testguard-cli 0.7.0__tar.gz → 0.8.1__tar.gz

testguard_cli-0.8.1/.github/scripts/check-cost-budget.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * Fail CI when the self-probe gate outgrows its budget.
+ *
+ * The decision lives in `src/probe/cost.mjs` as a pure function, unit-tested
+ * and covered by a self-claim; this script is only wiring — read the evidence,
+ * read the budget, print, choose an exit code.
+ *
+ * usage: check-cost-budget.mjs <evidence.json> [previous-evidence.json]
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { costReport, checkCostBudget, renderCostBudget } from '../../src/probe/cost.mjs';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const [evidencePath, previousPath] = process.argv.slice(2);
+if (!evidencePath) {
+  console.error('usage: check-cost-budget.mjs <evidence.json> [previous-evidence.json]');
+  process.exit(2);
+}
+
+const read = (p) => JSON.parse(readFileSync(resolve(p), 'utf8'));
+const budget = read(join(ROOT, 'testguard.cost-budget.json'));
+
+// A previous run is informational only. Its absence must never fail the check:
+// the first run on a branch, or a cold cache, has nothing to compare against.
+let previousMs;
+if (previousPath) {
+  try {
+    previousMs = costReport(read(previousPath).records).totalMs;
+  } catch {
+    previousMs = undefined;
+  }
+}
+
+const decision = checkCostBudget(costReport(read(evidencePath).records), { budgetSeconds: budget.seconds, previousMs });
+const text = renderCostBudget(decision);
+console.log(text);
+if (!decision.ok) {
+  console.log(`::error::${text.split('\n')[0]}`);
+  process.exit(1);
+}

