testguard-cli 0.1.0__tar.gz

testguard_cli-0.1.0/.gitattributes

@@ -0,0 +1 @@
+graphify-out/graph.json merge=graphify

testguard_cli-0.1.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+name: 🐛 Bug report
+about: Something TestGuard did that it should not have
+title: '[BUG] '
+labels: bug
+assignees: ''
+---
+
+## What happened
+
+<!-- The command you ran and its full output. -->
+
+## What you expected
+
+## The claim involved
+
+```json
+<!-- The relevant entry from testguard.claims.json — redact anything private. -->
+```
+
+## Environment
+
+- **TestGuard**: <!-- testguard --version -->
+- **Node.js**: <!-- node --version -->
+- **Test runner**: <!-- vitest x.y -->
+- **OS**:
+
+## Evidence record (if relevant)
+
+```json
+<!-- The record for that claim from .testguard/evidence.json — paths and hashes only, no source. -->
+```

testguard_cli-0.1.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: 💡 Feature request
+about: Something TestGuard should do
+title: '[FEAT] '
+labels: enhancement
+assignees: ''
+---
+
+## The claim you cannot verify today
+
+<!-- What are you trying to prove about your tests, and what stops you? -->
+
+## Proposed behaviour
+
+## Does it change what the tool emits?
+
+<!-- If yes, it is a spec change: which schema, which GATE-SEMANTICS rule? -->
+
+## Alternatives considered

testguard_cli-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+# Pull request
+
+## What & why
+
+<!-- One or two sentences. -->
+
+## Checklist
+
+- [ ] `npm test` passes
+- [ ] `npm run self:probe` exits 0 (every claim about TestGuard still killed)
+- [ ] `CHANGELOG.md` has an entry under `[Unreleased]`
+- [ ] If output changed: schema + `GATE-SEMANTICS.md` + validator + conformance case updated together
+- [ ] If the fixture changed: each new expectation verified independently before `expected.json`
+- [ ] No client-identifying material; neutral domains only
+
+## Output
+
+<!-- For CLI-visible changes, paste before/after terminal output. -->

testguard_cli-0.1.0/.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-npm:
+        patterns: ["*"]
+    # devDependencies only (ajv for the conformance suite, vitest as the test
+    # runner). The published package has zero runtime dependencies.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-pip:
+        patterns: ["*"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      all-actions:
+        patterns: ["*"]

testguard_cli-0.1.0/.github/scripts/sync-release-version.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+/**
+ * package.json is the single source of truth for the version. Every other
+ * surface that carries it is synced from there:
+ *   - pyproject.toml         `version = "x.y.z"`
+ *   - action.yml             default of the `version` input
+ *   - packaging/homebrew/*.rb the tarball URL (sha256 is set after publish)
+ *
+ * `--check` verifies instead of writing (used by release.yml).
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const root = resolve(process.argv[1], '..', '..', '..');
+const check = process.argv.includes('--check');
+const version = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')).version;
+if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error(`package.json version is not a stable semver: ${version}`);
+
+const surfaces = [
+  ['pyproject.toml', /^version = "[^"]+"/m, `version = "${version}"`],
+  ['action.yml', /(\n  version:\n    description: [^\n]*\n    required: false\n    default: ')[^']*(')/, `$1${version}$2`],
+  ['packaging/homebrew/testguard.rb', /testguard-cli-\d+\.\d+\.\d+\.tgz/g, `testguard-cli-${version}.tgz`],
+];
+
+let drift = 0;
+for (const [rel, pattern, replacement] of surfaces) {
+  const path = resolve(root, rel);
+  const before = readFileSync(path, 'utf8');
+  if (!pattern.test(before)) throw new Error(`${rel}: version pattern not found`);
+  const after = before.replace(pattern, replacement);
+  if (after === before) continue;
+  drift++;
+  if (check) console.error(`${rel}: out of sync with package.json ${version}`);
+  else { writeFileSync(path, after); console.log(`${rel}: synced to ${version}`); }
+}
+if (check && drift) process.exit(1);
+if (check) console.log(`all version surfaces at ${version}`);

