diff --git a/README.md b/README.md index 4344657..7b5c9ee 100644 --- a/README.md +++ b/README.md @@ -6,20 +6,17 @@ Arc-specific static CI quality gate and integration-pattern validator for wallet [![Release](https://img.shields.io/github/v/release/tanka420/arcready?include_prereleases&label=release)](https://github.com/tanka420/arcready/releases) ![TypeScript](https://img.shields.io/badge/TypeScript-5.x-blue) ![Node.js](https://img.shields.io/badge/Node.js-22%2B-green) -![npm](https://img.shields.io/badge/npm-arcready%400.3.0-blue) +![npm](https://img.shields.io/badge/npm-arcready%400.4.0-blue) ![Backend](https://img.shields.io/badge/backend-not_required-lightgrey) ArcReady helps developers catch common Arc integration mistakes before release. It is a developer-side early warning layer for static checks in local workflows and CI. > ArcReady is an independent open-source project. It is not an official Circle or Arc product. -> Release boundary: the install and Action examples below deliberately run the -> published `arcready@0.3.0` release. The main branch contains later, unreleased -> rule and runtime changes. In particular, v0.3.0 still runs -> `wallet/NO_ETH_GAS_LABEL` as a default critical rule, while current main -> exposes it only as default-excluded, deprecated `info` advice. Use the -> versioned release notes for v0.3.0 behavior and the current rule catalog for -> main-branch behavior. +> Release boundary: npm `latest` is the reviewed `arcready@0.4.0` package. The +> current stable Action tag remains `tanka420/arcready@v0.3.0` until the staged +> v0.4.0 Action proof and immutable tag checkpoints complete. The v0.3 Action +> wrapper can run the new package by setting `arcready-version: "0.4.0"`. ## What It Is @@ -34,20 +31,20 @@ It reports findings in terminal, JSON, Markdown, or HTML formats and can fail CI ## Quick Demo ```powershell -npx --yes arcready@0.3.0 init -npx --yes arcready@0.3.0 scan +npx --yes arcready@0.4.0 init +npx --yes arcready@0.4.0 scan ``` CI-oriented Markdown report: ```powershell -npx --yes arcready@0.3.0 scan --format markdown --out arcready-report.md +npx --yes arcready@0.4.0 scan --format markdown --out arcready-report.md ``` Shortened example output: ```text -ArcReady v0.3.0 +ArcReady v0.4.0 Project: my-arc-app Score: 75 Status: fail @@ -78,13 +75,13 @@ patterns, not universal Arc compatibility or runtime verification. Run without installing: ```powershell -npx --yes arcready@0.3.0 scan +npx --yes arcready@0.4.0 scan ``` Create a config file: ```powershell -npx --yes arcready@0.3.0 init +npx --yes arcready@0.4.0 init ``` Install locally: @@ -117,17 +114,18 @@ jobs: - uses: tanka420/arcready@v0.3.0 with: + arcready-version: "0.4.0" fail-on: critical ``` -The action runs the published npm CLI and defaults to `arcready@0.3.0`. You can pin or override the CLI package version: - -The `v0.3.0` Action tag therefore runs v0.3.0 package behavior, not unreleased -main-branch behavior. +The stable `v0.3.0` Action wrapper defaults to npm package v0.3.0, so the example +pins its package input to the published v0.4.0 release. The repository Action +candidate defaults to v0.4.0, but no `v0.4.0` Action tag is claimed until the +separate exact-SHA proof and tag checkpoints complete. ```yaml with: - arcready-version: "0.3.0" + arcready-version: "0.4.0" ``` See [docs/github-action.md](docs/github-action.md) for inputs, artifact behavior, and external usage notes. @@ -184,10 +182,10 @@ Supported formats: - HTML ```powershell -npx --yes arcready@0.3.0 scan --format terminal -npx --yes arcready@0.3.0 scan --format json --out arcready-report.json -npx --yes arcready@0.3.0 scan --format markdown --out arcready-report.md -npx --yes arcready@0.3.0 scan --format html --out arcready-report.html +npx --yes arcready@0.4.0 scan --format terminal +npx --yes arcready@0.4.0 scan --format json --out arcready-report.json +npx --yes arcready@0.4.0 scan --format markdown --out arcready-report.md +npx --yes arcready@0.4.0 scan --format html --out arcready-report.html ``` Generated report folders such as `.arcready/` and `reports/` are ignored by git. diff --git a/action.yml b/action.yml index 64961c2..5926691 100644 --- a/action.yml +++ b/action.yml @@ -5,7 +5,7 @@ inputs: arcready-version: description: "ArcReady npm package version to run" required: false - default: "0.3.0" + default: "0.4.0" working-directory: description: "Directory to scan" required: false diff --git a/docs/exec-plans/active/R01.md b/docs/exec-plans/active/R01.md index d3b8724..4807e04 100644 --- a/docs/exec-plans/active/R01.md +++ b/docs/exec-plans/active/R01.md @@ -1,6 +1,6 @@ # R01 — Coordinated ArcReady v0.4.0 Release -Status: Validated — E1 candidate pending commit and PR approval +Status: Validated — E2A candidate pending commit and PR approval Risk class: R3 distribution and external contract @@ -16,24 +16,21 @@ Last reviewed: 2026-08-20 ### Problem -The public npm package and exact GitHub Action release remain on v0.3.0, while -main contains the merged C04–C12 rule hardening, bounded analyzers, experimental -canonical JSON output, dependency, default-selection, and remediation changes. -The current repository README must distinguish those surfaces because a user -following its pinned v0.3.0 commands does not receive current main behavior. +The reviewed npm package is now published as `arcready@0.4.0`, but the stable +GitHub Action tag remains `v0.3.0` and defaults to the old npm package. E2 must +move the Action default to 0.4.0 without claiming a tag before its exact-SHA +external proof completes. -The mismatch is directly harmful for C12: npm v0.3.0 runs -`wallet/NO_ETH_GAS_LABEL` as a default critical rule, while merged main -default-excludes it as deprecated `info` advice after measured real-repository -false positives. +The boundary matters for C12: the stable v0.3 Action still selects the old +default-critical gas-label rule unless the caller explicitly overrides +`arcready-version` to 0.4.0. ### Why now The [A02 adoption audit](../../research/A02.md) found zero default findings in -eight pinned repositories with the merged post-C12 package. The -[A03 distribution audit](../../research/A03.md) proved that npm `latest` and the -`v0.3.0` Action cannot reproduce that result because they still deliver the -older release. +eight pinned repositories with the merged post-C12 package. E1 then published +and independently verified that package as npm 0.4.0. The remaining distribution +gap is the stable v0.3 Action wrapper's default package selection. ### Product value @@ -71,14 +68,14 @@ Verified on 2026-08-20: | Boundary | Evidence | | --------------------- | ------------------------------------------------------------------- | -| npm latest | `arcready@0.3.0`, published 2026-06-13T17:07:22.227Z | -| npm package source | `gitHead` `108759757d047236cab19272c3246bacc3261f1a` | +| npm latest | `arcready@0.4.0`, published 2026-08-20T09:31:45.690Z | +| npm package source | `gitHead` `be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af` | | Git release tag | `v0.3.0` resolves to `e4a1244e5363bafee2dcf7446467e7f6fabe921e` | | Frozen E1 base | `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` | | Change size | 184 files, 61,169 insertions, 1,162 deletions from tag to base | | File deletion | no deleted path in the tag-to-main diff | -| Published package | 7 entries, 18,109-byte tarball, 79,982 bytes unpacked | -| E1 candidate package | 10 entries, 92,141-byte tarball, 436,925 bytes unpacked | +| Published package | 10 entries, 92,141-byte tarball, 436,925 bytes unpacked | +| Published integrity | Exact SHA-1 and SHA-512 recorded in the npm checklist | | Runtime dependencies | `@solidity-parser/parser@0.20.2`, `typescript@5.9.3` | | Dependency licenses | parser MIT with no declared dependency; TypeScript Apache-2.0 | | Dependency Node floor | TypeScript >=14.17; ArcReady >=22 | @@ -95,11 +92,12 @@ Resolved before E1 implementation: - the E1 base is frozen at that exact merge SHA, and later runtime changes are excluded unless the cumulative release inventory is reset. -Remaining before E1 publication: +E1 publication is complete. Remaining for E2: -- npm authentication and package-owner authorization; -- exact GitHub release permissions and tag protection state; -- exact candidate review, full gate, merge, and registry dry-run evidence. +- E2A exact-head CI and merge; +- E2B exact-E2A-SHA external proof before tag approval; +- exact GitHub release permissions and tag protection state before later tag + and GitHub Release checkpoints. Any new runtime-affecting main change resets the release base and requires a new cumulative inventory. @@ -374,7 +372,10 @@ analyzer semantics. ### Final independent review -Pending for the exact E1 package candidate and exact E2A Action/tag candidate. +E1 passed with `APPROVE — 0 blocker / 0 major / 0 minor` on its exact reviewed +candidate. E2A passed with `APPROVE — 0 blocker / 0 major / 0 minor` on the +exact 10-file staged bundle whose SHA-256 is +`fd4797234d5114996bbf745b2f70cbd5764ff1c44c51181d53d951c4e9a8dafa`. Corrections that change only E3 closeout prose do not require a new full analyzer review; any package or Action execution change does. @@ -390,6 +391,10 @@ rerun the full gate if it changes anything beyond the external reference, structural assertion, and release evidence. Do not substitute historical per-milestone gates for the cumulative release gate. +E2A passed this gate on 2026-08-20: fixture validation, all 42 package test files +and 2,704 tests, six workflow tests, lint, build, and installed-package smoke +completed successfully. + ### Additional release-candidate checks - `npm whoami` and package-owner verification immediately before publish; @@ -430,11 +435,13 @@ Progress: - [x] targeted validation passed - [x] E1 final independent review passed - [x] E1 full validation passed -- [ ] E1 exact-head CI passed and merged -- [ ] npm 0.4.0 explicitly approved, published, and verified -- [ ] E2A Action candidate reviewed, validated, and merged -- [ ] E2A transitive build-input equality with E1 passed -- [ ] E2A rebuilt package entry hashes equal E1 registry artifact +- [x] E1 exact-head CI passed and merged +- [x] npm 0.4.0 explicitly approved, published, and verified +- [x] E2A local Action vertical slice and registry consumer probe passed +- [x] E2A Action candidate reviewed and full validation passed +- [ ] E2A exact-head CI passed and merged +- [x] E2A transitive build-input equality with E1 passed +- [x] E2A rebuilt package entry hashes equal E1 registry artifact - [ ] E2B exact-SHA external smoke passed - [ ] v0.4.0 tag explicitly approved and created at E2A SHA - [ ] E3A tagged external Action smoke passed on its exact merge SHA @@ -516,3 +523,24 @@ Pending. package tests, six workflow tests, lint, build, and installed-package smoke. Ignored local adoption artifacts were quarantined outside the repository for lint and restored afterward; they are not candidate inputs. +- 2026-08-20: PR #75 merged E1 as + `be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af`; four exact-head checks and five + post-merge workflows passed on the expected SHAs. +- 2026-08-20: Published npm `arcready@0.4.0` with registry `gitHead` + `be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af`, SHA-1 + `936ed9a88a47273690782072488ee52e761c37c1`, and the reviewed SHA-512. The + registry tarball's ten entry hashes matched E1, and clean-install terminal, + default C12, legacy JSON, and JSON v2 probes passed. +- 2026-08-20: Began E2A from E1 merge `be945efd`; changed