOCAL branch code (uv run) so
+    # this repo's own PRs exercise the change. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install dependencies
+        run: uv sync --no-sources
+      - name: Validate commit messages
+        run: uv run --no-sources hyperi-ci check-commits
+
   quality:
     name: Quality
     runs-on: ubuntu-latest

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/.github/workflows/go-ci.yml

@@ -155,6 +155,30 @@ jobs:
           fi
           echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -200,6 +224,14 @@ jobs:
       - name: Install native dependencies
         run: ${{ env.HYPERCI_INSTALL }} install-native-deps golang
 
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+        run: git fetch --deepen=200 origin
+
       - name: Run quality checks
         env:
           GITLEAKS_GH_ACTIONS_KEY: ${{ secrets.GITLEAKS_GH_ACTIONS_KEY }}
@@ -347,4 +379,5 @@ jobs:
       from-head: ${{ inputs.from-head }}
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/.github/workflows/python-ci.yml

@@ -140,6 +140,30 @@ jobs:
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -174,6 +198,14 @@ jobs:
       - name: Install dependencies
         run: uv sync --frozen --all-extras
 
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+        run: git fetch --deepen=200 origin
+
       - name: Run quality checks
         env:
           GITLEAKS_GH_ACTIONS_KEY: ${{ secrets.GITLEAKS_GH_ACTIONS_KEY }}
@@ -345,4 +377,5 @@ jobs:
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
       python-version: ${{ inputs.python-version }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/.github/workflows/rust-ci.yml

@@ -173,6 +173,30 @@ jobs:
           fi
           echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -226,6 +250,14 @@ jobs:
       - name: Setup osv-scanner
         uses: hyperi-io/hyperi-ci/.github/actions/setup-osv-scanner@main
 
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+        run: git fetch --deepen=200 origin
+
       - name: Run quality checks
         env:
           GITLEAKS_GH_ACTIONS_KEY: ${{ secrets.GITLEAKS_GH_ACTIONS_KEY }}
@@ -402,4 +434,5 @@ jobs:
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
       rust-toolchain: ${{ inputs.rust-toolchain }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/.github/workflows/ts-ci.yml

@@ -137,6 +137,30 @@ jobs:
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -197,6 +221,14 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           "$HOME/.local/bin/osv-scanner" --version
 
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
+        run: git fetch --deepen=200 origin
+
       - name: Run quality checks
         env:
           GITLEAKS_GH_ACTIONS_KEY: ${{ secrets.GITLEAKS_GH_ACTIONS_KEY }}
@@ -355,4 +387,5 @@ jobs:
       from-head: ${{ inputs.from-head }}
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hyperi-ci
-Version: 2.7.0
+Version: 2.7.2
 Summary: HyperI CI/CD CLI tool — multi-language build, test, and publish automation
 Project-URL: Homepage, https://github.com/hyperi-io/hyperi-ci
 Project-URL: Repository, https://github.com/hyperi-io/hyperi-ci

hyperi_ci-2.7.2/VERSION

@@ -0,0 +1 @@
+2.7.2

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/docs/ARCHITECTURE.md

@@ -82,11 +82,21 @@ the single place language divergence is allowed.
 | Job | needs | if | Purpose |
 |---|---|---|---|
 | `plan` | — | always | Decide if this run is publish-worthy; emit gate outputs |
+| `commit-check` | — | push-to-main OR `pull_request` | Conventional-commit **landing gate** — fatal on push to main (validates what lands), advisory on PRs. NOT `run-checks`-gated (see below) |
 | `quality` | `[plan]` | `run-checks` | Lint / typecheck / security scan |
 | `test` | `[plan]` | `run-checks` | Unit + integration tests |
 | `build` | `[plan, quality, test]` | `run-build` | Compile binaries / wheels / packages, stamp version, upload `dist/` |
 | `release-tail` | `[plan, build]` | own gates | Container + tag-and-publish, via shared `_release-tail.yml` |
 
+`commit-check` is deliberately **independent of `plan` / `run-checks`**: that
+gate skips the quality job on ordinary (non-publish) merges to main, so a bad
+conventional-commit message could otherwise land unvalidated. It is a cheap
+git-log + regex check (no compile/publish), fatal on the push that actually
+reaches main and advisory on PRs (branch commits may be squashed away — only
+the squash subject lands). Feature-branch pushes skip it, preserving the
+chore-skip fast path. Logic: `hyperi_ci.quality.commit_validation.run`; the
+local `hyperi-ci check` runs the same validation over `origin/main..HEAD`.
+
 ### Gate outputs (computed in `plan`)
 
 | Output | True when | Effect |
@@ -115,13 +125,14 @@ flowchart LR
 
 ### What runs when
 
-| Push type | plan | quality | test | build | container | tag+publish |
-|---|---|---|---|---|---|---|
-| `chore:` / `docs:` to main | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
-| `feat:`/`fix:` to main, no `Publish:` trailer | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
-| `feat:`/`fix:` to main + `Publish: true` | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
-| Pull request | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ |
-| `workflow_dispatch` (retroactive publish) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Push type | plan | commit-check | quality | test | build | container | tag+publish |
+|---|---|---|---|---|---|---|---|
+| `chore:` / `docs:` to main | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `feat:`/`fix:` to main, no `Publish:` trailer | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `feat:`/`fix:` to main + `Publish: true` | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Pull request | ✓ | ✓ advisory | ✓ | ✓ | ✗ | ✗ | ✗ |
+| `workflow_dispatch` (retroactive publish) | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| push to a feature branch | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
 
