Merge feat/cli-multi-provider: additive non-github provider support #388
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Release | |
| on: | |
| pull_request: | |
| branches: | |
| - prod | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate-versions: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Extract Node version | |
| id: node-version | |
| run: | | |
| VERSION=$(node -p "require('./node/package.json').version") | |
| echo "VERSION=$VERSION" >> $GITHUB_OUTPUT | |
| echo "Node version: $VERSION" | |
| - name: Extract Python version | |
| id: python-version | |
| run: | | |
| VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' python/pyproject.toml) | |
| echo "VERSION=$VERSION" >> $GITHUB_OUTPUT | |
| echo "Python version: $VERSION" | |
| - name: Ensure versions match | |
| run: | | |
| NODE_VERSION="${{ steps.node-version.outputs.VERSION }}" | |
| PYTHON_VERSION="${{ steps.python-version.outputs.VERSION }}" | |
| if [ "$NODE_VERSION" != "$PYTHON_VERSION" ]; then | |
| echo "Version mismatch: Node=$NODE_VERSION Python=$PYTHON_VERSION" | |
| exit 1 | |
| fi | |
| echo "Versions match: $NODE_VERSION" | |
| - name: Ensure ClawHub skill version matches package version | |
| # rf-zgwj — the SKILL.md frontmatter version is what ClawHub publishes | |
| # under. Drift here would silently ship a stale version on the next | |
| # `clawhub skill publish` (publish.yaml). Both the Node and Python | |
| # resource copies must match the package version exactly. | |
| run: | | |
| PACKAGE_VERSION="${{ steps.node-version.outputs.VERSION }}" | |
| for skill_file in node/resources/rafter-security-skill.md python/rafter_cli/resources/rafter-security-skill.md; do | |
| SKILL_VERSION=$(sed -n 's/^version: *\(.*\)$/\1/p' "$skill_file" | head -1 | tr -d ' ') | |
| if [ -z "$SKILL_VERSION" ]; then | |
| echo "FAIL: $skill_file has no top-level 'version:' field" | |
| exit 1 | |
| fi | |
| if [ "$SKILL_VERSION" != "$PACKAGE_VERSION" ]; then | |
| echo "FAIL: $skill_file version=$SKILL_VERSION but package=$PACKAGE_VERSION" | |
| echo "Update the version: line in $skill_file to match." | |
| exit 1 | |
| fi | |
| echo "OK: $skill_file version matches ($SKILL_VERSION)" | |
| done | |
| - name: Check CHANGELOG updated | |
| run: | | |
| VERSION="${{ steps.node-version.outputs.VERSION }}" | |
| if ! grep -q "\[$VERSION\]" CHANGELOG.md; then | |
| echo "Warning: CHANGELOG.md missing entry for $VERSION" | |
| else | |
| echo "CHANGELOG.md updated for $VERSION" | |
| fi | |
| test-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Build Node package | |
| run: | | |
| cd node | |
| corepack enable | |
| corepack prepare pnpm@10 --activate | |
| pnpm install --frozen-lockfile | |
| pnpm run build | |
| pnpm test | |
| - name: Build Python package | |
| run: | | |
| cd python | |
| python -m pip install --upgrade build | |
| python -m build | |
| - name: Verify all artifacts | |
| run: | | |
| test -f node/dist/index.js || exit 1 | |
| test -f python/dist/*.whl || exit 1 | |
| test -f python/dist/*.tar.gz || exit 1 | |
| echo "All build artifacts verified" | |
| test-package: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: ./node | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - name: Enable pnpm | |
| run: corepack enable && corepack prepare pnpm@10 --activate | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build | |
| run: pnpm run build | |
| - name: Pack | |
| run: npm pack | |
| - name: Verify resources/pre-commit-hook.sh in tarball | |
| run: | | |
| TARBALL=$(ls rafter-security-cli-*.tgz | head -1) | |
| echo "Inspecting: $TARBALL" | |
| tar -tzf "$TARBALL" | grep "resources/pre-commit-hook.sh" \ | |
| || (echo "FAIL: resources/pre-commit-hook.sh not found in tarball" && exit 1) | |
| echo "OK: resources/pre-commit-hook.sh present in tarball" | |
| - name: Test install-hook end-to-end from packed tarball | |
| run: | | |
| TARBALL=$(ls rafter-security-cli-*.tgz | head -1) | |
| npm install -g "./$TARBALL" | |
| rafter --version | |
| TMPDIR=$(mktemp -d) | |
| git init "$TMPDIR" | |
| git -C "$TMPDIR" config user.email "ci@test.local" | |
| git -C "$TMPDIR" config user.name "CI Test" | |
| (cd "$TMPDIR" && rafter agent install-hook) | |
| test -f "$TMPDIR/.git/hooks/pre-commit" \ | |
| || (echo "FAIL: pre-commit hook not installed" && exit 1) | |
| echo "OK: pre-commit hook installed end-to-end" |