testguard_cli-0.1.0/.github/workflows/auto-merge.yml

@@ -0,0 +1,68 @@
+name: Auto-merge (green bot PRs)
+
+# After a successful CI run on a PR, merge it if — and only if — it is a
+# non-major dependabot bump or an automated release PR touching release
+# surfaces only. Everything else is left for a human. The CI run that
+# triggered this is re-verified job by job; a green badge is not trusted.
+
+on:
+  workflow_run:
+    workflows: ["TestGuard CI"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
+
+jobs:
+  auto-merge:
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Evaluate and merge if safe
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const run = context.payload.workflow_run;
+            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({ owner, repo, commit_sha: run.head_sha });
+            const pr = prs.find((p) => p.state === 'open');
+            if (!pr) { core.info('No open PR for this SHA.'); return; }
+            const num = pr.number, author = pr.user.login;
+            const hold = async (why) => {
+              try { await github.rest.issues.addLabels({ owner, repo, issue_number: num, labels: ['needs-review'] }); } catch {}
+              await github.rest.issues.createComment({ owner, repo, issue_number: num, body: `⏸️ **Held for human review** — ${why}\n\nCI is green, but this falls outside the policy in \`.github/workflows/auto-merge.yml\`.` });
+              core.notice(`#${num} held: ${why}`);
+            };
+            if (run.head_sha !== pr.head.sha || run.head_branch !== pr.head.ref) { core.info('Run does not match current PR head.'); return; }
+
+            // Re-verify the exact run: every job succeeded and all three Node legs ran.
+            const { data: jobs } = await github.rest.actions.listJobsForWorkflowRun({ owner, repo, run_id: run.id, filter: 'latest', per_page: 100 });
+            const legs = jobs.jobs.filter((j) => /^test \((20|22|24)\)$/.test(j.name));
+            if (legs.length !== 3 || jobs.jobs.some((j) => j.conclusion !== 'success' && j.conclusion !== 'skipped')) {
+              core.info(`Not merging — jobs: ${jobs.jobs.map((j) => `${j.name}=${j.conclusion}`).join(', ')}`); return;
+            }
+
+            const { data: files } = await github.rest.pulls.listFiles({ owner, repo, pull_number: num, per_page: 300 });
+            const paths = files.map((f) => f.filename);
+            const RELEASE_SURFACES = new Set(['package.json', 'package-lock.json', 'pyproject.toml', 'CHANGELOG.md', 'action.yml', 'packaging/homebrew/testguard.rb']);
+
+            if (author === 'dependabot[bot]') {
+              const m = /from (\d+)\.(\d+)\.\S+ to (\d+)\.(\d+)\./.exec(pr.title || '');
+              if (!m) { await hold('could not parse the version delta from the title.'); return; }
+              if (m[1] !== m[3]) { await hold(`this is a **major** bump; majors are never auto-merged.`); return; }
+            } else if (author === 'github-actions[bot]' && /^release: v\d+\.\d+\.\d+/.test(pr.title || '')) {
+              const stray = paths.filter((p) => !RELEASE_SURFACES.has(p));
+              if (stray.length) { await hold(`release PR touches non-release files:\n${stray.map((p) => `- \`${p}\``).join('\n')}`); return; }
+            } else {
+              core.info(`#${num} by ${author} — not a handled bot; leaving alone.`); return;
+            }
+
+            try {
+              const { data: merge } = await github.rest.pulls.merge({ owner, repo, pull_number: num, merge_method: 'squash' });
+              if (!merge.merged) throw new Error(merge.message || 'GitHub declined the merge');
+              await github.rest.issues.createComment({ owner, repo, issue_number: num, body: `🤖 **Auto-merged** — the exact CI run passed all three Node legs (20/22/24) within the runtime budget and satisfied \`.github/workflows/auto-merge.yml\`.` });
+            } catch (e) {
+              await hold(`auto-merge failed: \`${e.message}\``);
+            }

