feat: componentize GStack 2 runtime and release integrity

2026-09-21 04:10:47 +02:00 · 2026-07-20 14:16:23 -07:00
parent b0ea2296d1
commit f14445bb00
270 changed files with 9681 additions and 51572 deletions
@@ -0,0 +1,75 @@
+name: Release quality gate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.23.1
+
+      - name: Install frozen dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Release and package contract tests
+        run: bun run check:release
+
+      - name: Scan changed production text for credentials
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
+            BASE_SHA=$(git rev-parse HEAD^)
+          fi
+          git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
+            . \
+            ':(exclude)test/**' \
+            ':(exclude)evals/**' \
+            ':(exclude)outputs/**' \
+            ':(exclude)lib/diagram-render/dist/**' \
+            ':(exclude)skills/*/references/support/**' \
+            ':(exclude)docs/gstack-2/BACKLOG-MAP.json' \
+            | node .github/scripts/gate-secret-scan.mjs
+
+      - name: Pack, install, and invoke the npm runtime-control package
+        run: node .github/scripts/smoke-packed-package.mjs "$GITHUB_WORKSPACE"
+
+      - name: Gate critical dependency advisories
+        run: bun audit --audit-level=critical
+
+      - name: Syntax-check runtime JavaScript
+        run: find runtime -type f \( -name '*.js' -o -name '*.mjs' \) -print0 | xargs -0 -n1 node --check
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck=0.9.0-1
+          shellcheck --version
+
+      - name: ShellCheck release and setup boundaries
+        run: >-
+          shellcheck --severity=error
+          setup
+          scripts/build.sh
+          scripts/write-version-files.sh
+          scripts/gstack2/runtime-install-smoke.sh
+          browse/scripts/build-node-server.sh