mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-23 20:26:10 +00:00
Oliver Kieselbach
224eb668a1
The web app kept helpers in two root folders (lib/ and utils/) and named route-local helper folders either utils/ or lib/. Shared helpers now live in lib/, route-only helpers in a lib/ next to their route (app/dashboard/lib, app/sessions/lib). Generated wire types, manifests, guardrails, error codes and the lastmod file move to lib/generated/, like the MCP server's src/generated/. The session-search parity cases sit next to sessionSearchQuery.ts. Pure move, no behaviour change. Imports, the generators (combine.js, generate-shared-manifest-types.js, sync-error-codes.js, generate-lastmod.js), the CI drift paths, the two backend tests and the MCP freshness test that read these files, and the guard tests' registry path and scan list follow the new locations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
name: Validate & Combine Rules
|
|
on:
|
|
push:
|
|
branches: [main, dev]
|
|
paths:
|
|
- 'rules/gather/**'
|
|
- 'rules/analyze/**'
|
|
- 'rules/ime-log-patterns/**'
|
|
- 'rules/schema/**'
|
|
- 'rules/scripts/**'
|
|
- 'rules/guardrails.json'
|
|
pull_request:
|
|
paths:
|
|
- 'rules/gather/**'
|
|
- 'rules/analyze/**'
|
|
- 'rules/ime-log-patterns/**'
|
|
- 'rules/schema/**'
|
|
- 'rules/scripts/**'
|
|
- 'rules/guardrails.json'
|
|
|
|
jobs:
|
|
validate-and-combine:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: '22'
|
|
|
|
# Lockfile and no lifecycle scripts: this job holds contents:write and pushes to
|
|
# main, so an install-time script from a hijacked package would run with a token that
|
|
# can rewrite the repository. rules/scripts/package-lock.json pins ajv, ajv-formats
|
|
# and every transitive package (Dependabot keeps it current); ajv is pure JS and
|
|
# needs no install hooks.
|
|
- name: Install the rules validator from the lockfile
|
|
working-directory: rules/scripts
|
|
run: npm ci --ignore-scripts
|
|
|
|
# Gather, analyze and IME log pattern files plus guardrails.json, each against its
|
|
# schema; the guardrails schema is what keeps a "data" PR from becoming code in the
|
|
# generated TypeScript (see validate.js).
|
|
- name: Validate rules and guardrails against their schemas
|
|
run: node rules/scripts/validate.js
|
|
|
|
- name: Combine rules into dist/
|
|
run: node rules/scripts/combine.js
|
|
|
|
# Plain git instead of a third-party action: this step runs with contents:write on
|
|
# main, so no code we do not control gets to push. Checkout leaves the job's
|
|
# GITHUB_TOKEN in the remote credential helper, which is all `git push` needs.
|
|
# NOTE: combine.js writes THREE outputs; committing only dist/ would silently discard
|
|
# the two generated TS modules and leave the guardrails-in-sync CI check red.
|
|
- name: Commit generated outputs
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git add -- rules/dist/ \
|
|
src/Web/autopilot-monitor-web/lib/generated/guardrails.generated.ts \
|
|
src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts
|
|
if git diff --cached --quiet; then
|
|
echo "Generated outputs unchanged - nothing to commit"
|
|
exit 0
|
|
fi
|
|
git commit -m "chore: regenerate rules/dist + generated TS from individual files"
|
|
git push origin HEAD:main
|