testguard_cli-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: TestGuard CI
+
+on:
+  workflow_dispatch: # manual recovery for pushes that don't auto-trigger (e.g. release PRs opened by GITHUB_TOKEN)
+  push:
+    branches: [main]
+    tags: ['v*'] # publish-check below runs on tags only
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # 20 is the floor (node:util.parseArgs). 24 ships npm 11 — keep it so
+        # `npm ci` exercises the npm that treats some config as fatal where
+        # npm 10 is silent. Do not drop 24.
+        node-version: [20, 22, 24]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # probe builds a git worktree from HEAD; the self-probe below needs history
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install (devDependencies only; zero runtime deps)
+        run: npm ci
+
+      # ── Syntax-check EVERY source, not just what the entry point eagerly
+      #    imports; a lazily loaded module's parse error would otherwise slip. ──
+      - name: Syntax-check all sources
+        run: find cli src spec -name '*.mjs' -print0 | xargs -0 -n1 node --check
+
+      - name: Python wrapper imports (PyPI surface)
+        run: python3 -c "import testguard_cli.wrapper; print('testguard_cli.wrapper OK')"
+
+      # ── Test suite with a RUNTIME BUDGET. A test that walks the wrong tree
+      #    or probes far more than it should still passes — it just takes
+      #    forever. Only a duration gate catches that class. Normal: ~15s
+      #    locally, ~30–60s here. Budget is loose on purpose. ──
+      - name: Run tests (with runtime budget)
+        shell: bash
+        env:
+          TEST_BUDGET_MS: 240000
+        run: |
+          START=$(date +%s%3N)
+          npm test
+          DURATION=$(( $(date +%s%3N) - START ))
+          echo "Test suite duration: ${DURATION}ms (budget: ${TEST_BUDGET_MS}ms)"
+          if [ "$DURATION" -gt "$TEST_BUDGET_MS" ]; then
+            echo "::error::Test suite took ${DURATION}ms, over the ${TEST_BUDGET_MS}ms budget — something is probing far more than it should."
+            exit 1
+          fi
+
+      # ── Dogfood: the real binary against the known-answer fixture, as a
+      #    user would run it (the suite drives main() in-process). ──
+      - name: CLI version
+        run: node cli/testguard.mjs --version
+
+      - name: claims — fixture lists cleanly, no drift
+        run: node cli/testguard.mjs claims fixtures/known-answer
+
+      - name: probe → baseline → probe → brief on the fixture (through the bin)
+        shell: bash
+        run: |
+          set -o pipefail
+          S=$(mktemp -d)
+          cp -R fixtures/known-answer/. "$S/"
+          rm -rf "$S/node_modules" "$S/.flake-counter" "$S/.testguard"
+          ln -s "$GITHUB_WORKSPACE/node_modules" "$S/node_modules"
+          git -C "$S" init -q
+          git -C "$S" -c user.email=ci@example.invalid -c user.name=ci add -A
+          git -C "$S" -c user.email=ci@example.invalid -c user.name=ci commit -qm fixture
+          B="$GITHUB_WORKSPACE/cli/testguard.mjs"
+          status=0; node "$B" probe "$S" --budget 60000 --quiet || status=$?
+          [ "$status" -eq 1 ] || { echo "::error::expected exit 1 (unproven claims), got $status"; exit 1; }
+          node "$B" baseline "$S"
+          status=0; node "$B" probe "$S" --budget 60000 --quiet || status=$?
+          [ "$status" -eq 0 ] || { echo "::error::expected exit 0 after baseline, got $status"; exit 1; }
+          node "$B" brief "$S" --text | head -12
+          # every verdict must appear exactly once per expected.json
+          node --input-type=module -e "
+            import { readFileSync } from 'node:fs';
+            const ev = JSON.parse(readFileSync('$S/.testguard/evidence.json','utf8'));
+            const exp = JSON.parse(readFileSync('fixtures/known-answer/expected.json','utf8')).expected;
+            const bad = ev.records.filter(r => exp[r.claim.id+'/'+r.subject.id].verdict !== r.verdict);
+            if (bad.length) { console.error('MISMATCH', bad.map(r => r.claim.id+'/'+r.subject.id+':'+r.verdict)); process.exit(1); }
+            console.log('fixture verdicts match expected.json:', ev.records.length);
+          "
+
+      # ── Self-verification: TestGuard is governed by the standard it defines.
+      #    testguard.claims.json states invariants of the tool itself; every
+      #    fault must be killed by the tool's own tests. Exit 0 = all defended. ──
+      - name: probe TestGuard's own claims
+        run: node cli/testguard.mjs probe . --budget 180000 --out "$RUNNER_TEMP/self-evidence.json"
+
+      - name: Upload self-probe evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: testguard-self-evidence-node-${{ matrix.node-version }}
+          path: ${{ runner.temp }}/self-evidence.json
+          if-no-files-found: warn
+
+  # ── npm publish dry-run on tags ──
+  publish-check:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: test
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - run: npm publish --dry-run

