fix(release): finish dx-corp/code ownership migration

.github/workflows/channel-release-contract.test.mjs

@@ -6,6 +6,8 @@ const workflow = await readFile(new URL("./channel-release.yml", import.meta.url
 const releaseWorkflow = await readFile(new URL("./release.yml", import.meta.url), "utf8");
 
 test("preview schedules finalize only staged signed candidates", () => {
+ assert.match(workflow, /if: github\.repository == 'dx-corp\/code' && github\.ref == 'refs\/heads\/main'/);
+ assert.doesNotMatch(workflow, /github\.repository == '(?:evalops|dx-corp)\/maestro'/);
  assert.match(workflow, /"0 5 \* \* \*" # alpha/);
  assert.match(workflow, /"30 5 \* \* \*" # beta/);
  assert.match(workflow, /MONO_SHA256SUMS\.cosign\.bundle/);

.github/workflows/channel-release.yml

@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   publish-channel-source:
-    if: github.repository == 'evalops/maestro' && github.ref == 'refs/heads/main'
+    if: github.repository == 'dx-corp/code' && github.ref == 'refs/heads/main'
     runs-on: ${{ vars.PUBLIC_RELEASE_RUNNER || 'ubuntu-latest' }}
     timeout-minutes: 30
     permissions:

.github/workflows/public-source-provenance.yml

@@ -104,7 +104,7 @@ jobs:
             exit 0
           fi
 
-          if grep -Eiq "(https://github[.]com/evalops/(mono|maestro-internal)/pull/[0-9]+|evalops/(mono|maestro-internal)#[0-9]+|maestro-internal#[0-9]+)" <<< "${PR_BODY:-}"; then
+          if grep -Eiq "(https://github[.]com/(dx-corp|evalops)/(mono|maestro-internal)/pull/[0-9]+|(dx-corp|evalops)/(mono|maestro-internal)#[0-9]+|maestro-internal#[0-9]+)" <<< "${PR_BODY:-}"; then
             echo "Mirrored source provenance link found."
             exit 0
           fi
@@ -116,7 +116,7 @@ jobs:
           fi
 
           # shellcheck disable=SC2016 # Backticks are literal Markdown delimiters in the printf format.
-          printf -v comment_body '%s\nThis PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.\n\nLink the matching evalops/mono source PR (legacy maestro-internal links remain accepted), then re-run the check:\n\n- `https://github.com/evalops/mono/pull/<number>`\n- `evalops/mono#<number>`\n- `maestro-internal#<number>`\n\nMirrored files touched:\n\n%s' \
+          printf -v comment_body '%s\nThis PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.\n\nLink the matching dx-corp/mono source PR (legacy evalops and maestro-internal links remain accepted), then re-run the check:\n\n- `https://github.com/dx-corp/mono/pull/<number>`\n- `dx-corp/mono#<number>`\n- `maestro-internal#<number>`\n\nMirrored files touched:\n\n%s' \
             "$marker" "$file_list"
 
           existing_comment_id="$(
@@ -137,5 +137,5 @@ jobs:
               -f body="$comment_body" >/dev/null
           fi
 
-          echo "::error::Public PRs that touch mirrored source must link the matching evalops/mono source PR."
+          echo "::error::Public PRs that touch mirrored source must link the matching dx-corp/mono source PR."
           exit 1

.github/workflows/release-branch-admission.test.mjs

@@ -68,5 +68,5 @@ test("release admission requires protected history and all pinned checks", () =>
 test("public main cannot create a release tag from moving source", () => {
   const tag = parseWorkflow(readFileSync(new URL("./tag-release.yml", import.meta.url), "utf8"));
   const release = tag.jobs["tag-current-version"].steps.find(step => step.id === "release");
-  assert.equal(release.with["create-tag-if-missing"], "${{ github.repository != 'evalops/maestro' }}");
+  assert.equal(release.with["create-tag-if-missing"], "${{ github.repository != 'dx-corp/code' }}");
 });

.github/workflows/release.yml

@@ -328,7 +328,7 @@ jobs:
           publish_with_token() {
             local tarball="$1"
             if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
-              echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for evalops/maestro release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro."
+              echo "::error::OIDC publish failed and secrets.NPM_TOKEN is empty. Configure npm trusted publishing for dx-corp/code release.yml (npm-release env) and ensure this job has id-token: write, or set a granular NPM_TOKEN with write on @evalops/maestro."
               return 1
             fi
 

.github/workflows/source-provenance-link.test.mjs

@@ -8,6 +8,8 @@ const pattern = workflow.match(/if grep -Eiq "([^"\n]*https:\/\/github[^"\n]*)"
 assert.ok(pattern, "actual workflow provenance expression");
 
 for (const link of [
+  "https://github.com/dx-corp/mono/pull/8492",
+  "dx-corp/mono#8492",
   "https://github.com/evalops/mono/pull/8492",
   "evalops/mono#8492",
   "https://github.com/evalops/maestro-internal/pull/42",
@@ -21,6 +23,7 @@ for (const link of [
 for (const link of [
   "No source PR",
   "https://github.com/another/mono/pull/8492",
+  "https://github.com/dx-corp/maestro/pull/1063",
   "https://github.com/evalops/maestro/pull/1063",
   "https://github.com/evalops/mono/issues/8492",
   "https://github.com/evalops/mono/pull/",

