Epic: github-warden roadmap

[lex00]

Tracking epic for github-warden. Forward work is the discrete sub-issues below (each cold-handoff ready: real paths, the src/cycles/branch-protection.ts template, acceptance criteria). Design context: chant#447.

Status: pre-1.0 (v0.1.0). One reconcile cycle (branch protection) + GitHub posture audit. Config schema and CLI flags will change as cycles land.

Shipped

• Reconcile harness (config, App auth, diff, guardrails, runner), branch-protection cycle (the template), dump/import, emitted pipeline, CLI, GitHub posture-audit cycle (uses chant's audit engine).
• Distribution plumbing: public repo; JS Action (uses: intentius/github-warden@<sha>, v0.1.0 prerelease); emitted pipeline SHA-pinned to the Action.

Publish to npm — gated on COVERAGE, not credentials

• Publish the CLI to npm (npx github-warden) only once the core access/repo cycles land (cycle: org settings #5 org settings, cycle: membership & roles #6 membership, cycle: teams #7 teams, cycle: repository settings #8 repo settings, cycle: rulesets (repo + org) #9 rulesets). Publishing a one-cycle "governance tool" undersells it and locks a public CLI/config contract that's still evolving. Name github-warden is reserved/available. The Action path needs nothing further and works today for what's built.

Cycles & remaining work

See sub-issues #5–#20. Reconcile cycles copy the branch-protection template; aggregator/report cycles (#19) are detect-only; #20 (harness→chant primitive) is deferred until a second git-host warden exists.

Scope guardrail

warden is GitHub-only governance. Other git hosts would be separate sibling apps reusing the future chant reconcile primitive (#20). Infra lexicons (k8s/aws/etc.) are NOT warden targets — author with chant, audit with blacklight.

[lex00]

Distribution — done (autonomous)

• ✅ Repo made public.
• ✅ JS Action shipped — uses: intentius/github-warden@v1 (root action.yml, committed bundle, CI staleness guard). This is the primary path and works now; no npm needed.
• ✅ v1.0.0 released + floating v1 tag → 50db522.
• ✅ Emitted pipeline switched from npx to the Action, SHA-pinned (intentius/github-warden@50db522… # v1) so it dogfoods warden's own action-pinning rule. Passes warden's own audit.

CLI on npm — one manual step left (needs maintainer npm auth)

The package is publish-ready (private removed, publishConfig.access=public, bin + dist in files, prepublishOnly builds; name github-warden is available on npm). npm wasn't authenticated in the automation env (E401), so the first publish is yours:

npm login
npm publish    # from the github-warden repo root

That enables the npx github-warden path for local dry-run preview + non-GitHub-Actions runtimes. The Action path needs nothing further.