diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9732942..191bf71 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,6 @@ on: permissions: actions: read contents: read - packages: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -18,15 +17,16 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v2.5.1 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v3.1.0 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} workspace_mode: isolated - publish_mode: hosted_exception + # The shared package template defaults publication on. Its required + # negative sentinel keeps this invocation validation-only; no provider + # coordinate is supplied. npm_publish_mode: disabled node_versions: '["20", "22"]' - publish_node_version: "22" pnpm_version: "9.15.9" prepare_command: pnpm exec svelte-kit sync metadata_check_command: pnpm check:release-metadata @@ -44,47 +44,25 @@ jobs: # in-cluster nix-setup; nothing is baked. Cache-first only. cache_backed: true package_dir: ./bazel-bin/pkg - npm_access: public - github_package_name: "@jesssullivan/scheduling-kit" - dry_run: true # Repo-local lane for the write-time double-booking proof (TIN-2764). The # reusable job above runs `pnpm test:integration` with no database, so the - # homegrown concurrency suite skips there; this job stands up a Postgres - # service and runs the same command with DATABASE_URL set, exercising the - # practitioner-day advisory lock against a real database. This is - # intentionally NOT part of the reusable workflow (which stays untouched). - # - # Runner: GitHub-hosted ubuntu-latest, NOT the org self-hosted pool. A - # `services:` container with `localhost:5432` port mapping only resolves when - # the job runs directly on a Docker-on-host VM. The org's PRIMARY_LINUX runners - # are in-cluster/ARC (k8s) where the service is a sibling pod unreachable on - # localhost without DinD, which would make beforeAll's connect throw and paint - # this proof job a persistent red instead of running it. ubuntu-latest is free - # for this public repo and supports service containers natively. + # homegrown concurrency suite skips there. This lane provisions PostgreSQL + # from the repo's pinned flake on the same GF capability class as package CI; + # it never falls back to a hosted runner or ARC service-container semantics. integration-postgres: - name: Integration (Postgres service) - runs-on: ubuntu-latest - services: - postgres: - image: postgres:16-alpine - env: - POSTGRES_PASSWORD: postgres - POSTGRES_DB: scheduling_kit_test - ports: - - 5432:5432 - options: >- - --health-cmd "pg_isready -U postgres" - --health-interval 10s - --health-timeout 5s - --health-retries 10 + name: Integration (GF PostgreSQL) + runs-on: ${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }} env: - # The job runs on the runner host (not inside a job container), so the - # service is reachable on localhost via the mapped port. - DATABASE_URL: postgres://postgres:postgres@localhost:5432/scheduling_kit_test + PGHOST: 127.0.0.1 + PGPORT: "55432" + PGUSER: postgres + PGDATABASE: scheduling_kit_test + DATABASE_URL: postgres://postgres@127.0.0.1:55432/scheduling_kit_test PG_INTEGRATION: "1" steps: - uses: actions/checkout@v4 + - uses: tinyland-inc/ci-templates/.github/actions/nix-setup@v3.1.0 - uses: pnpm/action-setup@v4 with: version: "9.15.9" @@ -93,19 +71,21 @@ jobs: node-version: "22" - run: pnpm install --frozen-lockfile - run: pnpm exec svelte-kit sync - # Preflight: fail with an actionable message if the service container is - # not reachable, rather than letting the suite's beforeAll connect throw a - # confusing error deeper in the run. - - name: Wait for Postgres + - name: Run integration proof with pinned PostgreSQL + shell: bash run: | - for i in $(seq 1 30); do - if pg_isready -h localhost -p 5432 -U postgres; then - echo "postgres is ready" - exit 0 - fi - echo "waiting for postgres (attempt $i)..." - sleep 2 - done - echo "postgres service never became reachable on localhost:5432" >&2 - exit 1 - - run: pnpm test:integration + set -euo pipefail + export CI_NODE_BIN_DIR="$(dirname "$(command -v node)")" + export CI_PNPM_BIN="$(command -v pnpm)" + nix develop .#ci-postgres --command bash <<'POSTGRES_PROOF' + set -euo pipefail + export PGDATA="$RUNNER_TEMP/scheduling-kit-postgres-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" + export PATH="$CI_NODE_BIN_DIR:$(dirname "$CI_PNPM_BIN"):$PATH" + initdb --username="$PGUSER" --auth=trust "$PGDATA" + pg_ctl -D "$PGDATA" -l "$RUNNER_TEMP/scheduling-kit-postgres.log" \ + -o "-h $PGHOST -p $PGPORT" -w start + trap 'pg_ctl -D "$PGDATA" -w stop -m fast >/dev/null 2>&1 || true' EXIT + createdb --maintenance-db=postgres "$PGDATABASE" + pg_isready -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" + "$CI_PNPM_BIN" test:integration + POSTGRES_PROOF diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml deleted file mode 100644 index 8420c83..0000000 --- a/.github/workflows/publish.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Publish - -on: - release: - types: [published] - workflow_dispatch: - inputs: - dry_run: - description: "Dry run (no actual publish)" - required: false - type: boolean - default: true - -permissions: - actions: read - contents: read - id-token: write - packages: write - -concurrency: - group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.ref }} - cancel-in-progress: false - -jobs: - package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v2.5.1 - with: - runner_mode: repo_owned - runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} - workspace_mode: isolated - publish_mode: hosted_exception - npm_publish_mode: disabled - node_versions: '["20", "22"]' - publish_node_version: "22" - pnpm_version: "9.15.9" - prepare_command: pnpm exec svelte-kit sync - metadata_check_command: pnpm check:release-metadata - lint_command: pnpm lint - typecheck_command: pnpm check - unit_test_command: pnpm test:unit - integration_test_command: pnpm test:integration - build_command: pnpm build - package_check_command: pnpm check:package - bazel_targets: "//:typecheck //:pkg //:test" - # Cache-first shared-cache-backed Bazel validation (TIN-2110 pilot). - # Same opt-in lane as CI; endpoint injected at runtime, no executor. - cache_backed: true - package_dir: ./bazel-bin/pkg - npm_access: public - github_package_name: "@jesssullivan/scheduling-kit" - dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }} diff --git a/AGENTS.md b/AGENTS.md index 5717c38..9e8de1e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -65,15 +65,15 @@ The package should be reusable across multiple businesses. Avoid app-specific as ## Current Tracking -As of `2026-06-11`, release-authority, artifact-truth, and runner-contract -convergence have largely landed. The active structural work is docs/toolchain -truth normalization and the adopter capability contract. +As of `2026-08-27`, release authority and artifact truth are ruled. The active +structural work is keeping source documentation and validation workflows aligned +with the Bzlmod-only delivery contract and the adopter capability boundary. Active threads: -- `TIN-89` package, Bazel, CI, publish, and dependency truth across shared - scheduling packages; its current GitHub face is kit issues `#73`/`#75` and - bridge issues `#76`/`#78` +- `TIN-89` package, Bazel, CI, and dependency truth across shared scheduling + packages; its current GitHub face is kit issues `#73`/`#75` and bridge issues + `#76`/`#78` - the kit-side half of `TIN-88`, the explicit site and backend capability contract for reusable adopters, tracked as kit `#79` and bridge `#82` @@ -82,9 +82,9 @@ Closed but still relevant context: - `TIN-101` completed the mini sprint for toolchain authority and hermetic package convergence - `TIN-103` closed the release-authority ambiguity for `Jesssullivan/scheduling-kit` - `TIN-104` was canceled as a duplicate during that convergence work -- `TIN-165` is done: the tinyland bazel-registry is generated from standalone - package truth and currently carries scheduling-kit `0.10.0+` and - scheduling-bridge `0.5.11+`; the registry line is in `.bazelrc` +- `TIN-165` is done: the tinyland Bazel registry is the package delivery SSOT +- `TIN-3092` is done: the registry carries the immutable scheduling-kit + `0.11.1` archive and its GF consumer proof - `TIN-677` is done: HomegrownAdapter takes injected schemas from `@tummycrypt/tinyland-business-pg`, with `tinyland-auth-pg` kept only as an optional legacy fallback @@ -93,29 +93,30 @@ Current operational truth: - local development should default to `jesssullivan/main` - that branch is the current functional release line -- current released version is `0.10.0`: git tag plus GitHub Release, GitHub - Packages `@jesssullivan/scheduling-kit`, and the active tinyland Bazel - registry (`0.10.0+`) -- npmjs `@tummycrypt/scheduling-kit` is retired for new versions and frozen at - `0.8.0`; `npm_publish_mode: disabled` is permanent policy, not a temporary - outage +- current released version is `tummycrypt_scheduling_kit@0.11.1`: source commit + and lightweight tag `9a00ee387afe1759ebba0c0a67e9246d84b1aa37`, + GitHub Release `v0.11.1`, and append-only registry receipt + `cfbb16e6ae957da9e8a25b7418a7871ec815e0a1` +- the Bzlmod module graph through `tinyland-inc/bazel-registry` is the sole + delivery authority; npmjs and GitHub Packages are historical surfaces, not + release gates, consumer aliases, or evidence for current versions - HomegrownAdapter does not require `tinyland-auth-pg`; schemas are injected explicitly (canonically from `@tummycrypt/tinyland-business-pg`) and any auth-pg fallback stays optional - `#73` remains open only for explicit historical release-surface - backfill/documentation around older `0.7.1` / `0.7.2` gaps; the current - release/tag/npm/Bazel/registry authority path is healthy + backfill/documentation around older `0.7.1` / `0.7.2` gaps; it cannot make a + provider package a current delivery authority - `tinyland-inc/origin/main` is now a downstream mirror/validation surface, not an equally authoritative release surface -- package metadata, git tags, npm dist-tags, and GitHub releases are separate - authority surfaces until `#73` is resolved +- source metadata, git tags, GitHub Releases, and append-only BCR entries are + distinct evidence; only the registry entry delivers a current module ## Build Truth There are **two** build surfaces in this repo: 1. `pnpm` remains the package-manager and script interface for local work -2. Bazel defines and builds the publishable package artifact used by CI +2. Bazel defines and builds the JavaScript package artifact validated by CI Do not confuse them. @@ -123,15 +124,15 @@ The repo flake and `.envrc` exist to make those surfaces reproducibly available from a fresh machine. They are bootstrap tools, not a second packaging authority. -### Canonical publish path +### Canonical validation and delivery path -Today, the functional publish path is driven by: +Today, the functional validation path is driven by: - the shared `js-bazel-package` GitHub Actions workflow - metadata, typecheck, lint, test, and build commands invoked through pnpm - Bazel targets including `//:pkg` -- publishable package output from `./bazel-bin/pkg` -- npm / GitHub Packages release jobs +- package output from `./bazel-bin/pkg` +- GF validation only; this repo has no package-publication workflow And, right now, the functional release repo is: @@ -147,14 +148,15 @@ Bazel exists to provide: - hermetic graph definition - version / metadata conformity checks - cacheability and reproducibility -- the package artifact that CI publishes +- the package artifact that GF CI validates Current target state: 1. release metadata declared once -2. Bazel validates/builds the publishable artifact -3. CI publishes that artifact -4. downstream apps consume only the published version +2. Bazel validates/builds the package artifact +3. GF CI validates and archives that artifact as build evidence +4. an append-only `tinyland-inc/bazel-registry` entry delivers the module +5. downstream apps consume the ruled Bzlmod version ## Bazel Guardrails @@ -172,7 +174,7 @@ Key points: - `BUILD.bazel` describes the hermetic targets. - `pnpm-lock.yaml` remains important because Bazel translates the lockfile. -## CI / Publishing Truth +## CI / Delivery Truth ### CI @@ -191,31 +193,26 @@ Typecheck/lint may be tolerated temporarily in CI if they are marked `continue-on-error`, but that should not be treated as a steady-state quality bar. -### Publishing +### Delivery Delivery doctrine: - the Bzlmod