From 00432e06c148496a2be425bcac2872799a946399 Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Wed, 16 Sep 2026 16:25:00 -0600 Subject: [PATCH 1/2] fix(release): follow dx-corp ownership --- .../check-release-workflow-contract.mjs | 2 +- .../check-release-workflow-contract.test.mjs | 2 +- .../workflows/release-branch-admission.test.mjs | 4 ++-- .github/workflows/release.yml | 6 +++--- .github/workflows/tag-release.yml | 16 ++++++++-------- scripts/tag-release-contract.test.mjs | 2 ++ 6 files changed, 17 insertions(+), 15 deletions(-) diff --git a/.github/workflows/check-release-workflow-contract.mjs b/.github/workflows/check-release-workflow-contract.mjs index 3d82f68c1..ef0e01278 100644 --- a/.github/workflows/check-release-workflow-contract.mjs +++ b/.github/workflows/check-release-workflow-contract.mjs @@ -427,7 +427,7 @@ export function validateReleaseWorkflow(source) { ]) { if ( (name === "prepare" - ? job.condition !== "github.repository == 'evalops/maestro' && github.ref == 'refs/heads/main'" + ? job.condition !== "github.repository == 'dx-corp/maestro' && github.ref == 'refs/heads/main'" : job.condition) || (job.continueOnError && job.continueOnError !== "false") ) { diff --git a/.github/workflows/check-release-workflow-contract.test.mjs b/.github/workflows/check-release-workflow-contract.test.mjs index 64950f3d5..0d8a7c24d 100644 --- a/.github/workflows/check-release-workflow-contract.test.mjs +++ b/.github/workflows/check-release-workflow-contract.test.mjs @@ -20,7 +20,7 @@ concurrency: group: \${{ github.workflow }}-\${{ startsWith(github.event.client_payload.version || inputs.version, 'v') && (github.event.client_payload.version || inputs.version) || format('v{0}', github.event.client_payload.version || inputs.version) }} jobs: prepare: - if: github.repository == 'evalops/maestro' && github.ref == 'refs/heads/main' + if: github.repository == 'dx-corp/maestro' && github.ref == 'refs/heads/main' runs-on: \${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }} permissions: contents: read diff --git a/.github/workflows/release-branch-admission.test.mjs b/.github/workflows/release-branch-admission.test.mjs index bd1992fa0..a88aabc69 100644 --- a/.github/workflows/release-branch-admission.test.mjs +++ b/.github/workflows/release-branch-admission.test.mjs @@ -48,7 +48,7 @@ test("release admission requires protected history and all pinned checks", () => const main = git("rev-parse", "HEAD"); const orphan = git("commit-tree", "HEAD^{tree}", "-m", "unreviewed identical source"); const tools = join(root,"tools"); mkdirSync(tools); - writeFileSync(join(tools,"gh"), '#!/bin/sh\n[ "$*" = "api repos/evalops/maestro/rules/branches/releases%2Fv0.10.76" ] || exit 91\nprintf "%s\\n" "$TEST_RELEASE_RULES"\n', {mode:0o755}); + writeFileSync(join(tools,"gh"), '#!/bin/sh\n[ "$*" = "api repos/dx-corp/maestro/rules/branches/releases%2Fv0.10.76" ] || exit 91\nprintf "%s\\n" "$TEST_RELEASE_RULES"\n', {mode:0o755}); const run = (sha, policy) => spawnSync("bash", ["--norc", "-e", "-c", admission], { cwd, encoding:"utf8", timeout:10000, env:{...process.env, PATH:`${tools}:${process.env.PATH}`, release_sha:sha, release_tag:"v0.10.76", TEST_RELEASE_RULES:JSON.stringify(policy)}, @@ -68,5 +68,5 @@ test("release admission requires protected history and all pinned checks", () => test("public main cannot create a release tag from moving source", () => { const tag = parseWorkflow(readFileSync(new URL("./tag-release.yml", import.meta.url), "utf8")); const release = tag.jobs["tag-current-version"].steps.find(step => step.id === "release"); - assert.equal(release.with["create-tag-if-missing"], "${{ github.repository != 'evalops/maestro' }}"); + assert.equal(release.with["create-tag-if-missing"], "${{ github.repository != 'dx-corp/maestro' }}"); }); diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b93f4ddf5..7225ca7fb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ concurrency: jobs: prepare: - if: github.repository == 'evalops/maestro' && github.ref == 'refs/heads/main' + if: github.repository == 'dx-corp/maestro' && github.ref == 'refs/heads/main' runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }} timeout-minutes: 10 permissions: @@ -87,7 +87,7 @@ jobs: timeout 60s git fetch --no-tags origin main if ! git merge-base --is-ancestor "$release_sha" FETCH_HEAD; then release_branch="releases/${release_tag}" - rules="$(timeout 60s gh api "repos/evalops/maestro/rules/branches/releases%2F${release_tag}")" + rules="$(timeout 60s gh api "repos/dx-corp/maestro/rules/branches/releases%2F${release_tag}")" jq -e ' any(.