Repository navigation
feat!: single entry point workflows, setup CLI and verification layers - #6
Open
ricardogobbosouza wants to merge 31 commits into
Open
ricardogobbosouza wants to merge 31 commits into
ricardogobbosouza wants to merge 31 commits into
Conversation
Replace the per-workflow example files with two entry points: project.yml for apps (Claude, tests, reviews, risk gate, CI fix, deploy, release PR, incidents) and package.yml for packages, both selected by a stack input. Add composite actions with tested shell scripts, the setup/check/protect CLI, the monitoring relay worker and the laravel Claude plugin. BREAKING CHANGE: laravel-tests.yml and the per-workflow examples are removed; projects call project.yml or package.yml @v2 from a single .github/workflows/datalogix.yml, written by `npx github:datalogix/workflows#v2 setup`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
askSteps evaluates every step's condition to number the questions before the repository step reads the state, and the Claude token step read ctx.state.claudeToken, missing from the generic empty state main sets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
npm 12 refuses git packages by default (EALLOWGIT); --allow-git=root allows only the package being run, not git dependencies below it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When the production HEALTH_URL gives no domain, setup suggests the repository's name with .com.br for an app whose .env has APP_LOCALE pt_BR, and .com otherwise. The staging domain now defaults to the dev subdomain of the production domain instead of staging. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The site may not exist yet when a project is set up: an empty deploy hook creates the environment without DEPLOY_HOOK, and setup lists running it again among the steps left by hand, as deploys fail until it is set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… the relay org checks the Claude GitHub App, writes the issue forms to the organization's public .github repository and deploys the monitoring relay of its version, storing its settings in workflows/relay.json there. setup and check now read the relay settings from that file instead of cli/config.json and relay/wrangler.toml at the released tag. The docs describe org as optional: only the issue forms and Nightwatch problems as issues need it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Setup reads composer.json and asks which lint checks run (Laravel Pint, PHPStan and another command, the installed tools checked) and which test command (the suggested one, another or none). It suggests php artisan test when composer test also runs Pint or PHPStan, so lint does not run twice, and the composer scripts that only check as the lint command. project.yml and package.yml take pint, phpstan and lint-command, and test-command none skips the test suite. Packages get a lint job, run once outside the matrix, that adds PHPStan when composer.json requires it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app tests audit the Node lockfile (npm, pnpm or Yarn) on the same events as composer audit: scheduled and manual runs, and pull requests that change it. Only high and critical advisories fail, as npm publishes many low ones, and dev dependencies are included, since Vite and the frontend libraries end up in the bundle. The plugin runs the same audit when Claude changes the lockfile, and fix-ci may fix its failures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Write(path) permission rules never match: Claude Code checks file writes against Edit(path) rules only, so the findings file was always denied. Allow it with an Edit rule and drop Edit and MultiEdit from the denied list, which would deny it too; edits no rule allows are already denied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Standard sites (without zero-downtime) only got a pointer to the docs; print their checkout too, since setup cannot tell which kind a site is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With an optional API token (used during setup only, never stored), setup finds the sites or environments of the repository and, for each one chosen: on Forge it reads the deploy hook, makes the deploy script check out FORGE_VAR_COMMIT and turns off Push to deploy; on Laravel Cloud it turns off Push to deploy and sets the branch. What it could not do stays in the list of what is left by hand, with the reason. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… in setup and check Setup now tells what is left by hand for settings it did not mention: the Claude GitHub App not reaching the repository, laravel/nightwatch missing from composer.json, NIGHTWATCH_TOKEN missing from a Forge site (which it sets through the API when it knows the token), a HEALTH_URL that does not answer 200, and merge commits turned off with a production branch (which it allows when it can). check reports the Claude App, Nightwatch's agent and merge commits too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every job that uses an environment makes GitHub record a deployment. With github-deployments: false, project passes deployment: false to the deploy jobs (deploys and rollbacks), which still read the environment's secrets and variables and wait for its required reviewers. Setup asks for it when the app deploys and writes the input only when it is off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ls and package.json scripts Setup now asks for inputs that ran with their defaults unasked: which of the code review, security review, risk gate and fix CI run on pull requests, whether production deploys automatically or only from Run workflow, the approvals of medium and high risk pull requests in team projects, and whether the tests run the package.json scripts. Each input is written only when it leaves its default. When the answers change the checks the ruleset should require, setup says to run protect again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The questions that turn something on (staging, the production branch and its deploys, GitHub deployments, Nightwatch markers and issues, the database check, the package.json scripts, the Claude workflows and the risk gate, working alone) now say below them, dimmed, what they do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… file claude-code-action only runs when the calling workflow file matches the default branch's copy, so on such pull requests the security review failed with "did not finish", which running it again never fixed. A new workflow-file action tells, from the file's blobs; both reviews then skip Claude, and the security review comments why and keeps failing, so a workflow change cannot skip the review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A project's own sensitive paths (e.g. app/Services/Payment/*) add to the default high-risk paths instead of replacing them, so none of the defaults is dropped by accident. project passes it to risk-gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… review When setup suggests a pull request that changes the workflow file and the security review is on, it now says that Claude does not review it and the check fails: a person reviews it, and an admin merges it past the check when the branch is protected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…aves Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ation-only pull requests and add staging-watch-minutes - laravel-app-tests and the lint job of laravel-package-tests keep running their checks after one fails, so a run reports every failure; none runs when the dependencies could not be installed - claude-security-review skips pull requests whose whole diff is Markdown, except Markdown read as instructions or rendered by the app (.github/, .claude/, resources/, CLAUDE.md, AGENTS.md); a deleted or renamed file counts as code - project.yml takes staging-watch-minutes (0 uses watch-minutes) to shorten the staging watch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A Nuxt or Next app or a JavaScript library got a Laravel workflow file. Setup now stops unless --stack or --kind says what the folder is (e.g. a Laravel repository not scaffolded yet); check and protect keep reading it as a Laravel app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 of 4 tasks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s and key the Node cache by lockfile Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…anges as they were Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rker and check the gh login on github.com only Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ry secrets once Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s in project Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
project.yml(apps) andpackage.yml(packages) become the single entry points, selected by astackinput; projects keep one.github/workflows/datalogix.yml.setup/check/protect/orgCLI, run withnpx --allow-git=root github:datalogix/workflows#v2 <command>(npm 12+ refuses git packages by default;--allow-git=rootallows only this one).setupsuggests the production and staging domains and can leave the deploy hooks for later.org(optional, once per organization) writes the shared issue forms andworkflows/relay.jsonto the organization's public.githubrepository and deploys the monitoring relay to Cloudflare;setupandcheckread the relay settings from there.laravelClaude plugin.Breaking changes
laravel-tests.ymland the per-workflow examples are removed. Projects callproject.ymlorpackage.yml@v2, so this ships asv2.0.0.Before merging
npx --allow-git=root github:datalogix/workflows#v2 orgin the organization (optional) andsetupin a real project and package, and open a test pull request there (cidoes not exerciselaravel-app-tests,laravel-package-tests,deployorrelease-pr).v2branch before publishing thev2.0.0release, so the branch and the newv2tag never coexist.🤖 Generated with Claude Code