diff --git a/.github/workflows/channel-release-contract.test.mjs b/.github/workflows/channel-release-contract.test.mjs index 3a7f7546e..de34388da 100644 --- a/.github/workflows/channel-release-contract.test.mjs +++ b/.github/workflows/channel-release-contract.test.mjs @@ -6,6 +6,8 @@ const workflow = await readFile(new URL("./channel-release.yml", import.meta.url const releaseWorkflow = await readFile(new URL("./release.yml", import.meta.url), "utf8"); test("preview schedules finalize only staged signed candidates", () => { + assert.match(workflow, /if: github\.repository == 'dx-corp\/code' && github\.ref == 'refs\/heads\/main'/); + assert.doesNotMatch(workflow, /github\.repository == '(?:evalops|dx-corp)\/maestro'/); assert.match(workflow, /"0 5 \* \* \*" # alpha/); assert.match(workflow, /"30 5 \* \* \*" # beta/); assert.match(workflow, /MONO_SHA256SUMS\.cosign\.bundle/); diff --git a/.github/workflows/channel-release.yml b/.github/workflows/channel-release.yml index a31709f8c..ffbcb0c40 100644 --- a/.github/workflows/channel-release.yml +++ b/.github/workflows/channel-release.yml @@ -23,7 +23,7 @@ concurrency: jobs: publish-channel-source: - if: github.repository == 'evalops/maestro' && github.ref == 'refs/heads/main' + if: github.repository == 'dx-corp/code' && github.ref == 'refs/heads/main' runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }} timeout-minutes: 30 permissions: diff --git a/.github/workflows/public-source-provenance.yml b/.github/workflows/public-source-provenance.yml index ad7ba4448..e4550dd5f 100644 --- a/.github/workflows/public-source-provenance.yml +++ b/.github/workflows/public-source-provenance.yml @@ -104,7 +104,7 @@ jobs: exit 0 fi - if grep -Eiq "(https://github[.]com/evalops/(mono|maestro-internal)/pull/[0-9]+|evalops/(mono|maestro-internal)#[0-9]+|maestro-internal#[0-9]+)" <<< "${PR_BODY:-}"; then + if grep -Eiq "(https://github[.]com/(dx-corp|evalops)/(mono|maestro-internal)/pull/[0-9]+|(dx-corp|evalops)/(mono|maestro-internal)#[0-9]+|maestro-internal#[0-9]+)" <<< "${PR_BODY:-}"; then echo "Mirrored source provenance link found." exit 0 fi @@ -116,7 +116,7 @@ jobs: fi # shellcheck disable=SC2016 # Backticks are literal Markdown delimiters in the printf format. - printf -v comment_body '%s\nThis PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.\n\nLink the matching evalops/mono source PR (legacy maestro-internal links remain accepted), then re-run the check:\n\n- `https://github.com/evalops/mono/pull/`\n- `evalops/mono#`\n- `maestro-internal#`\n\nMirrored files touched:\n\n%s' \ + printf -v comment_body '%s\nThis PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.\n\nLink the matching dx-corp/mono source PR (legacy evalops and maestro-internal links remain accepted), then re-run the check:\n\n- `https://github.com/dx-corp/mono/pull/`\n- `dx-corp/mono#`\n- `maestro-internal#`\n\nMirrored files touched:\n\n%s' \ "$marker" "$file_list" existing_comment_id="$( @@ -137,5 +137,5 @@ jobs: -f body="$comment_body" >/dev/null fi - echo "::error::Public PRs that touch mirrored source must link the matching evalops/mono source PR." + echo "::error::Public PRs that touch mirrored source must link the matching dx-corp/mono source PR." exit 1 diff --git a/.github/workflows/release-branch-admission.test.mjs b/.github/workflows/release-branch-admission.test.mjs index 2c314beb7..851eade17 100644 --- a/.github/workflows/release-branch-admission.test.mjs +++ b/.github/workflows/release-branch-admission.test.mjs @@ -68,5 +68,5 @@ test("release admission requires protected history and all pinned checks", () => test("public main cannot create a release tag from moving source", () => { const tag = parseWorkflow(readFileSync(new URL("./tag-release.yml", import.meta.url), "utf8")); const release = tag.jobs["tag-current-version"].steps.find(step => step.id === "release"); - assert.equal(release.with["create-tag-if-missing"], "${{ github.repository != 'evalops/maestro' }}"); + assert.equal(release.with["create-tag-if-missing"], "${{ github.repository != 'dx-corp/code' }}"); }); diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6703a7a59..73a7b3dea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -328,7 +328,7 @@ jobs: publish_with_token() { local tarball="$1" if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then - echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for evalops/maestro release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro." + echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for dx-corp/code release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro." return 1 fi diff --git a/.github/workflows/source-provenance-link.test.mjs b/.github/workflows/source-provenance-link.test.mjs index ebbc25247..12b3a626c 100644 --- a/.github/workflows/source-provenance-link.test.mjs +++ b/.github/workflows/source-provenance-link.test.mjs @@ -8,6 +8,8 @@ const pattern = workflow.match(/if grep -Eiq "([^"\n]*https:\/\/github[^"\n]*)" assert.ok(pattern, "actual workflow provenance expression"); for (const link of [ + "https://github.com/dx-corp/mono/pull/8492", + "dx-corp/mono#8492", "https://github.com/evalops/mono/pull/8492", "evalops/mono#8492", "https://github.com/evalops/maestro-internal/pull/42", @@ -21,6 +23,7 @@ for (const link of [ for (const link of [ "No source PR", "https://github.com/another/mono/pull/8492", + "https://github.com/dx-corp/maestro/pull/1063", "https://github.com/evalops/maestro/pull/1063", "https://github.com/evalops/mono/issues/8492", "https://github.com/evalops/mono/pull/", diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml index 3490ece68..2935ae9bf 100644 --- a/.github/workflows/tag-release.yml +++ b/.github/workflows/tag-release.yml @@ -18,7 +18,7 @@ env: jobs: tag-current-version: - runs-on: ${{ github.repository == 'evalops/maestro-internal' && (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') || (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') }} + runs-on: ${{ github.repository == 'dx-corp/maestro-internal' && (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') || (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') }} timeout-minutes: 45 permissions: actions: read @@ -42,11 +42,11 @@ jobs: uses: ./.github/actions/release-context with: fallback-to-package-version: "true" - create-tag-if-missing: "${{ github.repository != 'evalops/maestro' }}" + create-tag-if-missing: "${{ github.repository != 'dx-corp/code' }}" - id: registry-release name: Check npm registry release - if: ${{ github.repository == 'evalops/maestro' }} + if: ${{ github.repository == 'dx-corp/code' }} env: PACKAGE_NAME: ${{ steps.release.outputs.package_name }} RELEASE_VERSION: ${{ steps.release.outputs.release_version }} @@ -84,7 +84,7 @@ jobs: - id: staged-release name: Check signed Mono staging - if: ${{ github.repository == 'evalops/maestro' }} + if: ${{ github.repository == 'dx-corp/code' }} env: GH_TOKEN: ${{ github.token }} RELEASE_TAG: ${{ steps.release.outputs.release_tag }} @@ -107,7 +107,7 @@ jobs: - id: active-release name: Check active public release workflow - if: ${{ github.repository == 'evalops/maestro' && steps.registry-release.outputs.published != 'true' }} + if: ${{ github.repository == 'dx-corp/code' && steps.registry-release.outputs.published != 'true' }} env: GH_TOKEN: ${{ github.token }} RELEASE_TAG: ${{ steps.release.outputs.release_tag }} @@ -133,7 +133,7 @@ jobs: # in flight (queued/waiting/in_progress). A release waiting on the # npm-release environment approval must not red every subsequent main push. - name: Require version bump for existing release tag - if: ${{ github.repository == 'evalops/maestro' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }} + if: ${{ github.repository == 'dx-corp/code' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }} env: RELEASE_TAG: ${{ steps.release.outputs.release_tag }} RELEASE_VERSION: ${{ steps.release.outputs.release_version }} @@ -176,7 +176,7 @@ jobs: verify-published-registry-package: needs: tag-current-version - if: ${{ github.repository == 'evalops/maestro' && needs.tag-current-version.outputs.registry_published == 'true' }} + if: ${{ github.repository == 'dx-corp/code' && needs.tag-current-version.outputs.registry_published == 'true' }} runs-on: ${{ vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest' }} timeout-minutes: 30 permissions: @@ -222,7 +222,7 @@ jobs: needs: - tag-current-version - verify-published-registry-package - if: ${{ always() && github.repository == 'evalops/maestro' && needs.tag-current-version.result == 'success' && needs.tag-current-version.outputs.staged_ready == 'true' && (needs.tag-current-version.outputs.registry_published != 'true' || needs.verify-published-registry-package.result == 'success') && (needs.tag-current-version.outputs.tag_exists != 'true' || needs.tag-current-version.outputs.registry_published != 'true') && (needs.tag-current-version.outputs.active_release_count == '0' || needs.tag-current-version.outputs.active_release_count == '') }} + if: ${{ always() && github.repository == 'dx-corp/code' && needs.tag-current-version.result == 'success' && needs.tag-current-version.outputs.staged_ready == 'true' && (needs.tag-current-version.outputs.registry_published != 'true' || needs.verify-published-registry-package.result == 'success') && (needs.tag-current-version.outputs.tag_exists != 'true' || needs.tag-current-version.outputs.registry_published != 'true') && (needs.tag-current-version.outputs.active_release_count == '0' || needs.tag-current-version.outputs.active_release_count == '') }} runs-on: ${{ vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest' }} timeout-minutes: 10 permissions: diff --git a/scripts/tag-release-contract.test.mjs b/scripts/tag-release-contract.test.mjs index 1e597383e..1f5e29420 100644 --- a/scripts/tag-release-contract.test.mjs +++ b/scripts/tag-release-contract.test.mjs @@ -13,6 +13,8 @@ test("tag-release does not cancel in-progress runs", () => { test("tag-release dispatches a public release after tagging", () => { assert.match(workflow, /dispatch-public-release:/); + assert.match(workflow, /github\.repository == 'dx-corp\/code'/); + assert.doesNotMatch(workflow, /github\.repository == 'evalops\/maestro'/); }); test("internal tag-release dispatches public-release-mirror after creating a tag", () => {