module graph through `tinyland-inc/bazel-registry` is the SSOT delivery mechanism -- GitHub Packages `@jesssullivan/scheduling-kit` is the derived - out-of-ecosystem package, built from the Bazel `//:pkg` artifact - (`./bazel-bin/pkg`) -- npmjs `@tummycrypt/scheduling-kit` is retired for new versions and frozen at - `0.8.0`; `npm_publish_mode: disabled` is permanent policy, not a temporary - outage +- the source tag and GitHub Release identify the archive; neither replaces the + registry entry or the GF consumer proof +- npmjs and GitHub Packages are historical only; do not add provider + coordinates, credentials, publish permissions, consumer guidance, or a + publish workflow back to this repository -That GitHub Packages naming split (npm-style identity `@tummycrypt`, GitHub -Packages scope `@jesssullivan`) is operationally real. Do not break it -accidentally when editing the publish flow. - -Release/publish changes should be made against the functional release line -first, then ported deliberately into the mirror when needed. Do not split -package truth across both remotes by accident. +Release metadata changes should be made against the functional source line +first, then registered append-only and ported deliberately into the mirror when +needed. Do not split package truth across both remotes by accident. Current runner truth: -- current workflows use `runner_mode: repo_owned` and read runner labels from - `PRIMARY_LINUX_RUNNER_LABELS_JSON` +- CI uses the shared `tinyland-inc/ci-templates` package validator and the + existing GF capability labels; no hosted-runner exception is allowed - do not describe the runner lane as fully proven until repo Actions runner visibility and green workflow runs confirm it - keep private runner topology, cluster names, and apply details out of this @@ -290,7 +287,6 @@ Do not turn live-provider tests into the default CI path. - `.envrc` - `mkdocs.yml` - `.github/workflows/ci.yml` -- `.github/workflows/publish.yml` - `scripts/generate-doc-artifacts.mjs` - `docs/generated/**` - `llms.txt` @@ -303,7 +299,8 @@ Do not turn live-provider tests into the default CI path. ## Guardrails - Do not move browser automation into this repo. -- Do not let Bazel metadata drift from npm metadata. +- Do not let `package.json`, `MODULE.bazel`, and `BUILD.bazel` artifact identity + drift; this alignment is build integrity, not a second delivery graph. - Do not speak ambiguously about both `main` branches as if they are equally authoritative. - Do not leak site-specific environment logic into library contracts. diff --git a/BUILD.bazel b/BUILD.bazel index 2b9c51c..2300a80 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -1,7 +1,7 @@ """ BUILD.bazel for @tummycrypt/scheduling-kit. -Dual-mode build: pnpm remains the publish path, Bazel provides the hermetic graph. +Two build interfaces: pnpm exposes repository scripts; Bazel owns the hermetic graph. Standalone: pnpm build (svelte-kit sync && svelte-package) Bazel: bazel build //:pkg (hermetic, cacheable) @@ -153,7 +153,7 @@ js_library( ) # ============================================================================= -# npm package - publishable artifact +# JavaScript package artifact # ============================================================================= npm_package( diff --git a/MODULE.bazel b/MODULE.bazel index ef7f0a8..6e573b7 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -2,14 +2,15 @@ scheduling-kit - Bazel Module Configuration Backend-agnostic scheduling library with pluggable adapters, payment processors, -and Svelte UI components. Published as @tummycrypt/scheduling-kit on npm. +and Svelte UI components. The JavaScript artifact keeps the +@tummycrypt/scheduling-kit import identity for Bazel consumers. Bzlmod-native configuration for Bazel 8+. -CI and publishing remain pnpm-driven today; Bazel targets are the hermetic build graph. +CI invokes pnpm tooling but validates the hermetic Bazel build graph on GF. Build targets: bazel build //:scheduling_kit # Svelte package build (dist/) - bazel build //:pkg # npm-publishable package + bazel build //:pkg # JavaScript package artifact bazel test //:test # Unit tests (vitest) bazel build //:typecheck # Type validation (svelte-check) @@ -37,13 +38,12 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.22.5") # ============================================================================= # Inter-module dependencies (tinyland-inc/bazel-registry) # ============================================================================= -# Availability substrate (TIN-1996): kit is the first consumer of the -# tinyland-calendar (RRULE recurrence) and tinyland-caldav-client (external -# calendar busy overlay) registry modules. npm parity per the TIN-2035 -# delivery doctrine: each bazel_dep below is mirrored by an exact-version -# @tummycrypt devDependency in package.json (enforced by -# scripts/check-release-metadata.mjs), so the Bzlmod graph and the -# pnpm-lock-translated npm graph resolve identical versions. +# Availability substrate (TIN-1996): kit consumes tinyland-calendar (RRULE +# recurrence) and tinyland-caldav-client (external calendar busy overlay) +# through the Bzlmod graph. That graph is the sole first-party delivery +# authority. package.json and the pnpm lock still carry JavaScript dependencies +# needed to compile this source tree through npm_translate_lock; they are build +# inputs, not a parallel first-party registry or a parity authority. bazel_dep(name = "tummycrypt_tinyland_calendar", version = "0.2.3") bazel_dep(name = "tummycrypt_tinyland_caldav_client", version = "0.2.3") diff --git a/README.md b/README.md index bd17e0b..fa17d34 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ composition. This repo keeps two intentionally different build surfaces: - `pnpm` is the local package-manager and script interface -- Bazel defines and builds the publishable package artifact used by CI +- Bazel defines and builds the JavaScript package artifact validated by CI The recommended local bootstrap path is the repo flake plus `direnv`, which makes `pnpm`, `bazel` through Bazelisk, and the docs toolchain available from a @@ -41,15 +41,11 @@ with the registry line (already in this repo's `.bazelrc`): common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main ``` -npm-ecosystem consumers outside the Bazel module graph install the derived -GitHub Packages artifact: - -```bash -pnpm add @jesssullivan/scheduling-kit # registry: https://npm.pkg.github.com -``` - -npmjs (`@tummycrypt/scheduling-kit`) is retired for new versions and frozen at -`0.8.0`. +The append-only registry receipt carrying `0.11.1` and its GF consumer proof is +`cfbb16e6ae957da9e8a25b7418a7871ec815e0a1`. The +`@tummycrypt/scheduling-kit` string remains the JavaScript import identity inside +the Bazel artifact; it is not a provider install route. There is no supported +npmjs or GitHub Packages consumer alias for current releases. ## Development Environment @@ -84,9 +80,9 @@ bazel build //:pkg npm pack --dry-run ./bazel-bin/pkg ``` -Those checks keep `package.json`, `MODULE.bazel`, and `BUILD.bazel` aligned, -then validate the Bazel-built package artifact before anything gets near a -registry. +Those checks keep `package.json`, `MODULE.bazel`, and `BUILD.bazel` artifact +identity aligned. GF runs the same validation against the Bazel-built artifact; +delivery is the separately reviewed append-only BCR entry. ## Documentation @@ -102,35 +98,37 @@ nix flake check # Evaluate flake outputs and run lightweight checks Current reality: -- the functional release line is `Jesssullivan/scheduling-kit` +- the functional source and tag line is `Jesssullivan/scheduling-kit` - `tinyland-inc/scheduling-kit` is now a downstream mirror and validation - surface, not a second publish authority -- the active tinyland Bazel registry carries `scheduling-kit` `0.11.1+` (and - `scheduling-bridge` `0.5.11+`); the registry line is already in `.bazelrc` + surface, not a second release authority +- source commit, tag, and GitHub Release `v0.11.1` resolve to + `9a00ee387afe1759ebba0c0a67e9246d84b1aa37` +- the Tinyland Bazel registry carries `tummycrypt_scheduling_kit@0.11.1`; its + append-only proof receipt is `cfbb16e6ae957da9e8a25b7418a7871ec815e0a1` -Treat `Jesssullivan/main` as the release authority for package publication and -metadata changes. Do not assume both `main` branches are equivalent. +Treat `Jesssullivan/main` as the source authority for release metadata changes. +Treat `tinyland-inc/bazel-registry` as delivery authority. Do not assume the two +scheduling-kit `main` branches are equivalent. The delivery doctrine is: 1. release metadata declared once -2. Bazel defines and builds the publishable artifact -3. GitHub Actions validates that artifact on the repo-owned package runner -4. the Bzlmod module graph via `tinyland-inc/bazel-registry` is the SSOT +2. Bazel defines and builds the JavaScript artifact +3. GF GitHub Actions validates that artifact without provider credentials or + write permissions +4. the source tag and GitHub Release identify the immutable archive +5. the Bzlmod module graph via `tinyland-inc/bazel-registry` is the sole delivery mechanism -5. GitHub Packages carries the derived `@jesssullivan/scheduling-kit` package, - built from the Bazel `//:pkg` output, for consumers outside the Bazel - module graph -6. npmjs (`@tummycrypt/scheduling-kit`) is retired for new versions and frozen - at `0.8.0`; `npm_publish_mode: disabled` is permanent policy -7. downstream apps consume the published package only +6. downstream apps consume the ruled Bzlmod version +7. npmjs and GitHub Packages remain historical surfaces only ## Runner Authority -Package CI and publish use the shared `js-bazel-package` workflow with +Package CI uses the shared `js-bazel-package` validator with `runner_mode: repo_owned` and labels from `PRIMARY_LINUX_RUNNER_LABELS_JSON`. -The workflow publishes through the hosted publish exception for GitHub Packages -and explicitly disables npmjs publication. +The PostgreSQL concurrency proof uses the same GF capability class. This repo +has no publish workflow, hosted-runner exception, provider coordinate, package +write permission, or publication credential. Keep private runner topology and apply details out of this public repo. diff --git a/docs/build-and-release.md b/docs/build-and-release.md index e221f8d..540903b 100644 --- a/docs/build-and-release.md +++ b/docs/build-and-release.md @@ -28,16 +28,16 @@ The dev shell provides: This repo keeps two deliberately different surfaces: 1. `pnpm` remains the local package-manager and script interface. -2. Bazel defines and builds the publishable package artifact used by CI. +2. Bazel defines and builds the JavaScript package artifact validated by CI. That split is intentional. Nix bootstraps the tools, Bazel models the artifact -graph, and the shared `js-bazel-package` workflow publishes from -`./bazel-bin/pkg`. +graph, and the shared `js-bazel-package` workflow validates +`./bazel-bin/pkg` on GF. The active workflow contract uses repo-owned runner registration with Tinyland -capability labels. npmjs publication is permanently disabled; the publish path -validates the Bazel artifact and publishes the derived GitHub Packages package. -See the delivery doctrine below. +capability labels. It has read-only permissions and no package provider +coordinate or credential. This repository has no publication workflow. See the +delivery doctrine below. ## Delivery doctrine @@ -46,12 +46,12 @@ Package delivery follows one source of truth: 1. The Bzlmod module graph is the canonical (SSOT) delivery mechanism. Consumers depend on `tummycrypt_scheduling_kit` through the `tinyland-inc/bazel-registry` registry line already present in `.bazelrc`. -2. GitHub Packages (`@jesssullivan/scheduling-kit`) is a derived package: the - out-of-ecosystem alternative route for npm-style consumers, built from the - same Bazel `//:pkg` output (`./bazel-bin/pkg`) that the module graph models. -3. npmjs (`@tummycrypt/scheduling-kit`) is retired for first-party delivery. - It is frozen at `0.8.0`, and `npm_publish_mode: disabled` in the CI and - publish workflows is permanent policy, not a temporary outage. +2. The source tag and GitHub Release identify the immutable source archive; + they do not create a second consumer route. +3. `@tummycrypt/scheduling-kit` is the JavaScript import identity inside the + Bazel artifact, not an npm provider claim. +4. npmjs and GitHub Packages are historical surfaces only. They are not current + delivery