fix(install): brownfield CI-orphan WARN names every missing gate + check:lintstaged CI-wiring — #521 - #522
Merged
Merged
Conversation
#521 design Approved brainstorming design for GH #521: broaden install.sh §6c CI-orphan WARN to detect+name every enforcement gate absent from a kept brownfield workflow (check:globs/arch:check/audit:docs/check:lintstaged) + print a paste-block; wire check:lintstaged into both shipped CI templates so greenfield CI == validate == WARN-named set. No YAML auto-merge (rejected: false-green risk + BFR). Test plan extends r2-glob-reach.test.sh with a per-gate-accuracy POS-partial case. Prior-art: skipped — doc-only design spec, no new capability (brainstorming artefact for #521).
…521 3-task TDD plan: (1) wire check:lintstaged into both shipped CI templates; (2) rewrite install.sh §6c WARN as a per-gate loop + paste-block (POS-partial test proves per-gate accuracy); (3) full-suite verify + greenfield-green acceptance with a no-fabrication guard. Full bash/YAML in every step, no placeholders. Prior-art: skipped — doc-only implementation plan, no new capability (#521 brainstorming→plan).
…Change 1 Greenfield ci.yml ran 3 of validate's 4 gates; check:lintstaged lived only in the validate script. Add it to both shipped CI lint jobs so greenfield CI == validate. CI-safe: the gate skips without node_modules, runs after npm ci. Prior-art: skipped — wiring an existing gate into shipped CI templates, no new capability.
…ste-block — #521 §6c warned only about check:globs; arch:check (R3), audit:docs, check:lintstaged were silently unwarned. Rewrite as a per-gate loop: for each gate whose artifact is installed and that no kept workflow references, name it (with what it enforces) and print a paste step. Non-destructive, rc=0, no YAML parser. POS-partial test proves per-gate accuracy. Prior-art: skipped — WARN-completeness fix on an existing block, no new capability.
artyhoo
force-pushed
the
claude/festive-margulis-163cc2
branch
from
June 14, 2026 16:09
db98ac0 to
42033ce
Compare
artyhoo
changed the title
This was referenced Jun 14, 2026
artyhoo
added a commit
that referenced
this pull request
Jun 14, 2026
#521 Stage P (#526) universalization-fix-s3 Stage P implements the REFERENCE half of the HYBRID verdict (SSOT #117): an opt-in --wire-ci flag (or interactive [y/N], default No) that, when yq is present, idempotently appends the missing rule-enforcement gates (check:globs / arch:check / audit:docs / check:lintstaged) into the consumer's kept .github/workflows/*.yml job, re-detects, and suppresses the WARN on success (merge-then-no-warn). The BUILD half (broadened WARN + paste-block) shipped via #522/#525; the default path stays non-destructive (writes nothing). yq is used-if-present, never installed/pinned by us (companion-install-principle.md §1; BFR §1.1 shipped-axis — integrate, never hard-depend); absent/declined → falls through to the unchanged WARN + paste-block. - install.sh §6c: --wire-ci flag + detect-first yq auto-wire; job/workflow detection via yq; idempotent unique_by(.run) append; bash-3.2-safe array expansion under set -u. Preserves the #525 check:globs shadowed-package Note. - tests/install-sh/s3-wire-ci.test.sh (wired into audit-self.yml): paired-negative — NEG (load-bearing): default install leaves the workflow byte-identical (opt-in proven); POS (yq arm — CI-verified, GH runners ship yq, local prints SKIP): appends all 4, suppresses WARN, idempotent re-run, valid job path; comment-preservation is an OBSERVATION (yq best-effort), not a flaky gate. - prior-art-evaluations.md: SSOT #117 (HYBRID); 11-build-first-reuse-default VERDICTS extended with HYBRID per its line-47 "extend VERDICTS" instruction. Prior-art: prior-art-evaluations.md#117 (HYBRID — REFERENCE mikefarah/yq opt-in --wire-ci auto-wirer + BUILD the zero-dep broadened WARN/paste-block; no new package.json dependency, yq detect-first/never-installed; Stage P of universalization-fix-s3, GH #521).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the two defects reported in #521 plus the
validate≠CI drift found during design.Problem (#521)
On a brownfield repo (pre-existing
.github/workflows/ci.yml),install.shkeeps the consumer's CI verbatim (copy_safeskips existing files), so the framework's enforcement gates run in no CI job — the only non-bypassable channel. Two defects:check:globs, silently omittingarch:check(R3) andaudit:docs. A dev who wired only the named gate still shipped R3 un-enforced.--forcetoo coarse — the only "automatic" remedy overwrote all kept files, not just the workflow.Also found during design:
check:lintstagedwas missing from the shipped greenfield CI templates too —validateran 4 gates, the shippedci.ymlwired 3.Change
check:lintstaged→ both shipped CI templates (templates/ts-server/github-actions-ci.yml,packages/preset-next-15-canonical/templates/github-actions-ci-ui.yml). Greenfield CI now runs the fullvalidateset. CI-safe (the gate skips withoutnode_modules, runs afternpm ci).install.sh§6c WARN into a per-gate loop: for each of the 4 gates whose enforcing artifact is installed, if no kept workflow references it, name it (with what it enforces) and print a ready-to-paste- run:step.--forceis reworded honestly about overwriting all kept files. Non-destructive,rc=0, no YAML parser, no new dependency, no auto-edit of the consumer's workflow (a silent auto-wire could land a step in the wrong job on a monorepo → false-green CI, the worst failure for a "no check → no rule" framework).Establishes the invariant
{WARN-named} = {greenfield CI} = {validate}= 4 gates, zero drift.Out of scope (deferred, by design)
--wire-ciflag (issue's "optionally") — YAGNI; it still requires editing the consumer's YAML, just behind a flag. Recorded with a revisit trigger in the spec.Tests / verification
tests/install-sh/r2-glob-reach.test.shextended:#1rewritten with POS-all (none wired → names all 4 + paste-block), POS-partial (only globs wired → names the other 3, NOTcheck:globs— proves per-gate accuracy), NEG (greenfield → all 4 wired → no warn);#4added (both templates wirecheck:lintstaged).tests/install-sh/*suite green locally (28/28).ts-serverinstall with deps →check-lintstaged-resolves.sh= OK, rc=0, all 6 lint-staged commands resolve (the one read-unverifiable claim, discharged by a real run, not fabricated).Two-stage subagent review (spec + code-quality) per task, plus a holistic final review confirming both #521 defects close and the invariant holds.
Process notes
docs/superpowers/(brainstorming → writing-plans → subagent-driven execution).stagingtip — a 3-way merge preserved staging's#516test additions to the same test file (no clobber; diff is exactly the 6 intended files).Closes #521.