testguard_cli-0.8.1/.github/scripts/sync-release-version.mjs

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+/**
+ * package.json is the single source of truth for the version. Every other
+ * surface that carries it is synced from there:
+ *   - pyproject.toml         `version = "x.y.z"`
+ *   - action.yml             default of the `version` input
+ *   - packaging/homebrew/*.rb the tarball URL; the `sha256` is set by `--sha256`
+ *                            from the PUBLISHED tarball (release.yml, after npm)
+ *   - packaging/gitlab/*.yml  the include URL tag and the `version` input default
+ *   - README.md               the GitHub Action reference AND the GitLab include URL
+ *
+ * A file may carry more than one form, and each needs its own entry: README
+ * holds both the `raccioly/testguard@vX.Y.Z` action reference and the
+ * `testguard/vX.Y.Z/packaging` template URL. Only the first was listed, so
+ * v0.6.0 shipped with both README copies of the GitLab URL left at v0.5.0
+ * while `--check` reported "all version surfaces at 0.6.0" — a surface this
+ * script was never told to look at cannot drift in its eyes.
+ *
+ * The Homebrew `sha256` is the same lesson one step further: the URL was a
+ * surface, the hash beside it was a comment telling a human to run curl. It
+ * carried 385d69f9… unchanged across v0.6.0, v0.7.0 and v0.8.0 — a hash
+ * matching none of them. So the hash is now a surface too, with three modes:
+ *
+ *   --check            offline: every version surface at package.json's version,
+ *                      the formula's sha256 is 64 hex and not the known-stale
+ *                      placeholder. Used by release.yml's test job (before the
+ *                      tag, when the tarball cannot exist yet) and prepublishOnly.
+ *   --check --online   additionally downloads the tarball the formula names and
+ *                      requires its sha256 to match. Used by release.yml's
+ *                      detect-version (is the formula still owed?) and by the
+ *                      sha job as a post-condition before it opens the PR.
+ *   --sha256           waits for the tarball to become downloadable (bounded by
+ *                      --wait), computes its sha256 and writes it into the
+ *                      formula — only when the value changes. Exit 1 on timeout
+ *                      or on a 200 that is not a gzip tarball: a hashed error
+ *                      page would poison the formula, and "never optimistic".
+ *
+ * The hash is always computed from the REGISTRY tarball — what Homebrew will
+ * download — never from a local `npm pack`: a provenance-signed publish can
+ * differ byte for byte from the pack output.
+ *
+ *   --list-surfaces    print every file this script may write, one per line. The
+ *                      release workflows allow-list exactly these (plus
+ *                      package.json, package-lock.json and CHANGELOG.md, which
+ *                      the bump writes directly), so a surface added above can
+ *                      never again be rejected as an "unexpected file in the
+ *                      release diff" — which is what stopped every weekly
+ *                      release after the GitLab template became a surface.
+ *   --registry <url>   registry base (default https://registry.npmjs.org); the
+ *                      tests point it at a local server so `npm test` is offline.
+ *   --wait <s>         how long --sha256 keeps polling (default 900).
+ *   --interval <s>     seconds between polls (default 15).