evidence, gates, or supported consumer aliases. ## Bazel Cache Contract @@ -65,9 +65,9 @@ bazel test //:test Contributor machines can opt into a remote cache by adding a private `user.bazelrc`; this repository intentionally keeps private cache topology out of public source. CI remote-cache behavior is owned by the shared -`js-bazel-package` workflow and its runner environment. The public contract is -that CI must still publish the Bazel package artifact from `./bazel-bin/pkg` -with local fallback available when the remote cache is unavailable. +`js-bazel-package` workflow and its GF runner environment. The public contract +is that CI validates and archives the Bazel package artifact from +`./bazel-bin/pkg`; it does not publish that artifact to a package provider. ## Core commands @@ -96,19 +96,16 @@ Version drift across those files is a bug. Before cutting a package release, verify these surfaces together: -- Bazel registry entry in `tinyland-inc/bazel-registry` for the new version - (the SSOT delivery surface) -- GitHub Packages package: `@jesssullivan/scheduling-kit`, derived from the - Bazel `//:pkg` artifact -- tag and GitHub release for the package version -- Bazel package artifact from `./bazel-bin/pkg` -- consumer dependency range in bridge and app repos -- npmjs stays frozen: `@tummycrypt/scheduling-kit` is retired at `0.8.0`, and - `npm_publish_mode: disabled` must remain in both workflows - -Historical releases before this checklist may have npm versions without matching -GitHub Releases. Document or backfill those explicitly instead of treating the -latest GitHub Release as complete package truth. +- exact version identity across `package.json`, `MODULE.bazel`, and `BUILD.bazel` +- GF validation of `//:pkg` and the real-PostgreSQL concurrency proof +- source tag and GitHub Release resolving to the intended signed commit +- append-only Bazel registry entry in `tinyland-inc/bazel-registry` +- isolated BCR consumer proof for the new module version +- consumer Bzlmod version in bridge and app repositories + +Do not add an npmjs or GitHub Packages gate to this checklist. Historical +provider artifacts may be documented as history but cannot establish current +delivery truth. ## Docs and LLM surfaces diff --git a/docs/generated/package-surface.md b/docs/generated/package-surface.md index a8b0b25..329cc9f 100644 --- a/docs/generated/package-surface.md +++ b/docs/generated/package-surface.md @@ -11,7 +11,7 @@ Generated from `package.json` and the current `src/` tree. | Field | Value | | --- | --- | | Package | `@tummycrypt/scheduling-kit` | -| Version | `0.10.0` | +| Version | `0.11.1` | | Description | Backend-agnostic scheduling components with alternative payment support | | Node range | `>=20 <25` | | Repository | https://github.com/Jesssullivan/scheduling-kit.git | diff --git a/docs/generated/release-metadata.md b/docs/generated/release-metadata.md index 557f900..052224d 100644 --- a/docs/generated/release-metadata.md +++ b/docs/generated/release-metadata.md @@ -5,34 +5,34 @@ DO NOT EDIT: generated by `node scripts/generate-doc-artifacts.mjs`. # Release Metadata Generated from `package.json`, `MODULE.bazel`, `BUILD.bazel`, -`.bazelversion`, and the repo workflows. +`.bazelrc`, `.bazelversion`, and the CI workflow. ## Version Alignment | Surface | Value | | --- | --- | -| package.json version | `0.10.0` | -| MODULE.bazel version | `0.10.0` | -| BUILD.bazel npm_package version | `0.10.0` | -| BUILD.bazel package name | `@tummycrypt/scheduling-kit` | +| package.json version | `0.11.1` | +| MODULE.bazel version | `0.11.1` | +| BUILD.bazel JS package version | `0.11.1` | +| BUILD.bazel JS package name | `@tummycrypt/scheduling-kit` | | .bazelversion | `8.1.1` | | pnpm packageManager | `pnpm@9.15.9` | | MODULE.bazel pnpm version | `9.15.9` | -## Publish And Workflow Inputs +## Delivery And Validation Inputs | Field | Value | | --- | --- | -| npm package | `@tummycrypt/scheduling-kit` | -| npm access | `public` | -| npmjs publish mode | `disabled` | -| GitHub Packages name | `@jesssullivan/scheduling-kit` | +| Bzlmod module | `tummycrypt_scheduling_kit` | +| Bazel registry | https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main | +| Source repository | https://github.com/Jesssullivan/scheduling-kit.git | +| CI purpose | GF validation only | +| CI template | `tinyland-inc/ci-templates@v3.1.0` | | CI runner mode | `repo_owned` | -| Publish mode | `hosted_exception` | +| CI runner labels | `${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}` | | CI node versions | `["20", "22"]` | -| Publish node version | `22` | | Bazel targets | `//:typecheck //:pkg //:test` | -| Bazel package dir | `./bazel-bin/pkg` | +| Bazel artifact dir | `./bazel-bin/pkg` | ## Validation Commands diff --git a/docs/index.md b/docs/index.md index 72f6ff0..3d60579 100644 --- a/docs/index.md +++ b/docs/index.md @@ -29,15 +29,17 @@ Browser automation and remote Acuity scraping belong in This repo intentionally keeps two build surfaces: - `pnpm` is the local package-manager and script interface -- Bazel defines and builds the publishable package artifact used by CI +- Bazel defines and builds the JavaScript package artifact validated by GF The local flake and `.envrc` exist to provision those tools consistently on a fresh machine. They do not replace Bazel or become a second package authority. +The Bzlmod graph through `tinyland-inc/bazel-registry` is the sole delivery +path; provider package registries are not current consumer routes. ## Where to go next -- [Build & Release](build-and-release.md) for bootstrap, Bazel, Nix, and publish hygiene +- [Build & Release](build-and-release.md) for bootstrap, Bazel, Nix, and delivery hygiene - [Testing](testing.md) for the actual test layout and commands in this tree - [Tracing](tracing.md) for cassette-based recording and replay details - [Generated package surface](generated/package-surface.md) for the current export map and source inventory -- [Generated release metadata](generated/release-metadata.md) for version and publish inputs derived from repo files +- [Generated release metadata](generated/release-metadata.md) for version, Bzlmod delivery, and GF validation inputs derived from repo files diff --git a/docs/tracing.md b/docs/tracing.md index 28d78b7..a7c35a3 