mirror of
https://github.com/ruvnet/RuView
synced 2026-07-25 17:51:48 +00:00
Claude
9109269329
ADR-263 (@ruvnet/ruview 0.2.0), O1-O9: - claim-check fails closed on empty input (CLI exit 2, empty_text tool error) - MCP stdio server dispatches tools/call asynchronously (promise-based spawn); ping answers while a 3s fake verify runs — pinned by new e2e test - optionalDependencies dropped: cold npx installs exactly 1 package (MEASURED: was 4 pkgs/620kB/71 files via npm i in a clean prefix) - bounded rolling output tails replace spawnSync 1MiB maxBuffer - node_monitor port passed via sys.argv, never spliced into python -c source - serverInfo.version read from package.json; resources/prompts stubs - skills single-sourced: prepack sync script generates .claude/skills/ copies - which() = memoized dep-free PATH scan - tools underscore-canonical (ruview_claim_check, ...) + dotted aliases - guardrail precision: word-boundary map/f1/auc/iou, code-span + F1/O2 label scrubbing, quantitative-claims-only; packaging reproducer hints - 30/30 tests (was 17), incl. concurrency e2e + fail-open regression pins ADR-264 (@ruvnet/rvagent 0.2.0), O1-O9: - exports fixed: types-first, phantom dist/index.cjs require target removed - tarball map-free: 127,704B unpacked / 46 files / 0 maps (MEASURED, npm pack --dry-run; was 188kB incl. 44 maps referencing unshipped src) - Streamable HTTP actually wired behind RVAGENT_HTTP_PORT: one transport + one MCP server per session (mcp-session-id routing), 1MiB body cap (413), port-aware localhost origin gate; dual-transport description now true - tools renamed underscore-canonical with dotted router-only aliases - single Zod validation gate; advertised inputSchema generated from the same Zod source (zod-to-json-schema) - train_count: parent log fds closed (was leaking 2/job); job records persisted to <jobsDir>/<id>.json (job_status survives restarts); bounded log-tail reads - detectCogBinary probes its candidates instead of dead-coding them - version from package.json; @types/express dropped; @types/jest -> 29 - README rewritten to match reality (no phantom subcommands/policy layer) - 99/99 jest tests (incl. new session/body-cap suite + previously-broken manifest suite); stdio handshake + HTTP session flow smoke-tested live ADR-265 D1-D4: - .github/workflows/npm-packages.yml: 3-package x Node 20/22 gate — tests, version-literal grep (D3), pack-content/size gate, tarball-install smoke test (catches the ADR-264 F1 class), README claim-check (D4) - .github/workflows/ruview-npm-release.yml: publish from CI only with npm publish --provenance - @ruv/ruview-cli bin renamed ruview-cli (ruview bin belongs to @ruvnet/ruview); version single-sourced - ci.yml NODE_VERSION 18 -> 20 ADR statuses updated to Accepted/implemented; harness manifest re-pinned; ADR-263/264/265 + both package READMEs pass claim-check. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01WrGfTGKv1oWZ6iwXZACULz
79 lines
2.4 KiB
YAML
79 lines
2.4 KiB
YAML
# ADR-265 D2 — publish only from CI, with provenance.
|
|
#
|
|
# Manual `npm publish` from laptops stops: this workflow re-runs the ADR-265 D1
|
|
# gate for the selected package and then publishes with npm provenance
|
|
# attestations (OIDC), tying every published version to a public commit +
|
|
# workflow run — the npm-side analogue of the ADR-028 witness bundle.
|
|
#
|
|
# Requires: NPM_TOKEN repo secret (an npm automation token), or npm Trusted
|
|
# Publishing configured for the package (in which case the token is unused).
|
|
|
|
name: ruview npm release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
package:
|
|
description: 'Package directory to publish'
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- harness/ruview
|
|
- tools/ruview-mcp
|
|
dist_tag:
|
|
description: 'npm dist-tag'
|
|
required: false
|
|
default: 'latest'
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write # npm --provenance
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ inputs.package }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
registry-url: 'https://registry.npmjs.org'
|
|
|
|
- name: Install
|
|
run: |
|
|
if [ -f package-lock.json ]; then npm ci; else npm install --no-fund --no-audit; fi
|
|
|
|
- name: Build (if present)
|
|
run: npm run build --if-present
|
|
|
|
- name: Test
|
|
run: npm test --if-present
|
|
|
|
- name: Pack gate (no maps)
|
|
run: |
|
|
npm pack --dry-run --json 2>/dev/null | node -e "
|
|
const [info] = JSON.parse(require('fs').readFileSync(0, 'utf8'));
|
|
const maps = info.files.filter((f) => f.path.endsWith('.map'));
|
|
if (maps.length > 0) {
|
|
console.error('Tarball contains source maps (ADR-264 F2):', maps.map((m) => m.path));
|
|
process.exit(1);
|
|
}
|
|
console.log(\`pack gate OK: \${info.files.length} files, \${info.unpackedSize} B unpacked\`);
|
|
"
|
|
|
|
- name: Claim-check README
|
|
run: |
|
|
if [ -f README.md ]; then
|
|
node "$GITHUB_WORKSPACE/harness/ruview/bin/cli.js" claim-check --file README.md
|
|
fi
|
|
|
|
- name: Publish (with provenance)
|
|
run: npm publish --provenance --access public --tag "${{ inputs.dist_tag }}"
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|