Repository navigation
feat: js stack for Next and Nuxt apps and JavaScript libraries, with the core plugin - #8
Open
ricardogobbosouza wants to merge 14 commits into
Open
ricardogobbosouza wants to merge 14 commits into
ricardogobbosouza wants to merge 14 commits into
Conversation
- package.yml takes stack: js and calls node-package-tests from a job named tests, so the required check stays pipeline / tests / all-checks: the test script of package.json on each Node version of the matrix (22, 24 and 26 by default), and the typecheck, lint and build scripts, the lint command and the audit once. The setup-js action installs the dependencies with pnpm, yarn or npm according to the lockfile. - Setup detects a library (package.json, no composer.json, neither Next nor Nuxt), writes stack: js and asks for no Codecov token; Next and Nuxt apps stop setup, check and protect as not supported yet. The kind question only offers the kinds of the detected stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…y stack plugins/core holds the language, scope, validation limits, review rounds and pull request rules; plugins/laravel keeps feature flags, migrations, tests and the tools of the pre-PR verification, word for word. Every Claude workflow installs core@datalogix with laravel@datalogix and loads both conventions skills; CI validates the new plugin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude, claude-fix-ci, claude-review, claude-security-review and incident take a stack input (laravel by default): setup-laravel or setup-js prepares the project, and the prompts call the commands and conventions skill of that stack's plugin. project.yml passes the stack, normalized to its marketplace spelling, and installs its plugin with core. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d Nuxt Conventions on top of core (feature flags only with the project's flag library, additive migrations, tests only when the project has them, the package.json scripts and the build in the pre-PR verification) and the plan, fix-ci, incident and security-review commands with the same outputs as the Laravel ones; the security checklist covers server routes, API handlers and server actions, secrets exposed to the browser, the page payload and SSRF. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- node-app-tests runs the typecheck, lint, test and build scripts of package.json, then test:e2e against that build (with Playwright's browsers when the project uses it; e2e: false turns it off) and the audit, in a single job so the required check stays pipeline / tests / tests. project.yml calls it from js-tests, named tests. - project.yml runs claude, review, security, gate, fix-ci and incident for stack js too; deploys stay Laravel only. - risk-gate takes the stack: its default high-risk paths are Laravel's or JavaScript's (middleware, server and API routes, auth files, database migrations, the Next and Nuxt configuration, package.json and .github). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Setup detects a Next or Nuxt app as a JavaScript app (asking app or library when it is not sure), writes stack: js, offers Sentry as the only monitoring service and asks whether the tests run test:e2e when package.json has it; it asks nothing about deploys, as the workflows do not deploy js apps yet. Next steps point to Sentry's wizard for the framework, and check looks for its SDK. The project kind now works for a stack without deploy targets and writes the stack and e2e inputs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adding a Next or Nuxt app (setup, protect, check), its tests (node-app-tests, the end-to-end tests) and the manual setup, with the stack, e2e and risk-gate inputs in the reference. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…once ready - project.yml deploys, rolls back and opens release pull requests for stack js too, after js-tests. - A provider may print headers for the health checks (provider_health_headers, through a file): Vercel sends its Protection Bypass for Automation secret (VERCEL_AUTOMATION_BYPASS_SECRET), so a protected staging is not rolled back. - A provider that follows its deploy (provider_wait) records the release as live only once it is ready, so a build that fails no longer counts as the live release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ts environments A deploy provider of setup may name the secret its deploys read (DEPLOY_HOOK by default), the variables they need, whether setup asks for deploy hooks and the values setup writes in each environment; collectState, the environment task, the next steps and check follow it. Forge and Laravel Cloud keep the deploy hook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Setup offers Vercel for a Next or Nuxt app: it asks for a Vercel token (also stored as VERCEL_TOKEN), finds the projects linked to the repository in the account and its teams, and asks for the Protection Bypass for Automation secret; it stores them with VERCEL_PROJECT and VERCEL_TEAM_ID in each environment, without deploy hooks. - It creates the project's staging custom environment when it has none, writes vercel.json without Vercel's own deploys of the branches the workflows deploy (pull requests keep their previews) and offers to create the health route /api/health of the framework (Next app or pages router, Nuxt). - check looks for VERCEL_TOKEN, VERCEL_PROJECT and the health route; the next steps list what is left in Vercel. Written from Vercel's API documentation: the first real setup still has to be checked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The setup questions and tasks of Vercel, the environments, vercel.json and health route by hand, and what check looks for. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package.ymlwithstack: js):node-package-testsruns thetestscript on a Node matrix and thetypecheck,lintandbuildscripts and the audit once;setup-jsinstalls with pnpm, yarn or npm by lockfile. The required check stayspipeline / tests / all-checks.plugins/coreholds the conventions common to every stack (language, scope, validation limits, review rounds, pull requests);plugins/laravelkeeps feature flags, migrations, tests and its tools, word for word. Every Claude workflow installscore@datalogixwith the stack's plugin.stack(defaultlaravel) to picksetup-laravelorsetup-jsand the stack's commands. Newplugins/jswith the conventions and theplan,fix-ci,incidentandsecurity-reviewcommands for Next and Nuxt.project.ymlwithstack: js):node-app-tests(typecheck,lint,test,build, thentest:e2ewith Playwright's browsers, and the audit) in a single job, so the required check stayspipeline / tests / tests; Claude, reviews, risk gate (with JavaScript high-risk paths), fix-ci, incidents and Vercel deploys.VERCEL_TOKEN), the projects linked to the repository, the protection bypass secret, the staging custom environment,vercel.jsonwithout Vercel's deploys of the deployed branches, and the/api/healthroute of the framework.x-vercel-protection-bypass), and a provider that follows its build records the release as live only once it is ready. Deploy providers declare their environment secrets and variables, so setup and check no longer assumeDEPLOY_HOOK.Stacked on #7. Non-breaking for existing inputs, but the core plugin changes how Claude receives its rules in every Laravel project: released as a minor (
v2.2.0) only after the Laravel test below.Test plan
npm test,npm run lint, relay tests,shellcheck,actionlintwith the local workflow references,claude plugin validateon the marketplace and the three plugins@claudeon an issue, a plan, a code review, a security review and a fix-ci behave as today withcore+laravelnode-app-testswithtest:e2e, the JavaScript security review and fix-cirepoUrl, team projects, staging custom environment on a Pro team), first deploy to staging and production with the protection bypass, and a rollback with the labelnode-package-tests.ymlof this branch🤖 Generated with Claude Code