100644 --- a/docs/tracing.md +++ b/docs/tracing.md @@ -385,7 +385,7 @@ test:cassette-check: ```yaml jobs: test: - runs-on: ubuntu-latest + runs-on: ${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }} steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v2 @@ -393,7 +393,7 @@ jobs: - run: pnpm test:unit cassette-check: - runs-on: ubuntu-latest + runs-on: ${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }} if: github.event_name == 'schedule' steps: - uses: actions/checkout@v4 diff --git a/flake.nix b/flake.nix index 7bf84f2..2b3aaf6 100644 --- a/flake.nix +++ b/flake.nix @@ -76,6 +76,12 @@ checks.docs = docsSite; checks.release-metadata = releaseMetadataCheck; + # Remote-only database proof used by the GF integration lane. Keeping + # PostgreSQL in the locked flake avoids a hosted service-container path. + devShells.ci-postgres = pkgs.mkShellNoCC { + packages = [ pkgs.postgresql_16 ]; + }; + devShells.default = pkgs.mkShellNoCC { packages = with pkgs; [ actionlint diff --git a/llms.txt b/llms.txt index 6737126..916754a 100644 --- a/llms.txt +++ b/llms.txt @@ -6,7 +6,7 @@ DO NOT EDIT: generated by `node scripts/generate-doc-artifacts.mjs`. > Backend-agnostic scheduling library with Effect-powered orchestration, Svelte checkout components, scheduling adapters, and Bazel-backed package artifact checks. -This repository keeps pnpm as the local package-manager and script interface while Bazel defines and builds the publishable package artifact used by CI. +This repository keeps pnpm as the local package-manager and script interface while Bazel defines and builds the JavaScript package artifact validated on GF. Bzlmod through the Tinyland Bazel registry is the sole delivery path. ## Docs @@ -18,7 +18,7 @@ This repository keeps pnpm as the local package-manager and script interface whi ## Generated Reference - [Package surface](docs/generated/package-surface.md): Export map, source inventory, and script entry points derived from repo files. -- [Release metadata](docs/generated/release-metadata.md): Version, workflow, and publish metadata derived from repo files. +- [Release metadata](docs/generated/release-metadata.md): Version, Bzlmod delivery, and GF validation metadata derived from repo files. ## Optional diff --git a/package.json b/package.json index b41493b..f800b56 100644 --- a/package.json +++ b/package.json @@ -88,7 +88,6 @@ "docs:generate": "node scripts/generate-doc-artifacts.mjs", "docs:serve": "pnpm docs:generate && mkdocs serve", "docs:check": "pnpm docs:generate --check && mkdocs build --strict", - "prepublishOnly": "pnpm check:release-metadata && pnpm package && pnpm check:package", "check:release-metadata": "node scripts/check-release-metadata.mjs", "check:package": "publint", "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json", @@ -185,9 +184,6 @@ "type": "git", "url": "git+https://github.com/Jesssullivan/scheduling-kit.git" }, - "publishConfig": { - "access": "public" - }, "pnpm": { "onlyBuiltDependencies": [ "esbuild", diff --git a/scripts/check-release-metadata.mjs b/scripts/check-release-metadata.mjs index b5a859b..0788af1 100644 --- a/scripts/check-release-metadata.mjs +++ b/scripts/check-release-metadata.mjs @@ -1,13 +1,12 @@ -import { readFileSync } from 'node:fs'; +import { existsSync, readFileSync } from 'node:fs'; -const read = (relativePath) => - readFileSync(new URL(relativePath, import.meta.url), 'utf8'); +const repoRoot = new URL('../', import.meta.url); +const read = (relativePath) => readFileSync(new URL(relativePath, repoRoot), 'utf8'); -const packageJson = JSON.parse(read('../package.json')); -const moduleBazel = read('../MODULE.bazel'); -const buildBazel = read('../BUILD.bazel'); -const ciWorkflow = read('../.github/workflows/ci.yml'); -const publishWorkflow = read('../.github/workflows/publish.yml'); +const packageJson = JSON.parse(read('package.json')); +const moduleBazel = read('MODULE.bazel'); +const buildBazel = read('BUILD.bazel'); +const ciWorkflow = read('.github/workflows/ci.yml'); const extract = (source, pattern, label) => { const match = source.match(pattern); @@ -21,12 +20,6 @@ const expectedVersion = packageJson.version; const expectedPackageName = packageJson.name; const expectedPnpmVersion = packageJson.packageManager?.replace(/^pnpm@/, ''); const expectedRepositoryUrl = 'git+https://github.com/Jesssullivan/scheduling-kit.git'; -const expectedPackageBasename = expectedPackageName.split('/').at(-1); -const expectedRepositoryOwner = new URL(expectedRepositoryUrl.replace(/^git\+/, '')) - .pathname.split('/') - .filter(Boolean)[0] - .toLowerCase(); -const expectedGitHubPackageName = `@${expectedRepositoryOwner}/${expectedPackageBasename}`; const includes = (source, needle) => source.includes(needle); const scalar = (value) => @@ -35,17 +28,17 @@ const scalar = (value) => .replace(/^(['"])(.*)\1\s*(?:#.*)?$/, '$2') .replace(/\s+#.*$/, '') .trim(); -// An acceptable pin is either a 40-char commit SHA or an immutable semver -// release tag (e.g. @v2.3.0). The ci-templates README rule is to pin to an -// immutable release tag; a floating branch ref such as @main is not a valid -// pin. Both forms are accepted so kit can converge off the bare-commit pin -// onto the immutable v-tag (TIN-2110) without re-introducing pin debt. const usesPinnedPackageWorkflow = (workflow) => /uses:\s*tinyland-inc\/ci-templates\/\.github\/workflows\/js-bazel-package\.yml@(?:[0-9a-fA-F]{40}|v[0-9]+\.[0-9]+\.[0-9]+)\b/.test( workflow, ); const hasWorkflowConcurrency = (workflow) => /\nconcurrency:\n/.test(workflow); const doesNotInheritAllSecrets = (workflow) => !/secrets:\s*inherit/.test(workflow); +const hasNoWritePermission = (workflow) => !/^\s+[a-z-]+:\s*write\s*$/im.test(workflow); +const hasNoProviderPublicationSurface = (workflow) => + !