only the Action + default, structural assertions, current public distribution docs/examples, + and E1 evidence. All declared transitive package inputs remained + byte-identical to E1. The E2A rebuild reproduced all ten registry entry hashes + and the exact tarball SHA-1; local good/bad Action command probes returned + pass/zero and expected fail/three-critical behavior with all reports created. +- 2026-08-20: Final independent E2A review approved the exact 27,766-byte, + 10-file staged bundle with SHA-256 + `fd4797234d5114996bbf745b2f70cbd5764ff1c44c51181d53d951c4e9a8dafa` at + `0 blocker / 0 major / 0 minor`. `corepack pnpm verify:full` then passed fixture + validation, 42 package test files with 2,704 tests, six workflow tests, lint, + build, and installed-package smoke. Ignored audit artifacts were quarantined + for lint and restored afterward; they are not candidate inputs. diff --git a/docs/github-action.md b/docs/github-action.md index 6d00e7a..ff98f3f 100644 --- a/docs/github-action.md +++ b/docs/github-action.md @@ -27,21 +27,26 @@ jobs: - uses: tanka420/arcready@v0.3.0 with: + arcready-version: "0.4.0" fail-on: critical ``` -`v0.3.0` is the current GitHub Action-ready release and includes rule quality hardening. The action runs the published npm CLI package, and the default CLI version is `0.3.0`. You can override the CLI package version with `arcready-version`. +`v0.3.0` remains the current stable GitHub Action tag until the v0.4.0 exact-SHA +proof and immutable tag checkpoints complete. That wrapper defaults to npm +package v0.3.0, so current examples set `arcready-version: "0.4.0"`. The +repository Action candidate defaults to the published npm v0.4.0 package; it is +not a claim that the `v0.4.0` Action tag already exists. ## Inputs -| Input | Default | Description | -| ------------------- | ------------------- | ----------------------------------------------------------------- | -| `arcready-version` | `0.3.0` | ArcReady npm package version to run | -| `working-directory` | `.` | Directory to scan | -| `fail-on` | `critical` | Fail when findings reach `critical`, `warning`, `info`, or `none` | -| `output-dir` | `.arcready/reports` | Directory for ArcReady report files | -| `upload-artifact` | `true` | Upload ArcReady reports as a workflow artifact | -| `artifact-name` | `arcready-report` | Artifact name for uploaded ArcReady reports | +| Input | Main default | Stable v0.3 tag | Description | +| ------------------- | ------------------- | --------------- | ----------------------------------------------------------------- | +| `arcready-version` | `0.4.0` | `0.3.0` | ArcReady npm package version to run | +| `working-directory` | `.` | `.` | Directory to scan | +| `fail-on` | `critical` | `critical` | Fail when findings reach `critical`, `warning`, `info`, or `none` | +| `output-dir` | `.arcready/reports` | same | Directory for ArcReady report files | +| `upload-artifact` | `true` | `true` | Upload ArcReady reports as a workflow artifact | +| `artifact-name` | `arcready-report` | same | Artifact name for uploaded ArcReady reports | ## Working Directory @@ -50,6 +55,7 @@ Scan a subdirectory: ```yaml - uses: tanka420/arcready@v0.3.0 with: + arcready-version: "0.4.0" working-directory: apps/wallet fail-on: critical ``` @@ -69,6 +75,7 @@ Upload artifacts with the default settings: ```yaml - uses: tanka420/arcready@v0.3.0 with: + arcready-version: "0.4.0" upload-artifact: true ``` @@ -77,6 +84,7 @@ Customize the report directory and artifact name: ```yaml - uses: tanka420/arcready@v0.3.0 with: + arcready-version: "0.4.0" output-dir: reports/arcready artifact-name: arc-static-validation ``` @@ -114,4 +122,6 @@ uses: tanka420/arcready@v0.3.0 It checks a known-good fixture that should pass and a known-bad fixture that should fail as expected. -External action smoke validation is