[]; .type == "pull_request") and any(.[]; .type == "non_fast_forward") and @@ -328,7 +328,7 @@ jobs: publish_with_token() { local tarball="$1" if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then - echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for evalops/maestro release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro." + echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for dx-corp/maestro release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro." return 1 fi diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml index 3490ece68..c0fbdd5f6 100644 --- a/.github/workflows/tag-release.yml +++ b/.github/workflows/tag-release.yml @@ -18,7 +18,7 @@ env: jobs: tag-current-version: - runs-on: ${{ github.repository == 'evalops/maestro-internal' && (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') || (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') }} + runs-on: ${{ github.repository == 'dx-corp/maestro-internal' && (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') || (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') }} timeout-minutes: 45 permissions: actions: read @@ -42,11 +42,11 @@ jobs: uses: ./.github/actions/release-context with: fallback-to-package-version: "true" - create-tag-if-missing: "${{ github.repository != 'evalops/maestro' }}" + create-tag-if-missing: "${{ github.repository != 'dx-corp/maestro' }}" - id: registry-release name: Check npm registry release - if: ${{ github.repository == 'evalops/maestro' }} + if: ${{ github.repository == 'dx-corp/maestro' }} env: PACKAGE_NAME: ${{ steps.release.outputs.package_name }} RELEASE_VERSION: ${{ steps.release.outputs.release_version }} @@ -84,7 +84,7 @@ jobs: - id: staged-release name: Check signed Mono staging - if: ${{ github.repository == 'evalops/maestro' }} + if: ${{ github.repository == 'dx-corp/maestro' }} env: GH_TOKEN: ${{ github.token }} RELEASE_TAG: ${{ steps.release.outputs.release_tag }} @@ -107,7 +107,7 @@ jobs: - id: active-release name: Check active public release workflow - if: ${{ github.repository == 'evalops/maestro' && steps.registry-release.outputs.published != 'true' }} + if: ${{ github.repository == 'dx-corp/maestro' && steps.registry-release.outputs.published != 'true' }} env: GH_TOKEN: ${{ github.token }} RELEASE_TAG: ${{ steps.release.outputs.release_tag }} @@ -133,7 +133,7 @@ jobs: # in flight (queued/waiting/in_progress). A release waiting on the # npm-release environment approval must not red every subsequent main push. - name: Require version bump for existing release tag - if: ${{ github.repository == 'evalops/maestro' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }} + if: ${{ github.repository == 'dx-corp/maestro' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }} env: RELEASE_TAG: ${{ steps.release.outputs.release_tag }} RELEASE_VERSION: ${{ steps.release.outputs.release_version }} @@ -176,7 +176,7 @@ jobs: verify-published-registry-package: needs: tag-current-version - if: ${{ github.repository == 'evalops/maestro' && needs.tag-current-version.outputs.registry_published == 'true' }} + if: ${{ github.repository == 'dx-corp/maestro' && needs.tag-current-version.outputs.registry_published == 'true' }} runs-on: ${{ vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest' }} timeout-minutes: 30 permissions: @@ -222,7 +222,7 @@ jobs: needs: - tag-current-version - verify-published-registry-package - if: ${{ always() && github.repository == 'evalops/maestro' && needs.tag-current-version.result == 'success' && needs.tag-current-version.outputs.staged_ready == 'true' && (needs.tag-current-version.outputs.registry_published != 'true' || needs.verify-published-registry-package.result == 'success') && (needs.tag-current-version.outputs.tag_exists != 'true' || needs.tag-current-version.outputs.registry_published != 'true') && (needs.tag-current-version.outputs.active_release_count == '0' || needs.tag-current-version.outputs.active_release_count == '') }} + if: ${{ always() && github.repository == 'dx-corp/maestro' && needs.tag-current-version.result == 'success' && needs.tag-current-version.outputs.staged_ready == 'true' && (needs.tag-current-version.outputs.registry_published != 'true' || needs.verify-published-registry-package.result == 'success') && (needs.tag-current-version.outputs.tag_exists != 'true' || needs.tag-current-version.outputs.registry_published != 'true') && (needs.tag-current-version.outputs.active_release_count == '0' || needs.tag-current-version.outputs.active_release_count == '') }} runs-on: ${{ vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest' }} timeout-minutes: 10 permissions: diff --git a/scripts/tag-release-contract.test.mjs b/scripts/tag-release-contract.test.mjs index 1e597383e..54bbac4d1 100644 --- a/scripts/tag-release-contract.test.mjs +++ b/scripts/tag-release-contract.test.mjs @@ -13,6 +13,8 @@ test("tag-release does not cancel in-progress runs", () => { test("tag-release dispatches a public release after tagging", () => { assert.match(workflow, /dispatch-public-release:/); + assert.match(workflow, /github\.repository == 'dx-corp\/maestro'/); + assert.doesNotMatch(workflow, /github\.repository == 'evalops\/maestro'/); }); test("internal tag-release dispatches public-release-mirror after creating a tag", () => { From 533d7a707ae53d715a273f90586483af76c2dc23 Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Wed, 16 Sep 2026 16:33:47 -0600 Subject: [PATCH 2/2] fix(release): accept dx-corp source provenance --- .github/workflows/public-source-provenance.yml | 6 +++--- .github/workflows/source-provenance-link.test.mjs | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/public-source-provenance.yml b/.github/workflows/public-source-provenance.yml index ad7ba4448..e4550dd5f 100644 --- a/.github/workflows/public-source-provenance.yml +++ b/.github/workflows/public-source-provenance.yml @@ -104,7 +104,7 @@ jobs: exit 0 fi - if grep -Eiq "(https://github[.]com/evalops/(mono|maestro-internal)/pull/[0-9]+|evalops/(mono|maestro-internal)#[0-9]+|maestro-internal#[0-9]+)" <<< "${PR_BODY:-}"; then + if grep -Eiq "(https://github[.]com/(dx-corp|evalops)/(mono|maestro-internal)/pull/[0-9]+|(dx-corp|evalops)/(mono|maestro-internal)#[0-9]+|maestro-internal#[0-9]+)" <<< "${PR_BODY:-}"; then echo "Mirrored source provenance link found." exit 0 fi @@ -116,7 +116,7 @@ jobs: fi # shellcheck disable=SC2016 # Backticks are literal Markdown delimiters in the printf format. - printf -v comment_body '%s\nThis PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.\n\nLink the matching evalops/mono source PR (legacy maestro-internal links remain accepted), then re-run the check:\n\n- `https://github.com/evalops/mono/pull/`\n- `evalops/mono#`\n- `maestro-internal#`\n\nMirrored files touched:\n\n%s' \ + printf -v comment_body '%s\nThis PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.\n\nLink the matching dx-corp/mono source PR (legacy evalops and maestro-internal links remain accepted), then re-run the check:\n\n- `https://github.com/dx-corp/mono/pull/`\n- `dx-corp/mono#`\n- `maestro-internal#`\n\nMirrored files touched:\n\n%s' \ "$marker" "$file_list" existing_comment_id="$( @@ -137,5 +137,5 @@ jobs: -f body="$comment_body" >/dev/null fi - echo "::error::Public PRs that touch mirrored source must link the matching evalops/mono source PR." + echo "::error::Public PRs that touch mirrored source must link the matching dx-corp/mono source PR." exit 1 diff --git a/.github/workflows/source-provenance-link.test.mjs b/.github/workflows/source-provenance-link.test.mjs index ebbc25247..12b3a626c 100644 --- a/.github/workflows/source-provenance-link.test.mjs +++ b/.github/workflows/source-provenance-link.test.mjs @@ -8,6 +8,8 @@ const pattern = workflow.match(/if grep -Eiq "([^"\n]*https:\/\/github[^"\n]*)" assert.ok(pattern, "actual workflow provenance expression"); for (const link of [ + "https://github.com/dx-corp/mono/pull/8492", + "dx-corp/mono#8492", "https://github.com/evalops/mono/pull/8492", "evalops/mono#8492", "https://github.com/evalops/maestro-internal/pull/42", @@ -21,6 +23,7 @@ for (const link of [ for (const link of [ "No source PR", "https://github.com/another/mono/pull/8492", + "https://github.com/dx-corp/maestro/pull/1063", "https://github.com/evalops/maestro/pull/1063", "https://github.com/evalops/mono/issues/8492", "https://github.com/evalops/mono/pull/",