+ *   --timeout <s>      per-request timeout (default 60): a registry that accepts the
+ *                      connection and never answers is a failed attempt, not a hang.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const root = resolve(process.argv[1], '..', '..', '..');
+const argv = process.argv.slice(2);
+const flag = (name) => argv.includes(name);
+const option = (name, fallback) => {
+  const i = argv.indexOf(name);
+  return i === -1 ? fallback : argv[i + 1];
+};
+const check = flag('--check');
+const listSurfaces = flag('--list-surfaces');
+const online = flag('--online');
+const setSha = flag('--sha256');
+const registry = (option('--registry', 'https://registry.npmjs.org')).replace(/\/+$/, '');
+const waitSeconds = Number(option('--wait', '900'));
+const intervalSeconds = Number(option('--interval', '15'));
+const timeoutSeconds = Number(option('--timeout', '60'));
+if (!Number.isFinite(waitSeconds) || waitSeconds < 0) throw new Error(`--wait must be a non-negative number of seconds, got ${option('--wait')}`);
+if (!Number.isFinite(intervalSeconds) || intervalSeconds < 0) throw new Error(`--interval must be a non-negative number of seconds, got ${option('--interval')}`);
+if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) throw new Error(`--timeout must be a positive number of seconds, got ${option('--timeout')}`);
+
+const version = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')).version;
+if (!/^\d+\.\d+\.\d+$/.test(version)) throw new Error(`package.json version is not a stable semver: ${version}`);
+
+const FORMULA = 'packaging/homebrew/testguard.rb';
+const formulaPath = resolve(root, FORMULA);
+/** The hash the formula carried, unchanged, from v0.6.0 through v0.8.0. It matches no published tarball. */
+const KNOWN_STALE_SHA256 = '385d69f9d3c153b934d9c1cb6a2c754eb9b221b0a8c0ba8b805858384d2d4678';
+const SHA_LINE = /^(\s*sha256 ")([^"]*)(")/m;
+const TARBALL = `testguard-cli-${version}.tgz`;
+const tarballUrl = `${registry}/testguard-cli/-/${TARBALL}`;
+
+const surfaces = [
+  ['pyproject.toml', /^version = "[^"]+"/m, `version = "${version}"`],
+  ['action.yml', /(\n  version:\n    description: [^\n]*\n    required: false\n    default: ')[^']*(')/, `$1${version}$2`],
+  [FORMULA, /testguard-cli-\d+\.\d+\.\d+\.tgz/g, TARBALL],
+  ['README.md', /raccioly\/testguard@v\d+\.\d+\.\d+/g, `raccioly/testguard@v${version}`],
+  ['README.md', /testguard\/v\d+\.\d+\.\d+\/packaging/g, `testguard/v${version}/packaging`],
+  ['packaging/gitlab/testguard.gitlab-ci.yml', /testguard\/v\d+\.\d+\.\d+\/packaging/g, `testguard/v${version}/packaging`],
+  ['packaging/gitlab/testguard.gitlab-ci.yml', /(\n    version:\n      description: [^\n]*\n      default: ")\d+\.\d+\.\d+(")/, `$1${version}$2`],
+];
+
+if (listSurfaces) {
+  // Derived from the same table the writes use, so the two cannot disagree.
+  for (const rel of [...new Set(surfaces.map(([rel]) => rel))]) console.log(rel);
+  process.exit(0);
+}
+
+/** The formula's current `sha256 "…"` value, or a throw when the line is missing. */
+function formulaSha256() {
+  const m = SHA_LINE.exec(readFileSync(formulaPath, 'utf8'));
+  if (!m) throw new Error(`${FORMULA}: sha256 line not found`);
+  return m[2];
+}
+
+/**
+ * One GET of the tarball. Returns `{ status, sha256 }`; `sha256` is set only
+ * for a 200 whose body starts with the gzip magic (1f 8b) — a registry error
+ * page with a 200 status is treated as "not a tarball", never hashed.
+ */
+async function fetchTarball() {
+  const res = await fetch(tarballUrl, { redirect: 'follow', signal: AbortSignal.timeout(timeoutSeconds * 1000) });