/(github_package_name|github_package_registry|npm_access|npm_registry_url|npm_publish_provenance|NPM_TOKEN|TINYLAND_GITHUB_PACKAGES_TOKEN|npm\.pkg\.github\.com|registry\.npmjs\.org)/i.test( + workflow, + ); const checks = [ { @@ -73,6 +66,16 @@ const checks = [ actual: packageJson.repository?.url, expected: expectedRepositoryUrl, }, + { + label: 'package.json omits publishConfig', + actual: String(packageJson.publishConfig === undefined), + expected: 'true', + }, + { + label: 'package.json omits publication lifecycle hook', + actual: String(packageJson.scripts?.prepublishOnly === undefined), + expected: 'true', + }, { label: 'CI reusable workflow pin', actual: String(usesPinnedPackageWorkflow(ciWorkflow)), @@ -83,6 +86,21 @@ const checks = [ actual: scalar(extract(ciWorkflow, /contents:\s*([^\n]+)/, 'CI contents permission')), expected: 'read', }, + { + label: 'CI actions permission', + actual: scalar(extract(ciWorkflow, /actions:\s*([^\n]+)/, 'CI actions permission')), + expected: 'read', + }, + { + label: 'CI has no write permissions', + actual: String(hasNoWritePermission(ciWorkflow)), + expected: 'true', + }, + { + label: 'CI has no packages permission', + actual: String(!/^\s+packages:/m.test(ciWorkflow)), + expected: 'true', + }, { label: 'CI concurrency', actual: String(hasWorkflowConcurrency(ciWorkflow)), @@ -100,21 +118,17 @@ const checks = [ }, { label: 'CI runner labels', - actual: scalar( - extract(ciWorkflow, /runner_labels_json:\s*([^\n]+)/, 'CI runner_labels_json'), - ), + actual: scalar(extract(ciWorkflow, /runner_labels_json:\s*([^\n]+)/, 'CI runner_labels_json')), expected: '${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}', }, { - label: 'CI publish mode', - actual: scalar(extract(ciWorkflow, /publish_mode:\s*([^\n]+)/, 'CI publish_mode')), - expected: 'hosted_exception', + label: 'CI isolated workspace', + actual: scalar(extract(ciWorkflow, /workspace_mode:\s*([^\n]+)/, 'CI workspace_mode')), + expected: 'isolated', }, { - label: 'CI npm publish mode', - actual: scalar( - extract(ciWorkflow, /npm_publish_mode:\s*([^\n]+)/, 'CI npm_publish_mode'), - ), + label: 'CI disables npm publication', + actual: scalar(extract(ciWorkflow, /npm_publish_mode:\s*([^\n]+)/, 'CI npm_publish_mode')), expected: 'disabled', }, { @@ -122,11 +136,6 @@ const checks = [ actual: scalar(extract(ciWorkflow, /package_dir:\s*([^\n]+)/, 'CI package_dir')), expected: './bazel-bin/pkg', }, - { - label: 'CI omits npm provenance', - actual: String(!/npm_publish_provenance:/.test(ciWorkflow)), - expected: 'true', - }, { label: 'CI Bazel package target', actual: String( @@ -135,127 +144,42 @@ const checks = [ expected: 'true', }, { - label: 'CI GitHub Packages name', - actual: extract(ciWorkflow, /github_package_name:\s*"([^"]+)"/, 'CI github_package_name'), - expected: expectedGitHubPackageName, - }, - { - label: 'publish reusable workflow pin', - actual: String(usesPinnedPackageWorkflow(publishWorkflow)), + label: 'CI has no hosted exception', + actual: String(!/(hosted_exception|ubuntu-latest)/.test(ciWorkflow)), expected: 'true', }, { - label: 'publish concurrency', - actual: String(hasWorkflowConcurrency(publishWorkflow)), + label: 'CI has no publication provider coordinates or secrets', + actual: String(hasNoProviderPublicationSurface(ciWorkflow)), expected: 'true', }, { - label: 'publish packages permission', - actual: scalar( - extract(publishWorkflow, /packages:\s*([^\n]+)/, 'publish packages permission'), - ), - expected: 'write', - }, - { - label: 'publish provenance permission', - actual: scalar( - extract(publishWorkflow, /id-token:\s*([^\n]+)/, 'publish id-token permission'), - ), - expected: 'write', - }, - { - label: 'publish runner mode', - actual: scalar( - extract(publishWorkflow, /runner_mode:\s*([^\n]+)/, 'publish runner_mode'), - ), - expected: 'repo_owned', - }, - { - label: 'publish runner labels', + label: 'GF PostgreSQL runner labels', actual: scalar( extract( - publishWorkflow, - /runner_labels_json:\s*([^\n]+)/, - 'publish runner_labels_json', + ciWorkflow, + /integration-postgres:[\s\S]*?runs-on:\s*([^\n]+)/, + 'GF PostgreSQL runs-on', ), ), - expected: '${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}', - }, - { - label: 'publish mode', - actual: scalar( - extract(publishWorkflow, /publish_mode:\s*([^\n]+)/, 'publish publish_mode'), - ), - expected: 'hosted_exception', + expected: '${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }}', }, { - label: 'publish npm publish mode', - actual: scalar( - extract( - publishWorkflow, - /npm_publish_mode:\s*([^\n]+)/, - 'publish npm_publish_mode', - ), - ), - expected: 'disabled', - }, - { - label: 'publish package artifact path', - actual: scalar(extract(publishWorkflow, /package_dir:\s*([^\n]+)/, 'publish package_dir')), - expected: './bazel-bin/pkg', - }, - { - label: 'publish omits npm provenance', - actual: String(!/npm_publish_provenance:/.test(publishWorkflow)), - expected: 'true', - }, - { - label: 'publish omits npm token', - actual: String(!/NPM_TOKEN/.test(publishWorkflow)), - expected: 'true', - }, - { - label: 'publish Bazel package target', + label: 'GF PostgreSQL uses pinned nix setup', actual: String( - includes( - extract(publishWorkflow, /bazel_targets:\s*"([^"]+)"/, 'publish bazel_targets'), - '//:pkg', + /uses:\s*tinyland-inc\/ci-templates\/\.github\/actions\/nix-setup@(?:[0-9a-fA-F]{40}|v[0-9]+\.[0-9]+\.[0-9]+)\b/.test( + ciWorkflow, ), ), expected: 'true', }, { - label: 'publish GitHub Packages name', - actual: extract(publishWorkflow, /github_package_name:\s*"([^"]+)"/, 'publish github_package_name'), - expected: expectedGitHubPackageName, + label: 'publication workflow removed', + actual: String(!existsSync(new URL('.github/workflows/publish.yml', repoRoot))), + expected: 'true', }, ]; -// In-house Bzlmod/npm parity (TIN-1996, per the TIN-2035 delivery doctrine): -// every tummycrypt_* bazel_dep must be mirrored by an exact-version -// devDependency on the corresponding @tummycrypt npm package. The lockfile -// drives Bazel's npm_translate_lock, so a range here would let the Bzlmod -// module graph and the npm graph resolve different versions. -// -// Fail-closed against reformatting: each bazel_dep(...) call is matched as a -// whole (any formatting, including buildifier multi-line with trailing -// commas); a tummycrypt_* dep whose version attribute cannot be extracted -// surfaces as a mismatch instead of silently skipping the check. -const npmNameFromModule = (moduleName) => - `@tummycrypt/${moduleName.replace(/^tummycrypt_/, '').replaceAll('_', '-')}`; -for (const [call] of moduleBazel.matchAll(/bazel_dep\s*\([^)]*\)/g)) { - const moduleName = /(? check.actual !