.github/workflows/tag-release.yml

@@ -18,7 +18,7 @@ env:
 
 jobs:
   tag-current-version:
-    runs-on: ${{ github.repository == 'evalops/maestro-internal' && (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') || (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') }}
+    runs-on: ${{ github.repository == 'dx-corp/maestro-internal' && (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') || (vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest') }}
     timeout-minutes: 45
     permissions:
       actions: read
@@ -42,11 +42,11 @@ jobs:
         uses: ./.github/actions/release-context
         with:
           fallback-to-package-version: "true"
-          create-tag-if-missing: "${{ github.repository != 'evalops/maestro' }}"
+          create-tag-if-missing: "${{ github.repository != 'dx-corp/code' }}"
 
       - id: registry-release
         name: Check npm registry release
-        if: ${{ github.repository == 'evalops/maestro' }}
+        if: ${{ github.repository == 'dx-corp/code' }}
         env:
           PACKAGE_NAME: ${{ steps.release.outputs.package_name }}
           RELEASE_VERSION: ${{ steps.release.outputs.release_version }}
@@ -84,7 +84,7 @@ jobs:
 
       - id: staged-release
         name: Check signed Mono staging
-        if: ${{ github.repository == 'evalops/maestro' }}
+        if: ${{ github.repository == 'dx-corp/code' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ steps.release.outputs.release_tag }}
@@ -107,7 +107,7 @@ jobs:
 
       - id: active-release
         name: Check active public release workflow
-        if: ${{ github.repository == 'evalops/maestro' && steps.registry-release.outputs.published != 'true' }}
+        if: ${{ github.repository == 'dx-corp/code' && steps.registry-release.outputs.published != 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ steps.release.outputs.release_tag }}
@@ -133,7 +133,7 @@ jobs:
       # in flight (queued/waiting/in_progress). A release waiting on the
       # npm-release environment approval must not red every subsequent main push.
       - name: Require version bump for existing release tag
-        if: ${{ github.repository == 'evalops/maestro' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }}
+        if: ${{ github.repository == 'dx-corp/code' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }}
         env:
           RELEASE_TAG: ${{ steps.release.outputs.release_tag }}
           RELEASE_VERSION: ${{ steps.release.outputs.release_version }}
@@ -176,7 +176,7 @@ jobs:
 
   verify-published-registry-package:
     needs: tag-current-version
-    if: ${{ github.repository == 'evalops/maestro' && needs.tag-current-version.outputs.registry_published == 'true' }}
+    if: ${{ github.repository == 'dx-corp/code' && needs.tag-current-version.outputs.registry_published == 'true' }}
     runs-on: ${{ vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest' }}
     timeout-minutes: 30
     permissions:
@@ -222,7 +222,7 @@ jobs:
     needs:
       - tag-current-version
       - verify-published-registry-package
-    if: ${{ always() && github.repository == 'evalops/maestro' && needs.tag-current-version.result == 'success' && needs.tag-current-version.outputs.staged_ready == 'true' && (needs.tag-current-version.outputs.registry_published != 'true' || needs.verify-published-registry-package.result == 'success') && (needs.tag-current-version.outputs.tag_exists != 'true' || needs.tag-current-version.outputs.registry_published != 'true') && (needs.tag-current-version.outputs.active_release_count == '0' || needs.tag-current-version.outputs.active_release_count == '') }}
+    if: ${{ always() && github.repository == 'dx-corp/code' && needs.tag-current-version.result == 'success' && needs.tag-current-version.outputs.staged_ready == 'true' && (needs.tag-current-version.outputs.registry_published != 'true' || needs.verify-published-registry-package.result == 'success') && (needs.tag-current-version.outputs.tag_exists != 'true' || needs.tag-current-version.outputs.registry_published != 'true') && (needs.tag-current-version.outputs.active_release_count == '0' || needs.tag-current-version.outputs.active_release_count == '') }}
     runs-on: ${{ vars.PUBLIC_PR_VALIDATION_RUNNER || 'ubuntu-latest' }}
     timeout-minutes: 10
     permissions:

scripts/tag-release-contract.test.mjs

@@ -13,6 +13,8 @@ test("tag-release does not cancel in-progress runs", () => {
 
 test("tag-release dispatches a public release after tagging", () => {
 	assert.match(workflow, /dispatch-public-release:/);
+	assert.match(workflow, /github\.repository == 'dx-corp\/code'/);
+	assert.doesNotMatch(workflow, /github\.repository == 'evalops\/maestro'/);
 });
 
 test("internal tag-release dispatches public-release-mirror after creating a tag", () => {