configured to use `uses: tanka420/arcready@v0.3.0` after the `v0.3.0` tag is created and pushed. +External action smoke validation currently remains pinned to +`uses: tanka420/arcready@v0.3.0`; R01 changes that reference only in the later, +separately reviewed exact-SHA and tagged-proof checkpoints. diff --git a/docs/npm-publishing.md b/docs/npm-publishing.md index 72600b4..a630a83 100644 --- a/docs/npm-publishing.md +++ b/docs/npm-publishing.md @@ -1,21 +1,19 @@ # npm Publishing ArcReady is published on npm as an installable CLI package. The current public -version is `arcready@0.3.0`. The architecture-approved R01 E1 candidate selects -`0.4.0` from frozen base `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620`. -The candidate is not published, and its exact operational commit remains -pending final validation and review. +version is the registry-verified `arcready@0.4.0`, published from merged E1 +commit `be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af`. ## Current Package -| Field | Value | -| --------------------- | -------------------------- | -| Package name | `arcready` | -| Published version | `0.3.0` | -| Selected next version | `0.4.0` (R01 E1 candidate) | -| License | MIT | -| Node.js | `>=22` | -| CLI bin | `arcready` | +| Field | Value | +| --------------------- | --------------------------- | +| Package name | `arcready` | +| Published version | `0.4.0` | +| Selected next version | none; R01 E2 changes Action | +| License | MIT | +| Node.js | `>=22` | +| CLI bin | `arcready` | The npm package should include only: @@ -50,9 +48,9 @@ cd packages/arcready npm publish --dry-run ``` -Inspect the output before release. The dry run must show the separately approved, -unpublished candidate version and only the expected package files. Do not try to -publish `arcready@0.3.0` again. +Inspect the output before any future release. It must show a separately approved, +unpublished version and only the expected package files. Do not try to republish +the immutable `arcready@0.4.0` version. Use the versioned [v0.4.0 npm checklist](releases/v0.4.0-npm-checklist.md) for E1 evidence. Record @@ -72,9 +70,9 @@ Confirm the package name is still available or owned by the project: npm view arcready ``` -## Do Not Run This Until Release Approval +## Do Not Run This Without Release Approval -The real publish command is not part of this task: +The real publish command is never implied by Action or documentation work: ```bash npm publish diff --git a/docs/releases/v0.4.0-npm-checklist.md b/docs/releases/v0.4.0-npm-checklist.md index a03daaa..23c7bc2 100644 --- a/docs/releases/v0.4.0-npm-checklist.md +++ b/docs/releases/v0.4.0-npm-checklist.md @@ -1,6 +1,6 @@ # ArcReady v0.4.0 npm checklist -Status: E1 candidate — not published +Status: E1 published and registry-verified This checklist owns the package-publication evidence for R01 E1. The GitHub Action, Git tag, tagged smoke, and GitHub Release are later checkpoints and must @@ -10,12 +10,13 @@ not be created from this checklist. - Version: `0.4.0` - E1 base: `4b7ee02901f5313b8bd33e1e22de69b1b4e2d620` -- Exact reviewed candidate commit: pending -- Exact merged package commit: pending +- Exact reviewed candidate commit: `7a9a8be16a5d64fa2adb9ba675973435b3ba3398` +- Exact merged package commit: `be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af` - Reviewed staged bundle SHA-256: `1a2e3633f8f1c258f9fc606f2afb5e7c826e6015327e5ed8dba14b875eab5434` -- npm registry `gitHead`: pending publication -- Working tree at selected candidate: pending clean-tree verification +- npm registry `gitHead`: `be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af` +- Published at: `2026-08-20T09:31:45.690Z` +- Working tree at selected candidate: clean and equal to `origin/main` Any runtime-affecting change after the frozen base requires a new cumulative