+  if (res.status !== 200) return { status: res.status };
+  const body = Buffer.from(await res.arrayBuffer());
+  if (body.length < 2 || body[0] !== 0x1f || body[1] !== 0x8b) return { status: 200, notTarball: true, bytes: body.length };
+  return { status: 200, sha256: createHash('sha256').update(body).digest('hex'), bytes: body.length };
+}
+
+const sleep = (s) => new Promise((r) => setTimeout(r, s * 1000));
+
+/**
+ * Polls until the tarball downloads as a gzip, or the wait runs out. Every
+ * non-200 and every network error counts as "not yet": the registry answers
+ * `PUT 202` to a publish and can take minutes to serve the file.
+ */
+async function waitForTarball() {
+  const deadline = Date.now() + waitSeconds * 1000;
+  let attempt = 0;
+  for (;;) {
+    attempt++;
+    let result;
+    try {
+      result = await fetchTarball();
+    } catch (e) {
+      result = { status: 0, error: e.message };
+    }
+    if (result.sha256) return result;
+    const why = result.notTarball ? `200 but not a gzip tarball (${result.bytes} bytes)` : result.error ? `network error: ${result.error}` : `HTTP ${result.status}`;
+    if (Date.now() >= deadline) throw new Error(`${tarballUrl}: not downloadable after ${attempt} attempt(s) over ${waitSeconds}s — last: ${why}`);
+    console.error(`${TARBALL}: ${why}; retrying in ${intervalSeconds}s (attempt ${attempt})`);
+    await sleep(intervalSeconds);
+  }
+}
+
+if (setSha) {
+  const { sha256, bytes } = await waitForTarball();
+  const before = readFileSync(formulaPath, 'utf8');
+  const current = formulaSha256();
+  if (current === sha256) {
+    console.log(`${FORMULA}: sha256 unchanged (${sha256}, ${bytes} bytes)`);
+  } else {
+    writeFileSync(formulaPath, before.replace(SHA_LINE, `$1${sha256}$3`));
+    if (formulaSha256() !== sha256) throw new Error(`${FORMULA}: sha256 line did not take the new value`);
+    console.log(`${FORMULA}: sha256 ${current} -> ${sha256} (${bytes} bytes from ${tarballUrl})`);
+  }
+  process.exit(0);
+}
+
+let drift = 0;
+for (const [rel, pattern, replacement] of surfaces) {
+  const path = resolve(root, rel);
+  const before = readFileSync(path, 'utf8');
+  if (!pattern.test(before)) throw new Error(`${rel}: version pattern not found`);
+  const after = before.replace(pattern, replacement);
+  if (after === before) continue;
+  drift++;
+  if (check) console.error(`${rel}: out of sync with package.json ${version}`);
+  else { writeFileSync(path, after); console.log(`${rel}: synced to ${version}`); }
+}
+
+if (check) {
+  const sha = formulaSha256();
+  if (!/^[0-9a-f]{64}$/.test(sha)) { drift++; console.error(`${FORMULA}: sha256 is not 64 hex characters: "${sha}"`); }
+  else if (sha === KNOWN_STALE_SHA256) { drift++; console.error(`${FORMULA}: sha256 is the known-stale placeholder ${sha.slice(0, 8)}… (matches no published tarball); run --sha256 after publishing`); }
+  if (online) {
+    let result;
+    try {
+      result = await fetchTarball();
+    } catch (e) {
+      result = { status: 0, error: e.message };
+    }
+    if (!result.sha256) { drift++; console.error(`${FORMULA}: tarball not downloadable — ${tarballUrl}: ${result.error ?? (result.notTarball ? '200 but not a gzip tarball' : `HTTP ${result.status}`)}`); }
+    else if (result.sha256 !== sha) { drift++; console.error(`${FORMULA}: sha256 ${sha} does not match the published tarball ${result.sha256} (${tarballUrl})`); }
+    else console.log(`${FORMULA}: sha256 matches ${tarballUrl}`);
+  }
+}
+if (check && drift) process.exit(1);
+if (check) console.log(`all version surfaces at ${version}`);