 Tag-on-publish doctrine: a commit landing on main produces no tag and no
 artefacts. The operator opts in with `hyperi-ci push --publish` (adds the

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/docs/LESSONS.md

@@ -299,10 +299,12 @@ build to ensure fresh artifacts, also via `hyperi-ci run build`.
 - Detection: directory-based > marker-based > conftest-based
 - Coverage: separate `.coverage.<tier>` files, combine at end
 - No test directory: exit 0 (graceful skip)
-- Submodule-dependent tests:
+- Submodule-dependent tests or container builds:
   - Public submodule: declare `submodules: schemas` in `.hyperi-ci.yaml`;
     `hyperi-ci init` renders it as the reusable-workflow `submodules` input
-    in `ci.yml`, and the test job checks it out so the tests run.
+    in `ci.yml`. The test job checks it out so the tests run, and the
+    container build checks it out so a Dockerfile can bake submodule
+    content into the image.
   - Private submodule (e.g. `dfe-schemas` while private): GITHUB_TOKEN can't
     clone it, so mark dependent tests with
     `@pytest.mark.skipif(not schemas_dir.exists(), reason="submodule not checked out")`

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/src/hyperi_ci/cli.py

@@ -674,6 +674,23 @@ def check_commit_cmd(
     raise typer.Exit(1)
 
 
+@app.command(name="check-commits")
+def check_commits_cmd() -> None:
+    """Validate the conventional-commit messages in the CI push/PR range.
+
+    Landing-gate counterpart to `check-commit` (single message, local
+    commit-msg hook). Resolves the range from the CI event -- push
+    before..after (what lands on main) or PR base..HEAD -- validates each
+    commit, and is FATAL on push but ADVISORY on pull_request (branch
+    commits may be squashed away). CI-only; a no-op locally. Driven by the
+    dedicated `commit-check` workflow job, NOT the run-checks-gated quality
+    job -- so a merge to main is validated even when it is not a publish.
+    """
+    from hyperi_ci.quality.commit_validation import run
+
+    raise typer.Exit(run())
+
+
 def _publish_impl(
     tag: str | None,
     list_tags: bool,

{hyperi_ci-2.7.0 → hyperi_ci-2.7.2}/src/hyperi_ci/dispatch.py

@@ -169,22 +169,30 @@ def stage_setup(language: str, config: CIConfig) -> int:
     return rc
 
 
-def stage_quality(language: str, config: CIConfig) -> int:
+def stage_quality(language: str, config: CIConfig, *, local: bool = False) -> int:
     """Quality checks — gitleaks + language-specific checks."""
     if not config.get("quality.enabled", True):
         info("Quality checks disabled in configuration")
         return 0
 
-    # Cross-language checks first
+    # Cross-language checks first.
     with group("Gitleaks secret scanning"):
         rc = gitleaks.run(config)
         if rc != 0:
             return rc
 
-    with group("Commit message validation"):
-        rc = commit_validation.run(config)
-        if rc != 0:
-            return rc
+    # Commit-message validation. In CI this is the dedicated `commit-check`
+    # workflow job -- it runs on every merge to main (not just the
+    # publish-worthy pushes the run-checks-gated quality job covers) and is
+    # advisory on PRs. There is no such job for a LOCAL `hyperi-ci check`,
+    # so run it here over the unpushed range (origin/main..HEAD) as a
+    # pre-push backstop -- catch a bad message before the push, not after.
+    # See hyperi_ci.quality.commit_validation.run + CLAUDE.md CI gate doctrine.
+    if local:
+        with group("Commit message validation"):
+            rc = commit_validation.run(config, local=True)
+            if rc != 0:
+                return rc
 
     extra_env: dict[str, str] = {}
     if language == "rust":
@@ -440,9 +448,11 @@ def run_stage(
         info(f"Project status: {status}{_STATUS_CLARIFIER.get(status, '')}")
 
     handler = _STAGE_HANDLERS[stage]
-    if stage == "build":
-        # The build handler takes `local`; the others do not. _STAGE_HANDLERS
-        # is typed to the common (no-local) signature, so cast for this branch.
+    if stage in ("build", "quality"):
+        # build + quality take `local` (build skips cross-targets; quality
+        # runs the commit-message backstop only for a local `hyperi-ci
+        # check`). _STAGE_HANDLERS is typed to the common (no-local)
+        # signature, so cast for this branch.
         rc = cast("Any", handler)(language, config, local=local)
     else:
         rc = handler(language, config)