S0334-shared-scripts-consolidation: the canonical shared scripts, published from @cosyte/process - #109
Merged
Conversation
…ocess bin The canonical version sync, published from @cosyte/process so a repo executes it instead of carrying a copy. Five numbered conditions: the manifest version, exactly one column-0 VERSION declaration, a literal splice rather than a replacement pattern, an idempotent run that writes nothing, and an exit vocabulary closed at 0 and 1. Adds the entry-point surface the bin dispatches ahead of the verbs, plus the ustar writer, the YAML subset and the trigger-surface data the next two tasks consume.
Two tarballs into an output directory named by the first positional argument, default dist-artifacts, with the member sets the contract names. It fails fast: every required input is checked before the output directory is created, so a refused run leaves no half-built artifact set for a release job to pick up. The archives are read back in the tests with the system tar, not with the writer that produced them.
…face, as data plus a grader A workflow only runs from the repository's own .github/workflows directory, so what consolidates is the definition of what those files must say: the canonical trigger surface is published from @cosyte/process, and a caller text is graded against it element by element. A file that exists, parses and has lost its schedule is reported, never passed; scorecard's absence of a pull_request trigger is an element like any other. Also grades this repository's own canonical caller texts under scripts/parser-template against that same data, so the scaffold every parser copies cannot drift away from what consumers grade against, and proves the five numbered version-sync conditions are each named by a test.
… the trigger surface The README documents them where the five verbs are: the invocations, the five numbered conditions a sync-version refusal names, what pack-docs checks before it writes anything, and the trigger surface with its grader, whose example the snippet harness executes against this repository's own sources. The changeset is a patch rather than a minor while 0.1.0 is pending: the release plan is carried to that line by exactly one minor changeset, and a concurrent item queues the weaker type, which resolves to the same version.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…one descriptor CodeQL's js/file-system-race on the first run of this branch, twice: a file described by path and then read by path is two files as far as the filesystem is concerned, so the archive could carry one file's bytes under another's metadata. Both the packer and the idempotence test now take a descriptor and read the metadata and the bytes through it.
…fusal Impl gate ordinal 1, findings F2 (blocking), F3 and F4 (advisory). runEntryPoint converted only its own two error types and rethrew everything else, so an ordinary I/O failure left the bin as an unhandled exception naming neither the entry point nor an action available. Every failure now carries the contracted shape: the path, the entry point, what the system reported in structural terms, the action available, exit 1, stdout empty. The thrown error's own message is described rather than restated, because an arbitrary message can carry the bytes of a file the entry point read. pack-docs builds both archives before it creates the output directory, so a member the tarball format cannot carry refuses with the tree exactly as it was found rather than with docs-content.tar.gz already sitting where a release job would pick it up. That member is this command's own refusal now, naming the member and the action. The version declaration's value runs to the first quote, which is the form the contract quotes as the floor. A wider value matched a declaration line carrying a trailing comment that ends in the same two characters, and spliced the manifest version over the comment: source text deleted where a refusal was owed. Each of the five added tests was run red against the unfixed sources first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec:
pipeline/active/S0334-shared-scripts-consolidation/spec.md. The item isrepos: [config]: the hl7 adoption slice left by conductor ruling (pipeline/active/S0334-shared-scripts-consolidation/conductor-ruling-split-the-hl7-slice-off-the-refuted-scripts.md), because it can only be built against a published@cosyte/processversion this PR has not shipped yet. The config child's criteria are folded into the spec as AC-C1 through AC-C11.config becomes the one place the estate's small shared scripts live. Two entry points join the existing
cosyte-processbin, and the canonical trigger surface of the two security-workflow callers is published from the same package as data.What this adds
cosyte-process sync-version(AC-C1, AC-C3, AC-C4): writespackage.json's version into the exportedVERSIONconstant insrc/index.ts. Five numbered conditions, named by every refusal and documented in the README: a usable manifest version, exactly one declaration of the formexport const VERSION: string = "<value>";anchored at column 0 anywhere in the file, a literal splice (a version carrying$&or$1is written character for character), an idempotent run that does not touch an already-synced file, and an exit vocabulary closed at 0 and 1.cosyte-process pack-docs [outputdir](AC-C5, AC-C6): buildsdocs-content.tar.gzandsource.tar.gzinto an output directory defaulting todist-artifacts, with the member sets the contract names. Every required input is checked and both archives are built before the output directory is created, so a refused run leaves nothing half-built. The archives are written withnode:zliband a small ustar writer, so notarbinary has to be on PATH; the tests read them back with the systemtarrather than with the writer that produced them.SECURITY_WORKFLOW_SURFACES,gradeWorkflowText,gradeWorkflowFile,gradeSecurityWorkflows. A pass means every element was found and equal; that the file exists is not one of the elements, andscorecard.ymlcarrying nopull_requesttrigger is an element in the same way ascodeql.ymlcarrying one.scripts/parser-template/.github/workflows/are graded against that data (AC-C9), so the scaffold every parser copies cannot drift away from what consumers grade against.What this does not change
Neither entry point is a verb (AC-C7, AC-6):
cosyte-process checkgrades the same five scripts, any present reserved variants and the override file, and the override file's accepted top-level keys staybuild,test,lint,typecheck,format. An override namingsync-versionorpack-docsis refused exactly as any other unknown key is, by every verb. No new dependency, no new workflow, and no file deleted: neither.github/workflows/norscripts/parser-template/is touched by this diff, so no element of the canonical security-scanning trigger surface moves.Gates
Green locally on
4f9cc2dagainstmainat0d55911:pnpm test: root 37 files / 1023 passed;@cosyte/process12 files / 225 passed;@cosyte/script-utils17;@cosyte/test-utils195.pnpm drift:1 matching, 0 with drift, 23 skipped, of 24 repo(s), identical to the same command run onorigin/main.pnpm drift:validate,pnpm check:no-emdash,pnpm format:check,pnpm typecheck,pnpm lint,pnpm build,node scripts/readme-check.mjs,node scripts/changeset-guard.mjs: all green.