{testguard_cli-0.7.0 → testguard_cli-0.8.1}/.github/workflows/auto-merge.yml

@@ -46,7 +46,14 @@ jobs:
 
             const { data: files } = await github.rest.pulls.listFiles({ owner, repo, pull_number: num, per_page: 300 });
             const paths = files.map((f) => f.filename);
-            const RELEASE_SURFACES = new Set(['package.json', 'package-lock.json', 'pyproject.toml', 'CHANGELOG.md', 'action.yml', 'packaging/homebrew/testguard.rb', 'README.md']);
+            // Deliberately spelled out, not derived: this is the gate that merges
+            // without human review, so what a bot may touch stays readable here
+            // and is not computed from code the PR itself could change. Keep it
+            // in step with `sync-release-version.mjs --list-surfaces` plus the
+            // three files the bump writes — test/release-sync.test.mjs fails if
+            // a surface is missing, which is how the GitLab template's absence
+            // (it would have held every release PR for review) was found.
+            const RELEASE_SURFACES = new Set(['package.json', 'package-lock.json', 'pyproject.toml', 'CHANGELOG.md', 'action.yml', 'packaging/homebrew/testguard.rb', 'README.md', 'packaging/gitlab/testguard.gitlab-ci.yml']);
 
             if (author === 'dependabot[bot]') {
               const m = /from (\d+)\.(\d+)\.\S+ to (\d+)\.(\d+)\./.exec(pr.title || '');

{testguard_cli-0.7.0 → testguard_cli-0.8.1}/.github/workflows/ci.yml

@@ -210,6 +210,14 @@ jobs:
         if: matrix.node-version == 22
         run: node cli/testguard.mjs probe . --budget 180000 --no-escalate --cost --out .testguard/ci-self-evidence.json
 
+      # The gate went 9.6 -> 23.6 min across one merged PR and nothing said a
+      # word, because --cost only ever printed into a log. `always()` so the
+      # cost is reported even when the probe itself failed: a run that got
+      # slower AND found a survivor should say both, not just the second.
+      - name: The gate must stay inside its cost budget
+        if: always() && matrix.node-version == 22
+        run: node .github/scripts/check-cost-budget.mjs .testguard/ci-self-evidence.json
+
       # A stable, branch-named artifact so a developer can fetch the evidence
       # CI produced without knowing a run id (README: read CI's evidence
       # locally). One Node leg is enough; the verdicts are identical.

{testguard_cli-0.7.0 → testguard_cli-0.8.1}/.github/workflows/release.yml

@@ -36,6 +36,7 @@ jobs:
       tag_missing: ${{ steps.check.outputs.tag_missing }}
       npm_missing: ${{ steps.check.outputs.npm_missing }}
       pypi_missing: ${{ steps.check.outputs.pypi_missing }}
+      brew_missing: ${{ steps.check.outputs.brew_missing }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -45,6 +46,13 @@ jobs:
         # Each surface is gated on ITS OWN registry, not on the tag. A tag
         # whose npm or PyPI publish failed (e.g. Trusted Publishing not yet
         # configured) is retried by simply re-running this workflow.
+        #
+        # The Homebrew formula's sha256 is a surface too, gated on the registry
+        # tarball it names: `--check --online` downloads it and compares. It is
+        # owed (brew_missing=true) until npm serves the tarball AND the formula
+        # on main carries its hash — so a failed sha job is retried by the
+        # hourly sweep exactly like a failed publish. It does not set `changed`:
+        # only tag/npm/PyPI need the test job and the publish jobs.
         run: |
           CURRENT=$(node -p "require('./package.json').version")
           TAG="v${CURRENT}"
@@ -53,12 +61,17 @@ jobs:
           if npm view "testguard-cli@${CURRENT}" version >/dev/null 2>&1; then NPMM=false; else NPMM=true; fi
           CODE=$(curl -s -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/testguard-cli/${CURRENT}/json")
           if [ "$CODE" = "200" ]; then PYPIM=false; else PYPIM=true; fi
+          if node .github/scripts/sync-release-version.mjs --check --online; then BREWM=false; else BREWM=true; fi
           echo "tag_missing=$TAGM" >> "$GITHUB_OUTPUT"
           echo "npm_missing=$NPMM" >> "$GITHUB_OUTPUT"
           echo "pypi_missing=$PYPIM" >> "$GITHUB_OUTPUT"
+          echo "brew_missing=$BREWM" >> "$GITHUB_OUTPUT"
           if [ "$TAGM" = true ] || [ "$NPMM" = true ] || [ "$PYPIM" = true ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
-            echo "✅ $TAG — tag missing: $TAGM · npm missing: $NPMM · PyPI missing: $PYPIM"
+            echo "✅ $TAG — tag missing: $TAGM · npm missing: $NPMM · PyPI missing: $PYPIM · Homebrew sha256 owed: $BREWM"
+          elif [ "$BREWM" = true ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "✅ $TAG is published everywhere; only the Homebrew sha256 is owed"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "⏭️ $TAG is fully released everywhere — nothing to do"
@@ -82,6 +95,12 @@ jobs:
       - name: Self-probe must be fully defended before anything ships
         run: node cli/testguard.mjs probe . --budget 180000 --out "$RUNNER_TEMP/self-evidence.json" --quiet --cost
       - name: Version surfaces are in sync
+        # Offline on purpose. Before the tag the tarball for this version
+        # cannot exist, so `--online` would say nothing in the normal path and
+        # would DEADLOCK the recovery path: npm published, the sha job failed,
+        # the formula still stale — an online check here fails and the job
+        # that fixes the formula never runs. The online comparison lives in
+        # detect-version (is it owed?) and in homebrew-sha (did it take?).
         run: node .github/scripts/sync-release-version.mjs --check
 