inventory and review decision. Release-only metadata and documentation must be @@ -77,16 +78,16 @@ exports: no removal and only `arcUsdcAmountConversionRule` added. The existing tests, lint, build, and installed-package smoke passed - [x] final independent adversarial review: APPROVE with zero blocker, major, or minor findings -- [ ] exact-head required CI: pending +- [x] exact-head required CI: four PR checks and five post-merge workflows passed ## Pre-publish authorization -- [ ] E1 candidate merged with explicit approval. -- [ ] `npm view arcready@0.4.0` confirms the version is absent. -- [ ] `npm whoami` and package-owner permission are confirmed immediately before +- [x] E1 candidate merged with explicit approval. +- [x] `npm view arcready@0.4.0` confirmed the version was absent before publish. +- [x] `npm whoami` and package-owner permission were confirmed immediately before publication. -- [ ] Dry-run contents and integrity match the reviewed candidate. -- [ ] Maintainer gives a separate explicit approval for `npm publish`. +- [x] Dry-run contents and integrity matched the reviewed candidate. +- [x] Maintainer gave a separate explicit approval for `npm publish`. Do not run `npm publish` merely because the candidate passes validation. If the version appears in the registry unexpectedly, integrity differs, or any package @@ -95,8 +96,13 @@ or unpublishing an immutable release. ## Post-publish evidence -- [ ] Registry version, integrity, tarball contents, and `gitHead` recorded. -- [ ] Clean install from the registry passes version, default C12 behavior, +- [x] Registry version, integrity, tarball contents, and `gitHead` recorded. +- [x] Clean install from the registry passes version, default C12 behavior, legacy output, and canonical opt-in probes. -- [ ] Exact E1 package SHA and registry evidence copied to the R01 completion +- [x] Exact E1 package SHA and registry evidence copied to the R01 completion record for E2 input-equality and package-entry hash comparison. + +Registry verification matched the reviewed dry-run exactly: npm `latest` is +`0.4.0`, SHA-1 is `936ed9a88a47273690782072488ee52e761c37c1`, SHA-512 is +`sha512-X8FumZlkylSwXYHNOQhGtXj1o9Ljbh4XFJD7i/JsN5fm45amIokidantNPL7wtDGG/NyVt8gLK8zSTRdDhMLfw==`, +and all ten extracted entry SHA-256 values match the table above. diff --git a/docs/releases/v0.4.0.md b/docs/releases/v0.4.0.md index 99ce5c7..2ab8f0b 100644 --- a/docs/releases/v0.4.0.md +++ b/docs/releases/v0.4.0.md @@ -43,13 +43,15 @@ otherwise. ## Coordinated Action release -This E1 release publishes only `arcready@0.4.0` on npm. The repository Action -default and external tagged smoke remain on v0.3.0 until the separately reviewed -R01 E2 checkpoints complete. Do not use these notes to create a `v0.4.0` Git tag -or GitHub Release during E1. +E1 published `arcready@0.4.0` on npm from merge +`be945efd2fb6d6ec625d9aa28ebdfc3cae7e91af`. The stable repository Action tag +and external tagged smoke remain on v0.3.0 until the separately reviewed R01 E2 +checkpoints complete. Do not use these notes alone to create a `v0.4.0` Git tag +or GitHub Release. ## Publication status -Release candidate only. npm publication requires final independent review, the -full repository gate, exact-head CI, merge approval, package-owner verification, -and a separate explicit publish approval. +The npm package is published and registry-verified. Its integrity, `gitHead`, +ten packed entries, clean installation, legacy output, default C12 behavior, and +canonical JSON opt-in match the reviewed E1 candidate. The coordinated Action +tag and GitHub Release remain pending their later R01 checkpoints. diff --git a/docs/roadmap.md b/docs/roadmap.md index 3fe3683..edda6c6 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -56,7 +56,7 @@ ArcReady currently includes: - TypeScript and Node.js CLI