testguard_cli-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,177 @@
+name: Auto Release — Tag, GitHub Release, npm, PyPI
+
+# TAG-DRIVEN and idempotent: a version needs releasing iff no tag v<version>
+# exists. Re-runs never double-publish. No long-lived secrets anywhere —
+# npm and PyPI both authenticate with OIDC Trusted Publishing.
+#
+# ONE-TIME SETUP (maintainer, cannot be automated):
+#   npm:  the first `npm publish` of testguard-cli is manual (Trusted Publishing
+#         is configured on an existing package). Then on npmjs.com →
+#         testguard-cli → Settings → Trusted Publisher: raccioly/testguard,
+#         workflow release.yml. Every later release is OIDC.
+#   PyPI: pypi.org → Your account → Publishing → add a PENDING publisher for
+#         project testguard-cli: owner raccioly, repo testguard, workflow
+#         release.yml, environment pypi. The first release creates the project.
+
+on:
+  workflow_dispatch: # manual recovery
+  schedule:
+    - cron: '17 * * * *' # hourly sweep: publishes any merged version bump the push event missed
+  push:
+    branches: [main]
+
+permissions:
+  contents: write # tags + releases
+
+concurrency:
+  group: testguard-release
+  cancel-in-progress: false
+
+jobs:
+  detect-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.check.outputs.version }}
+      changed: ${{ steps.check.outputs.changed }}
+      tag_missing: ${{ steps.check.outputs.tag_missing }}
+      npm_missing: ${{ steps.check.outputs.npm_missing }}
+      pypi_missing: ${{ steps.check.outputs.pypi_missing }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+      - name: What does this version still need?
+        id: check
+        # Each surface is gated on ITS OWN registry, not on the tag. A tag
+        # whose npm or PyPI publish failed (e.g. Trusted Publishing not yet
+        # configured) is retried by simply re-running this workflow.
+        run: |
+          CURRENT=$(node -p "require('./package.json').version")
+          TAG="v${CURRENT}"
+          echo "version=$CURRENT" >> "$GITHUB_OUTPUT"
+          if git ls-remote --tags origin "refs/tags/$TAG" | grep -q "refs/tags/$TAG$"; then TAGM=false; else TAGM=true; fi
+          if npm view "testguard-cli@${CURRENT}" version >/dev/null 2>&1; then NPMM=false; else NPMM=true; fi
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/testguard-cli/${CURRENT}/json")
+          if [ "$CODE" = "200" ]; then PYPIM=false; else PYPIM=true; fi
+          echo "tag_missing=$TAGM" >> "$GITHUB_OUTPUT"
+          echo "npm_missing=$NPMM" >> "$GITHUB_OUTPUT"
+          echo "pypi_missing=$PYPIM" >> "$GITHUB_OUTPUT"
+          if [ "$TAGM" = true ] || [ "$NPMM" = true ] || [ "$PYPIM" = true ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "✅ $TAG — tag missing: $TAGM · npm missing: $NPMM · PyPI missing: $PYPIM"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "⏭️ $TAG is fully released everywhere — nothing to do"
+          fi
+
+  test:
+    needs: detect-version
+    if: needs.detect-version.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - run: npm ci
+      - run: npm test
+      - name: Self-probe must be fully defended before anything ships
+        run: node cli/testguard.mjs probe . --budget 180000 --out "$RUNNER_TEMP/self-evidence.json" --quiet
+      - name: Version surfaces are in sync
+        run: node .github/scripts/sync-release-version.mjs --check
+
+  create-release:
+    needs: [detect-version, test]
+    if: needs.detect-version.outputs.changed == 'true'