   create-release:
@@ -177,3 +196,113 @@ jobs:
       - name: Assert OIDC token is available
         run: '[ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ] || { echo "::error::no OIDC token endpoint"; exit 1; }'
       - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+
+  homebrew-sha:
+    # The formula's sha256 is set from the PUBLISHED tarball — what Homebrew
+    # will download, which a provenance-signed publish can make differ byte
+    # for byte from `npm pack` — after npm serves it (a publish is `PUT 202`;
+    # the file can take minutes to appear, so the script polls, bounded).
+    #
+    # It cannot commit to main: branch protection requires the three CI legs
+    # on every commit and github-actions[bot] is no admin. So the one-line
+    # change lands as a bot PR with native auto-merge armed, and this job
+    # dispatches ci.yml on the branch itself — a PR opened with GITHUB_TOKEN
+    # gets no pull_request run, but workflow_dispatch is the documented
+    # exception. That also means the merge triggers nothing here; the hourly
+    # sweep observes the merged formula and finds brew_missing=false.
+    #
+    # Idempotent: an existing branch is reused, an existing open PR is left
+    # alone (CI re-dispatched only if its head has no check runs), a closed
+    # PR is respected as a human decision, and a formula that already carries
+    # the published hash lands nothing.
+    needs: [detect-version, test, create-release, publish-npm]
+    if: >-
+      !cancelled()
+      && needs.detect-version.outputs.brew_missing == 'true'
+      && needs.test.result != 'failure'
+      && needs.create-release.result != 'failure'
+      && (needs.publish-npm.result == 'success' || (needs.publish-npm.result == 'skipped' && needs.detect-version.outputs.npm_missing == 'false'))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # pushes the chore/homebrew-sha-v* branch
+      pull-requests: write # opens the PR and arms auto-merge
+      actions: write # dispatches ci.yml on that branch
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Set sha256 from the published tarball; land it as an auto-merging PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${{ needs.detect-version.outputs.version }}"
+          ON_MAIN=$(node -p "require('./package.json').version")
+          if [ "$ON_MAIN" != "$VERSION" ]; then
+            echo "⏭️ main is already at v${ON_MAIN}, not v${VERSION}; that release sets its own sha256"; exit 0
+          fi
+          BRANCH="chore/homebrew-sha-v${VERSION}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+            git fetch origin "$BRANCH"
+            git checkout -B "$BRANCH" "origin/$BRANCH"
+          else
+            git checkout -b "$BRANCH"
+          fi
+
+          node .github/scripts/sync-release-version.mjs --sha256 --wait 900
+          # Post-condition: the file now on disk matches the tarball, and no
+          # other surface drifted. Nothing is pushed unless this passes.
+          node .github/scripts/sync-release-version.mjs --check --online
+
+          if git diff --quiet -- packaging/homebrew/testguard.rb; then
+            echo "✅ $BRANCH already carries the published sha256"
+          else
+            git add packaging/homebrew/testguard.rb
+            git commit -m "chore(homebrew): sha256 for v${VERSION}, from the published tarball"
+            git push origin "$BRANCH"
+          fi
+          if [ -z "$(git log --oneline origin/main..HEAD)" ]; then
+            echo "✅ main already matches the published tarball; nothing to land"; exit 0
+          fi
+
+          CLOSED=$(gh pr list --head "$BRANCH" --base main --state closed --json url,mergedAt --jq '[.[] | select(.mergedAt == null)][0].url')
+          if [ -n "$CLOSED" ]; then
+            echo "::warning::$CLOSED was closed without merging; leaving that decision alone. Delete branch $BRANCH to let the sweep retry."; exit 0
+          fi
+          PR=$(gh pr list --head "$BRANCH" --base main --state open --json url --jq '.[0].url')
+          if [ -z "$PR" ]; then
+            {
+              printf 'Automated: `sha256` of `packaging/homebrew/testguard.rb` set from the published tarball\n\n'
+              printf '    https://registry.npmjs.org/testguard-cli/-/testguard-cli-%s.tgz\n\n' "$VERSION"
+              printf 'Computed by `.github/scripts/sync-release-version.mjs --sha256` in release.yml after `npm publish`, from the registry — never from a local `npm pack`. `--check --online` confirmed the value before this PR was opened.\n\n'
+              printf 'Auto-merge is armed; CI was dispatched on this branch by the release workflow. If the checks never appear: `gh workflow run ci.yml --ref %s`.\n' "$BRANCH"
+            } > /tmp/pr-body.md
+            if PR=$(gh pr create --base main --head "$BRANCH" --title "chore(homebrew): sha256 for v${VERSION}" --body-file /tmp/pr-body.md 2>/tmp/pr-err); then
+              gh pr merge --auto --squash "$PR"
+              echo "Opened $PR"
+            else
+              cat /tmp/pr-err
+              if grep -q 'not permitted to create or approve pull requests' /tmp/pr-err; then
+                echo "::error::GITHUB_TOKEN may not open a pull request: \"GitHub Actions is not permitted to create or approve pull requests\". The branch is pushed and correct; only the PR is missing. Fix it once, in Settings -> Actions -> General -> Workflow permissions, by ticking \"Allow GitHub Actions to create and approve pull requests\" (equivalently: gh api -X PUT repos/$GITHUB_REPOSITORY/actions/permissions/workflow -F default_workflow_permissions=read -F can_approve_pull_request_reviews=true), then re-run this workflow. Until then, open it by hand: gh pr create --base main --head $BRANCH The formula on main still carries the previous release's hash until then, and detect-version will keep reporting it owed on every hourly sweep."
+              else
+                echo "::error::gh pr create failed for $BRANCH — see the output above."
+              fi
+              exit 1
+            fi
+          else
+            echo "✅ PR already open: $PR"
+          fi
+          HEAD_SHA=$(git rev-parse HEAD)
+          RUNS=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${HEAD_SHA}/check-runs" --jq '.total_count')
+          if [ "${RUNS:-0}" = "0" ]; then
+            gh workflow run ci.yml --ref "$BRANCH"
+            echo "Dispatched ci.yml on $BRANCH ($HEAD_SHA)"
+          else
+            echo "✅ $HEAD_SHA already has $RUNS check run(s)"
+          fi

