chore(deps): bump the npm-dependencies group across 1 directory with 10 updates #567
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Checks | |
| # Pre-merge dogfood checks for the three native Actions. | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pr-checks-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| release-changelog: | |
| name: release changelog contract | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Verify current version has one changelog entry | |
| run: | | |
| VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided") | .version')" | |
| ./scripts/verify-release-changelog.sh "$VERSION" | |
| # Watchkeeper dogfood (v0.12.3): every pull request here gets a product | |
| # knowledge review from the local action in source mode — which is also | |
| # the live end-to-end test of action.yml itself. | |
| watchkeeper: | |
| name: watchkeeper (dogfood, native) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./ | |
| with: | |
| path: decisions | |
| # Validate dogfood (v0.17.2): every pull request runs the local validate | |
| # action in source mode — the live end-to-end test of validate-action/action.yml | |
| # (install, `decided validate --sarif`, exit-code propagation). SARIF uploads to | |
| # Code Scanning for same-repo PRs; it is skipped on forks, whose token cannot be | |
| # granted security-events: write, so the check never fails on a missing scope. | |
| validate: | |
| name: validate (dogfood, native) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./validate-action | |
| with: | |
| path: decisions | |
| upload-sarif: ${{ !github.event.pull_request.head.repo.fork }} | |
| # PR-gate dogfood (v0.21.14): every pull request runs the local PR-gate action | |
| # in source mode — the live end-to-end test of pr-gate-action/action.yml. It | |
| # carries the full contract via a single `decided gate` command — validation, | |
| # relationships, and review under the corpus enforcement policy — into one | |
| # required check, uploading one SARIF document under the Code Scanning category | |
| # `decided-gate` (distinct from the standalone validate job above, so the analyses | |
| # never collide). Skipped on forks, whose token cannot be granted | |
| # security-events: write. | |
| gate: | |
| name: pr-gate (dogfood, native) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./pr-gate-action | |
| with: | |
| path: decisions | |
| upload-sarif: ${{ !github.event.pull_request.head.repo.fork }} | |
| # Sentry dogfood: accepted decisions can carry deterministic source-code | |
| # constraints. Evaluate only the pull request diff against its base branch, | |
| # upload the native engine's SARIF, and block on any violation. No model, | |
| # embeddings, network judge, or second policy implementation is involved. | |
| sentry: | |
| name: sentry (dogfood, native) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Build native AsDecided | |
| run: cargo build --release --locked -p decided | |
| working-directory: rust | |
| - name: Run Sentry (SARIF) | |
| id: sentry | |
| env: | |
| BASE_REF: origin/${{ github.base_ref }} | |
| run: | | |
| set +e | |
| mkdir -p decided-sarif | |
| rust/target/release/decided sentry decisions \ | |
| --base "$BASE_REF" \ | |
| --sarif > decided-sarif/sentry.sarif | |
| code=$? | |
| echo "sentry exited $code" | |
| echo "exit_code=$code" >> "$GITHUB_OUTPUT" | |
| - name: Upload Sentry SARIF | |
| if: ${{ always() && !github.event.pull_request.head.repo.fork }} | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: decided-sarif/sentry.sarif | |
| category: decided-sentry | |
| - name: Report result | |
| env: | |
| EXIT_CODE: ${{ steps.sentry.outputs.exit_code }} | |
| run: | | |
| if [ "$EXIT_CODE" != "0" ]; then | |
| echo "::error::AsDecided Sentry failed (exit $EXIT_CODE) — see the Code Scanning annotations." | |
| exit "$EXIT_CODE" | |
| fi | |
| echo "AsDecided Sentry passed." | |
| # Keep public commands and generated agent guidance tied to the native | |
| # distribution. This job runs for docs-only changes too; rust-spike's path | |
| # filter is intentionally limited to engine/spec changes. | |
| guidance-drift: | |
| name: public docs and guidance drift | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Build native AsDecided | |
| working-directory: rust | |
| run: cargo build --release --locked -p decided | |
| - name: Check generated agent guidance | |
| run: rust/target/release/decided export decisions/ --agent-rules --check | |
| - name: Check public command and MCP contracts | |
| working-directory: rust | |
| run: cargo test -p decided-mcp --test docs_contract --release | |
| mcp-distribution: | |
| name: mcp distribution metadata | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Verify Registry and OCI metadata agree | |
| run: | | |
| WORKSPACE_VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided-mcp") | .version')" | |
| test "$(jq -r '.name' server.json)" = "io.github.asdecided/core" | |
| test "$(jq -r '.packages | length' server.json)" = "1" | |
| test "$(jq -r '.packages[0].registryType' server.json)" = "oci" | |
| test "$(jq -r '.packages[0].identifier' server.json)" = "ghcr.io/asdecided/core:mcp-v$WORKSPACE_VERSION" | |
| test "$(jq -r '.packages[0].transport.type' server.json)" = "stdio" | |
| test "$(jq -r '.version' server.json)" = "$WORKSPACE_VERSION" | |
| test "$(jq -r '.packages[0] | has("version")' server.json)" = "false" | |
| grep -F 'io.modelcontextprotocol.server.name="io.github.asdecided/core"' Dockerfile | |
| grep -F 'FROM runtime AS asdecided-mcp' Dockerfile | |
| # A release PR can point at an exact engine version that does not exist on | |
| # crates.io until the staged publish workflow runs. Listing the package | |
| # still validates its include/exclude boundary without falsely requiring | |
| # the unreleased dependency; crates-publish performs the full dry-run | |
| # after publishing and indexing asdecided-core. | |
| - name: Verify MCP crate package contents | |
| working-directory: rust | |
| run: cargo package --list --locked -p decided-mcp | |
| - name: Build and smoke-test Registry MCP image | |
| run: | | |
| WORKSPACE_VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided-mcp") | .version')" | |
| docker build --target asdecided-mcp --build-arg DECIDED_VERSION="$WORKSPACE_VERSION" -t asdecided-mcp:pr . | |
| RESPONSE="$(printf '%s\n' '{"jsonrpc":"2.0","id":"discover","method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"pr-smoke","version":"1.0.0"},"io.modelcontextprotocol/clientCapabilities":{}}}}' | docker run --rm -i -v "$PWD:/work:ro" asdecided-mcp:pr --root /work)" | |
| test "$(printf '%s' "$RESPONSE" | jq -r '.result.serverInfo.name')" = "decided-mcp" | |
| test "$(printf '%s' "$RESPONSE" | jq -r '.result.serverInfo.version')" = "$WORKSPACE_VERSION" |