+    # Runs even when the tag exists: every step inside is idempotent.
+    runs-on: ubuntu-latest
+    outputs:
+      tag: v${{ needs.detect-version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Create and push tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v${{ needs.detect-version.outputs.version }}"
+          if git ls-remote --tags origin | grep -q "refs/tags/$TAG$"; then
+            echo "✅ Tag $TAG already exists on remote"
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag -a "$TAG" -m "Release $TAG"
+            git push origin "$TAG"
+          fi
+      - name: Release notes from CHANGELOG
+        run: |
+          VERSION="${{ needs.detect-version.outputs.version }}"
+          NOTES=$(awk "/^## \\[${VERSION}\\]/{found=1; next} /^## \\[/{if(found) exit} found{print}" CHANGELOG.md)
+          [ -n "$NOTES" ] || NOTES="Release v${VERSION} — see CHANGELOG.md."
+          printf '%s\n' "$NOTES" > /tmp/release-notes.md
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v${{ needs.detect-version.outputs.version }}"
+          gh release view "$TAG" >/dev/null 2>&1 && { echo "✅ Release $TAG exists"; exit 0; }
+          gh release create "$TAG" --title "TestGuard $TAG" --notes-file /tmp/release-notes.md --latest
+
+  publish-npm:
+    needs: [detect-version, test, create-release]
+    if: needs.detect-version.outputs.npm_missing == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # mints the OIDC token for npm Trusted Publishing
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # NO registry-url on purpose: with it, setup-node writes an _authToken
+      # line that expands to an EMPTY token when NODE_AUTH_TOKEN is unset, and
+      # npm then sends that instead of attempting OIDC.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - run: npm install -g npm@11
+      - name: Assert Trusted Publishing preconditions
+        run: |
+          NPM_V=$(npm --version)
+          echo "node=$(node -p 'process.versions.node') npm=$NPM_V"
+          node -e '
+            const [maj, min] = process.versions.node.split(".").map(Number);
+            if (!(maj > 22 || (maj === 22 && min >= 14))) { console.error("::error::Node below the 22.14.0 floor npm Trusted Publishing requires."); process.exit(1); }
+          '
+          node -e '
+            const v = process.argv[1].split(".").map(Number);
+            if (!(v[0] > 11 || (v[0] === 11 && (v[1] > 5 || (v[1] === 5 && v[2] >= 1))))) { console.error("::error::npm below the 11.5.1 floor npm Trusted Publishing requires."); process.exit(1); }
+          ' "$NPM_V"
+          [ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ] || { echo "::error::no OIDC token endpoint — job lacks id-token: write"; exit 1; }
+      - name: Publish (provenance is automatic under Trusted Publishing)
+        run: npm publish --loglevel verbose
+
+  publish-pypi:
+    needs: [detect-version, test, create-release]
+    if: needs.detect-version.outputs.pypi_missing == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Sync version into pyproject.toml
+        run: |
+          VERSION="${{ needs.detect-version.outputs.version }}"
+          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+          grep '^version' pyproject.toml
+      - run: pip install build
+      - run: python -m build
+      - name: Assert OIDC token is available
+        run: '[ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ] || { echo "::error::no OIDC token endpoint"; exit 1; }'
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