== check.expected); if (failures.length > 0) { @@ -268,5 +192,5 @@ if (failures.length > 0) { } console.log( - `release metadata aligned for ${expectedPackageName}@${expectedVersion} (pnpm ${expectedPnpmVersion}, ${expectedGitHubPackageName})`, + `release metadata aligned for ${expectedPackageName}@${expectedVersion}; GF validation only, BCR delivery`, ); diff --git a/scripts/generate-doc-artifacts.mjs b/scripts/generate-doc-artifacts.mjs index e7ce08b..f6bf144 100644 --- a/scripts/generate-doc-artifacts.mjs +++ b/scripts/generate-doc-artifacts.mjs @@ -17,23 +17,26 @@ const extract = (source, pattern, label) => { const packageJson = JSON.parse(read('package.json')); const moduleBazel = read('MODULE.bazel'); const buildBazel = read('BUILD.bazel'); +const bazelRc = read('.bazelrc'); const bazelVersion = read('.bazelversion').trim(); const ciWorkflow = read('.github/workflows/ci.yml'); -const publishWorkflow = read('.github/workflows/publish.yml'); +const moduleName = extract(moduleBazel, /module\([\s\S]*?name = "([^"]+)"/m, 'MODULE.bazel name'); const moduleVersion = extract(moduleBazel, /module\([\s\S]*?version = "([^"]+)"/m, 'MODULE.bazel version'); const buildVersion = extract(buildBazel, /npm_package\([\s\S]*?version = "([^"]+)"/m, 'BUILD.bazel npm_package version'); const buildPackageName = extract(buildBazel, /npm_package\([\s\S]*?package = "([^"]+)"/m, 'BUILD.bazel package name'); const modulePnpmVersion = extract(moduleBazel, /pnpm_version = "([^"]+)"/, 'MODULE.bazel pnpm version'); +const registryUrl = extract(bazelRc, /common --registry=(https:\/\/raw\.githubusercontent\.com\/tinyland-inc\/bazel-registry\/[^\s]+)/, 'Bazel registry URL'); const ciNodeVersions = extract(ciWorkflow, /node_versions:\s*'([^']+)'/, 'CI node versions'); const ciBazelTargets = extract(ciWorkflow, /bazel_targets:\s*"([^"]+)"/, 'CI bazel targets'); const ciPackageDir = extract(ciWorkflow, /package_dir:\s*([^\n]+)/, 'CI package dir'); const ciRunnerMode = extract(ciWorkflow, /runner_mode:\s*([^\n]+)/, 'CI runner mode'); -const publishMode = extract(publishWorkflow, /publish_mode:\s*([^\n]+)/, 'publish mode'); -const npmPublishMode = extract(publishWorkflow, /npm_publish_mode:\s*([^\n]+)/, 'npm publish mode'); -const publishNodeVersion = extract(publishWorkflow, /publish_node_version:\s*"([^"]+)"/, 'publish node version'); -const githubPackageName = extract(publishWorkflow, /github_package_name:\s*"([^"]+)"/, 'GitHub Packages name'); -const npmAccess = extract(publishWorkflow, /npm_access:\s*([^\n]+)/, 'npm access'); +const ciRunnerLabels = extract(ciWorkflow, /runner_labels_json:\s*([^\n]+)/, 'CI runner labels'); +const ciTemplateRef = extract( + ciWorkflow, + /uses:\s*tinyland-inc\/ci-templates\/\.github\/workflows\/js-bazel-package\.yml@([^\s]+)/, + 'CI template ref', +); const countFiles = (directoryUrl) => { let count = 0; @@ -151,7 +154,7 @@ const renderReleaseMetadata = () => `${generatedBanner} # Release Metadata Generated from \`package.json\`, \`MODULE.bazel\`, \`BUILD.bazel\`, -\`.bazelversion\`, and the repo workflows. +\`.bazelrc\`, \`.bazelversion\`, and the CI workflow. ## Version Alignment @@ -160,29 +163,29 @@ ${markdownTable( [ ['package.json version', `\`${packageJson.version}\``], ['MODULE.bazel version', `\`${moduleVersion}\``], - ['BUILD.bazel npm_package version', `\`${buildVersion}\``], - ['BUILD.bazel package name', `\`${buildPackageName}\``], + ['BUILD.bazel JS package version', `\`${buildVersion}\``], + ['BUILD.bazel JS package name', `\`${buildPackageName}\``], ['.bazelversion', `\`${bazelVersion}\``], ['pnpm packageManager', `\`${packageJson.packageManager}\``], ['MODULE.bazel pnpm version', `\`${modulePnpmVersion}\``], ], )} -## Publish And Workflow Inputs +## Delivery And Validation Inputs ${markdownTable( ['Field', 'Value'], [ - ['npm package', `\`${packageJson.name}\``], - ['npm access', `\`${npmAccess}\``], - ['npmjs publish mode', `\`${npmPublishMode}\``], - ['GitHub Packages name', `\`${githubPackageName}\``], + ['Bzlmod module', `\`${moduleName}\``], + ['Bazel registry', registryUrl], + ['Source repository', packageJson.repository.url.replace(/^git\+/, '')], + ['CI purpose', 'GF validation only'], + ['CI template', `\`tinyland-inc/ci-templates@${ciTemplateRef}\``], ['CI runner mode', `\`${ciRunnerMode}\``], - ['Publish mode', `\`${publishMode}\``], + ['CI runner labels', `\`${ciRunnerLabels}\``], ['CI node versions', `\`${ciNodeVersions}\``], - ['Publish node version', `\`${publishNodeVersion}\``], ['Bazel targets', `\`${ciBazelTargets}\``], - ['Bazel package dir', `\`${ciPackageDir}\``], + ['Bazel artifact dir', `\`${ciPackageDir}\``], ], )} @@ -211,7 +214,7 @@ const llmsText = `${generatedBanner} > Backend-agnostic scheduling library with Effect-powered orchestration, Svelte checkout components, scheduling adapters, and Bazel-backed package artifact checks. -This repository keeps pnpm as the local package-manager and script interface while Bazel defines and builds the publishable package artifact used by CI. +This repository keeps pnpm as the local package-manager and script interface while Bazel defines and builds the JavaScript package artifact validated on GF. Bzlmod through the Tinyland Bazel registry is the sole delivery path. ## Docs @@ -223,7 +226,7 @@ This repository keeps pnpm as the local package-manager and script interface whi ## Generated Reference - [Package surface](docs/generated/package-surface.md): Export map, source inventory, and script entry points derived from repo files. -- [Release metadata](docs/generated/release-metadata.md): Version, workflow, and publish metadata derived from repo files. +- [Release metadata](docs/generated/release-metadata.md): Version, Bzlmod delivery, and GF validation metadata derived from repo files. ## Optional diff --git a/tinyland.repo.json b/tinyland.repo.json index bfd61d8..ca4f798 100644 --- a/tinyland.repo.json +++ b/tinyland.repo.json @@ -4,7 +4,7 @@ "repo": { "name": "scheduling-kit", "github": "Jesssullivan/scheduling-kit", - "description": "Backend-agnostic, headless scheduling library with pluggable adapters, payment processors, and Svelte UI; published from the Bazel //:pkg artifact.", + "description": "Backend-agnostic, headless scheduling library with pluggable adapters, payment processors, and Svelte UI; delivered through Bzlmod from the Bazel //:pkg artifact.", "linear": { "initiative": "TIN-89", "issue": "TIN-2110"