scanning; - wallet, bridge, and App Kit rule packs; - terminal, JSON, Markdown, and HTML legacy reports; -- installable npm package `arcready@0.3.0`; +- installable npm package `arcready@0.4.0`; - external composite GitHub Action `tanka420/arcready@v0.3.0`; - validation fixtures and package smoke tests; - automated CI and repository verification; @@ -310,24 +310,22 @@ analysis infrastructure without users. ## Distribution and release track -The v0.3 package and GitHub Action are already released. Distribution work may +The npm v0.4 package and GitHub Action v0.3 are released. Distribution work may proceed independently of engineering milestones after verifying package contents, CLI installation, Action references, release notes, and CI on the selected release commit. -The [A03 distribution audit](research/A03.md) confirms that npm `latest` and the -`v0.3.0` Action still run v0.3.0 while main documents later behavior, including -the C12 default exclusion. Current documentation must disclose that boundary. -A separately authorized R3 release milestone must select and verify the next -version before changing the package manifest, Action default, tag, or release; -A03 performs none of those distribution mutations. +The [A03 distribution audit](research/A03.md) established the earlier v0.3 +mismatch. R01 E1 closed the npm side by publishing and registry-verifying +`arcready@0.4.0` from merge `be945efd`; the stable `v0.3.0` Action tag still +defaults to npm v0.3 unless callers explicitly override its package input. The [R01 release plan](exec-plans/active/R01.md) selects a staged v0.4.0 candidate: npm package first, then the Action default, exact-SHA external proof, immutable tag, tagged external smoke, and finally the GitHub Release. Its -architecture review passed with `0 blocker / 0 major / 0 minor`. E1 package -candidate implementation is in progress from frozen base `4b7ee02`; explicit -approval remains required at every merge, publish, tag, and GitHub Release +architecture review passed with `0 blocker / 0 major / 0 minor`. E1 is complete; +E2A Action candidate implementation is in progress from the verified E1 merge. +Explicit approval remains required at every merge, tag, and GitHub Release checkpoint. Core milestones must not silently change an already selected release commit. diff --git a/examples/github-action.yml b/examples/github-action.yml index e84fede..804d74a 100644 --- a/examples/github-action.yml +++ b/examples/github-action.yml @@ -16,5 +16,6 @@ jobs: - uses: tanka420/arcready@v0.3.0 with: + arcready-version: "0.4.0" fail-on: critical upload-artifact: true diff --git a/packages/arcready/test/github-action.test.ts b/packages/arcready/test/github-action.test.ts index f700990..23901d6 100644 --- a/packages/arcready/test/github-action.test.ts +++ b/packages/arcready/test/github-action.test.ts @@ -12,7 +12,7 @@ describe("GitHub Action wrapper", () => { expect(existsSync(actionPath)).toBe(true); expect(action).toContain("using: composite"); expect(action).toContain("arcready-version:"); - expect(action).toContain('default: "0.3.0"'); + expect(action).toContain('default: "0.4.0"'); expect(action).toContain("working-directory:"); expect(action).toContain("fail-on:"); expect(action).toContain("output-dir:"); @@ -87,6 +87,15 @@ describe("GitHub Action wrapper", () => { expect(workflow).toContain("upload-artifact: true"); }); + it("pins the current public external example to the published package", () => { + const workflowPath = join(repoRoot, "examples", "github-action.yml"); + const workflow = readFileSync(workflowPath, "utf8"); + + expect(existsSync(workflowPath)).toBe(true); + expect(workflow).toContain("uses: tanka420/arcready@v0.3.0"); + expect(workflow).toContain('arcready-version: "0.4.0"'); + }); + it("defines the external action smoke workflow", () => { const workflowPath = join( repoRoot,