testguard_cli-0.1.0/.github/workflows/scheduled-release.yml

@@ -0,0 +1,121 @@
+name: Scheduled Release
+
+# Weekly: if anything releasable merged since the last tag, bump the patch
+# version, write the CHANGELOG entry, sync every version surface, verify the
+# tree is green, and open a release PR with auto-merge armed. Once merged, the
+# hourly sweep in release.yml tags and publishes.
+#
+# GITHUB_TOKEN-created PRs do not trigger `pull_request` workflows, so CI on
+# the release PR must be started by the maintainer:
+#     gh workflow run ci.yml --ref release/vX.Y.Z
+# After it goes green, auto-merge completes.
+
+on:
+  schedule:
+    - cron: '0 9 * * 1' # Mondays 09:00 UTC
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Version bump'
+        type: choice
+        options: [patch, minor]
+        default: patch
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: scheduled-release
+  cancel-in-progress: false
+
+jobs:
+  cut-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+
+      - name: Check for unreleased changes
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          CURRENT=$(node -p "require('./package.json').version")
+          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
+          if ! git ls-remote --tags origin "refs/tags/v$CURRENT" | grep -q "refs/tags/v$CURRENT$"; then
+            echo "v$CURRENT is not published — dispatching the idempotent release."
+            gh workflow run release.yml --ref main
+            echo "changed=false" >> "$GITHUB_OUTPUT"; exit 0
+          fi
+          if [ -z "$LAST_TAG" ]; then echo "changed=false" >> "$GITHUB_OUTPUT"; exit 0; fi
+          COMMITS=$(git log "${LAST_TAG}..HEAD" --oneline | grep -viE '^[0-9a-f]+ (release|chore\(release\)):' || true)
+          COUNT=$(echo "$COMMITS" | grep -c . || true)
+          echo "Last tag: $LAST_TAG — releasable commits since: $COUNT"
+          echo "$COMMITS"
+          if [ "$COUNT" -eq 0 ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "last_tag=$LAST_TAG" >> "$GITHUB_OUTPUT"
+            echo "$COMMITS" > /tmp/commits.txt
+          fi
+
+      - name: Bump version and write changelog
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          BUMP="${{ inputs.bump || 'patch' }}"
+          OLD="${{ steps.check.outputs.current }}"
+          NEW=$(node -e "const [a,b,c]='$OLD'.split('.').map(Number); console.log('$BUMP'==='minor' ? \`\${a}.\${b+1}.0\` : \`\${a}.\${b}.\${c+1}\`)")
+          echo "Bumping $OLD → $NEW"
+          node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='$NEW';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
+          npm install --package-lock-only --ignore-scripts
+          {
+            echo "## [$NEW] - $(date -u +%Y-%m-%d)"; echo
+            echo "Automated weekly release — everything merged since \`${{ steps.check.outputs.last_tag }}\`."; echo
+            echo "### Changed"; echo
+            sed -E 's/^[0-9a-f]+ /- /' /tmp/commits.txt; echo
+          } > /tmp/entry.md
+          awk '/^## \[Unreleased\]/ { print; print ""; while ((getline line < "/tmp/entry.md") > 0) print line; next } { print }' CHANGELOG.md > /tmp/CHANGELOG.new && mv /tmp/CHANGELOG.new CHANGELOG.md
+          node .github/scripts/sync-release-version.mjs
+          echo "NEW_VERSION=$NEW" >> "$GITHUB_ENV"
+
+      - name: Verify the tree is still green
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          npm ci
+          npm test
+          node cli/testguard.mjs probe . --budget 180000 --quiet --out "$RUNNER_TEMP/self.json"
+
+      - name: Open release PR with auto-merge armed
+        if: steps.check.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="release/v${NEW_VERSION}"
+          # Only release surfaces may change in a release PR.
+          CHANGED=$(git diff --name-only HEAD --)
+          for f in $CHANGED; do
+            case "$f" in package.json|package-lock.json|pyproject.toml|CHANGELOG.md|action.yml|packaging/homebrew/testguard.rb) ;;
+              *) echo "::error::unexpected file in release diff: $f"; exit 1;;
+            esac
+          done
+          if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+            echo "::error::branch $BRANCH already exists; refusing to overwrite"; exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          git add -A
+          git commit -m "release: v${NEW_VERSION} — automated weekly batch"
+          git push origin "$BRANCH"
+          printf 'Automated weekly release. Version bump + CHANGELOG entry + synced version surfaces. Merging tags and publishes to npm and PyPI via release.yml.\n\nCI does not start automatically on PRs opened by GITHUB_TOKEN. Run:\n\n    gh workflow run ci.yml --ref %s\n\nAuto-merge is armed; it completes once the required checks pass.\n' "$BRANCH" > /tmp/pr-body.md
+          PR=$(gh pr create --base main --head "$BRANCH" --title "release: v${NEW_VERSION} — automated weekly batch" --body-file /tmp/pr-body.md)
+          gh pr merge --auto --squash "$PR"
+          echo "Release PR: $PR"

testguard_cli-0.1.0/.github/workflows/supply-chain.yml

@@ -0,0 +1,24 @@
+name: Supply-Chain Security
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '30 12 * * 1' # Mondays 12:30 UTC
+  push:
+    branches: [main]
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  osv-scan-pr:
+    if: github.event_name == 'pull_request'
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67" # v2.5.1
+
+  osv-scan-scheduled:
+    if: github.event_name != 'pull_request'
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67" # v2.5.1