fix: keep project inventories inside repository roots (#9) #78
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v5 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.13" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: "24" | |
| - name: Set up social-preview renderer | |
| run: python -m pip install --disable-pip-version-check --no-input Pillow | |
| - name: Render canonical social preview | |
| run: python .github/render_social_preview.py | |
| - name: Validate skill pack | |
| run: python scripts/validate_skill_pack.py . --as-of 2026-08-17 | |
| - name: Verify anti-slop vendor integrity | |
| run: python scripts/verify_anti_slop_vendor.py . | |
| - name: Run TypeScript quality regressions | |
| run: python scripts/test_typescript_quality_regressions.py . | |
| - name: Verify release metadata | |
| run: python scripts/verify_release_metadata.py . | |
| - name: Run helper smoke tests | |
| run: python scripts/run_smoke_tests.py . --as-of 2026-08-17 | |
| - name: Validate installer and updater scripts | |
| run: | | |
| node --check bin/install.mjs | |
| node --check bin/toolkit.mjs | |
| node --check scripts/auto-update-runner.mjs | |
| - name: Inspect package contents | |
| shell: bash | |
| run: | | |
| npm pack --dry-run 2>&1 | tee "$RUNNER_TEMP/npm-pack.txt" | |
| grep -F 'bin/toolkit.mjs' "$RUNNER_TEMP/npm-pack.txt" | |
| grep -F 'orchestration/managed-agents.md' "$RUNNER_TEMP/npm-pack.txt" | |
| grep -F 'orchestration/workflows.md' "$RUNNER_TEMP/npm-pack.txt" | |
| - name: Test full toolkit installer and managed routing in isolation | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| temp_home="$(mktemp -d)" | |
| cat > "$temp_home/AGENTS.md" <<'EOF' | |
| # User instructions | |
| Keep this user-authored rule exactly present. | |
| EOF | |
| node bin/toolkit.mjs setup --no-auto-update --codex-home "$temp_home" | |
| test "$(find "$temp_home/skills" -mindepth 2 -maxdepth 2 -name SKILL.md | wc -l)" -eq 20 | |
| test "$(find "$temp_home/agents" -maxdepth 1 -name '*.toml' | wc -l)" -eq 6 | |
| test -f "$temp_home/codex-toolkit/workflows.md" | |
| grep -F 'Keep this user-authored rule exactly present.' "$temp_home/AGENTS.md" | |
| test "$(grep -c '<!-- codex-toolkit:start -->' "$temp_home/AGENTS.md")" -eq 1 | |
| test "$(grep -c '<!-- codex-toolkit:end -->' "$temp_home/AGENTS.md")" -eq 1 | |
| grep -F 'bug-finder' "$temp_home/AGENTS.md" | |
| grep -F 'Bug hunt — unknown defects' "$temp_home/codex-toolkit/workflows.md" | |
| agents_before="$(sha256sum "$temp_home/AGENTS.md" | cut -d' ' -f1)" | |
| workflows_before="$(sha256sum "$temp_home/codex-toolkit/workflows.md" | cut -d' ' -f1)" | |
| node bin/toolkit.mjs setup --no-auto-update --codex-home "$temp_home" | |
| test "$agents_before" = "$(sha256sum "$temp_home/AGENTS.md" | cut -d' ' -f1)" | |
| test "$workflows_before" = "$(sha256sum "$temp_home/codex-toolkit/workflows.md" | cut -d' ' -f1)" | |
| test "$(grep -c '<!-- codex-toolkit:start -->' "$temp_home/AGENTS.md")" -eq 1 | |
| - name: Verify malformed managed markers fail closed | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| temp_home="$(mktemp -d)" | |
| cat > "$temp_home/AGENTS.md" <<'EOF' | |
| # Existing user instructions | |
| preserve-me | |
| <!-- codex-toolkit:start --> | |
| incomplete managed block | |
| EOF | |
| before="$(sha256sum "$temp_home/AGENTS.md" | cut -d' ' -f1)" | |
| if node bin/toolkit.mjs setup --no-auto-update --codex-home "$temp_home"; then | |
| echo "setup unexpectedly accepted malformed managed markers" >&2 | |
| exit 1 | |
| fi | |
| test "$before" = "$(sha256sum "$temp_home/AGENTS.md" | cut -d' ' -f1)" | |
| grep -F 'preserve-me' "$temp_home/AGENTS.md" | |
| - name: Test legacy Mission Control installer | |
| shell: bash | |
| run: | | |
| temp_home="$(mktemp -d)" | |
| node bin/toolkit.mjs --codex-home "$temp_home" | |
| test -f "$temp_home/skills/delegate-with-mission-cards/SKILL.md" | |
| test "$(find "$temp_home/agents" -maxdepth 1 -name '*.toml' | wc -l)" -eq 6 | |
| test ! -e "$temp_home/AGENTS.md" | |
| - name: Validate automatic-update scheduler plan | |
| shell: bash | |
| run: | | |
| temp_home="$(mktemp -d)" | |
| node bin/toolkit.mjs auto-update install --dry-run --codex-home "$temp_home" | |
| - name: Validate immutable-release update runner | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| runner_dir="$(mktemp -d)" | |
| cp scripts/auto-update-runner.mjs "$runner_dir/update-runner.mjs" | |
| cat > "$runner_dir/auto-update.json" <<'JSON' | |
| { | |
| "schema_version": 1, | |
| "repository": "cmdr-chara/codex-toolkit", | |
| "codex_home": "/tmp/codex-home", | |
| "npx_path": "/usr/bin/npx" | |
| } | |
| JSON | |
| cat > "$runner_dir/state.json" <<'JSON' | |
| { | |
| "schema_version": 1, | |
| "release": "v0.8.0" | |
| } | |
| JSON | |
| test_commit="0123456789abcdef0123456789abcdef01234567" | |
| moved_commit="89abcdef0123456789abcdef0123456789abcdef" | |
| node "$runner_dir/update-runner.mjs" --dry-run --tag v0.8.0 --commit "$test_commit" | tee "$runner_dir/plan.txt" | |
| grep -F "github:cmdr-chara/codex-toolkit#$test_commit" "$runner_dir/plan.txt" | |
| grep -F '"setup"' "$runner_dir/plan.txt" | |
| grep -F "\"commit\": \"$test_commit\"" "$runner_dir/plan.txt" | |
| if node "$runner_dir/update-runner.mjs" --dry-run --tag v0.8.0 --commit deadbeef; then | |
| echo "updater unexpectedly accepted a non-immutable commit reference" >&2 | |
| exit 1 | |
| fi | |
| cat > "$runner_dir/state.json" <<JSON | |
| { | |
| "schema_version": 1, | |
| "release": "v0.8.0", | |
| "commit": "$test_commit" | |
| } | |
| JSON | |
| node "$runner_dir/update-runner.mjs" --dry-run --tag v0.8.0 --commit "$test_commit" | grep -F 'already current' | |
| if node "$runner_dir/update-runner.mjs" --dry-run --tag v0.8.0 --commit "$moved_commit"; then | |
| echo "updater unexpectedly accepted a moved release tag" >&2 | |
| exit 1 | |
| fi |