{testguard_cli-0.7.0 → testguard_cli-0.8.1}/.github/workflows/scheduled-release.yml

@@ -88,10 +88,23 @@ jobs:
 
       - name: Verify the tree is still green
         if: steps.check.outputs.changed == 'true'
+        # --include-dirty is REQUIRED here, not a convenience. The step above
+        # bumped the version and synced every surface, and those writes are
+        # still uncommitted: the commit happens later, in the PR step. One of
+        # those surfaces, packaging/gitlab/testguard.gitlab-ci.yml, is the
+        # fault target of TG-GITLAB-PROBE-EXIT-PRESERVED, so the default
+        # worktree mode refuses to run at all — "1 defender/target file has
+        # uncommitted changes … worktree mode probes HEAD, so those changes
+        # would be silently ignored" (exit 2). That refusal is correct; the
+        # answer is to probe the tree we are about to release, which is what
+        # --include-dirty does (it snapshots the working tree into a scratch
+        # commit). --ignore-dirty would probe HEAD and quietly verify the
+        # PREVIOUS version instead, which is the optimistic reading this
+        # project does not take.
         run: |
           npm ci
           npm test
-          node cli/testguard.mjs probe . --budget 180000 --quiet --out "$RUNNER_TEMP/self.json"
+          node cli/testguard.mjs probe . --budget 180000 --quiet --include-dirty --out "$RUNNER_TEMP/self.json"
 
       - name: Open release PR with auto-merge armed
         if: steps.check.outputs.changed == 'true'
@@ -99,12 +112,17 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           BRANCH="release/v${NEW_VERSION}"
-          # Only release surfaces may change in a release PR.
+          # Only release surfaces may change in a release PR. The list is
+          # DERIVED from the sync script, never retyped here: when the GitLab
+          # template became a surface it was left out of the hand-written list,
+          # so the first release to reach this guard would have been rejected
+          # for writing a file the release is supposed to write. The three
+          # extras are the ones the bump step writes directly.
+          ALLOWED=$(node .github/scripts/sync-release-version.mjs --list-surfaces; printf 'package.json\npackage-lock.json\nCHANGELOG.md\n')
+          echo "Release surfaces allowed in this diff:"; printf '%s\n' "$ALLOWED" | sed 's/^/  /'
           CHANGED=$(git diff --name-only HEAD --)
           for f in $CHANGED; do
-            case "$f" in package.json|package-lock.json|pyproject.toml|CHANGELOG.md|action.yml|packaging/homebrew/testguard.rb|README.md) ;;
-              *) echo "::error::unexpected file in release diff: $f"; exit 1;;
-            esac
+            printf '%s\n' "$ALLOWED" | grep -qxF "$f" || { echo "::error::unexpected file in release diff: $f"; exit 1; }
           done
           if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
             echo "::error::branch $BRANCH already exists; refusing to overwrite"; exit 1
@@ -116,6 +134,18 @@ jobs:
           git commit -m "release: v${NEW_VERSION} — automated weekly batch"
           git push origin "$BRANCH"
           printf 'Automated weekly release. Version bump + CHANGELOG entry + synced version surfaces. Merging tags and publishes to npm and PyPI via release.yml.\n\nCI does not start automatically on PRs opened by GITHUB_TOKEN. Run:\n\n    gh workflow run ci.yml --ref %s\n\nAuto-merge is armed; it completes once the required checks pass.\n' "$BRANCH" > /tmp/pr-body.md
-          PR=$(gh pr create --base main --head "$BRANCH" --title "release: v${NEW_VERSION} — automated weekly batch" --body-file /tmp/pr-body.md)
-          gh pr merge --auto --squash "$PR"
-          echo "Release PR: $PR"
+          # A bare `gh pr create` failure here reads as a GraphQL error with no
+          # hint of the cause, which is how v0.8.1 lost its release PR after
+          # everything else in the release had succeeded.
+          if PR=$(gh pr create --base main --head "$BRANCH" --title "release: v${NEW_VERSION} — automated weekly batch" --body-file /tmp/pr-body.md 2>/tmp/pr-err); then
+            gh pr merge --auto --squash "$PR"
+            echo "Release PR: $PR"
+          else
+            cat /tmp/pr-err
+            if grep -q 'not permitted to create or approve pull requests' /tmp/pr-err; then
+              echo "::error::GITHUB_TOKEN may not open a pull request: \"GitHub Actions is not permitted to create or approve pull requests\". The branch is pushed and correct; only the PR is missing. Fix it once, in Settings -> Actions -> General -> Workflow permissions, by ticking \"Allow GitHub Actions to create and approve pull requests\" (equivalently: gh api -X PUT repos/$GITHUB_REPOSITORY/actions/permissions/workflow -F default_workflow_permissions=read -F can_approve_pull_request_reviews=true), then re-run this workflow. Until then, open it by hand: gh pr create --base main --head $BRANCH"
+            else
+              echo "::error::gh pr create failed for $BRANCH — see the output above."
+            fi
+            exit 1
+          fi