Conversation
Consumers pin two stable facades instead of per-stack files:
gate: uses gate.yml with {stack, working_directory} # -> _java/_ts/_php
security: uses security.yml # -> _guards + _semgrep
The per-stack + guards + semgrep workflows are _-prefixed to mark them internal; facades
reach them via nested local 'uses: ./.github/workflows/_X.yml', which GitHub resolves to
foundry at the consumer's pinned ref (no cross-repo pin). Each facade exposes one stable
*-ok aggregate check, so required-check names don't churn when a stack is added or an
internal renamed. foundry-init emits facade-callers; README/FEATURES/OVERVIEW/DESIGN updated.
BREAKING CHANGE: the CI API is now gate.yml + security.yml. Direct references to
java.yml/ts.yml/php.yml/tier0.yml/semgrep.yml must move to the facades. @v1 keeps the old
names frozen; adopt the facades at @v2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v2.0.0 foundation. Makes foundry genuinely plug-and-play: consumers pin two stable facades and pass their stack, instead of knowing which per-stack workflow files exist.
The API
gate.ymldispatches bystack(ts/java/php) to the internal per-stack gate (+ smells; Java adds opt-in spotbugs). Monorepo → call once per package.security.ymlruns secrets + ruleset-guard + SAST in one call.gate-ok/security-okaggregate → the only required checks; their names never churn when a stack is added or an internal is renamed.How it works
Per-stack + guards + semgrep are now
_-prefixed internals (_java/_ts/_php/_guards/_semgrep). The facades reach them via nested localuses: ./.github/workflows/_X.yml, which GitHub resolves to foundry at the ref the consumer pinned — so there's no cross-repo pin to keep in sync, and the internals can be reorganized freely behind the facade.web/bootstrap/ratchet-report/autofixstay public (called directly).foundry-init now emits facade-callers; README/FEATURES/OVERVIEW/DESIGN updated.
@v1stays frozen with the old per-stack names; adopt the facades at@v2.Validation: foundry's own actionlint (lint-workflows) checks the YAML/expressions here. The full runtime behavior (dispatch + aggregate + nested-reusable resolution) gets its first real exercise when jobbuddy migrates to consume these facades — PR2, which lands after this merges +
v2is cut (jobbuddy pins@v2). If the nested-resolution behaves unexpectedly, it surfaces there and I fix it in v2.0.1.