From d5bf84bb96b5e6796c008eac485390716009b87c Mon Sep 17 00:00:00 2001 From: PhD Jonathan MERCIER Date: Wed, 11 Nov 2026 00:37:45 +0100 Subject: [PATCH] ci: upgrade pinned actions and Node LTS (0.8.3) Update all five workflows to latest stable full-SHA actions and Node26.13.0 LTS without raising the installed runtime minimum. Preserve canonical ZIP transport, cache isolation, refs and approval/provenance gates. PATCH release for CI infrastructure. Verified Node26 clean rebuild (zero runtime drift), 57 focused tests, source inventory and bilingual source checks; independent source review accepted. Hosted execution remains gated on exact-source CI. Beads: ap-i798, ap-iasv --- .github/workflows/development-ci.yml | 39 +++++++++++-------- .github/workflows/documentation.yml | 17 ++++---- .github/workflows/promote-production.yml | 21 +++++----- .github/workflows/promotion-pr.yml | 7 ++-- .github/workflows/reproducibility.yml | 9 +++-- AGENTS.md | 15 +++++++ CONTRIBUTING.md | 2 +- README.md | 4 +- RELEASES.md | 17 ++++++++ docs/production-README.md | 2 +- docs/site/en/reference.md | 2 +- docs/site/fr/reference.md | 2 +- plugin.json | 2 +- .../references/compatibility-matrix.md | 16 ++++++++ tests/test_ci_verification.test.ts | 33 +++++++++++++++- 15 files changed, 138 insertions(+), 50 deletions(-) diff --git a/.github/workflows/development-ci.yml b/.github/workflows/development-ci.yml index d673e9c0..8e6a32cd 100644 --- a/.github/workflows/development-ci.yml +++ b/.github/workflows/development-ci.yml @@ -19,13 +19,14 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Install checksum-pinned Goose shell: bash run: | @@ -45,7 +46,7 @@ jobs: run: node scripts/ci-step.mjs quick node scripts/ci-tests.mjs quick - name: Upload detailed verification logs if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: production-ci-quick path: .artifacts/ci-logs @@ -62,13 +63,14 @@ jobs: matrix: shard: [1, 2, 3, 4] steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Install checksum-pinned Goose shell: bash run: | @@ -89,7 +91,7 @@ jobs: run: node scripts/ci-step.mjs skill-${{ matrix.shard }} node scripts/ci-tests.mjs skill ${{ matrix.shard }} - name: Upload detailed verification logs if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: production-ci-skill-${{ matrix.shard }} path: .artifacts/ci-logs @@ -101,13 +103,14 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 25 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Install checksum-pinned Goose shell: bash run: | @@ -127,7 +130,7 @@ jobs: run: node scripts/ci-step.mjs production-tests node scripts/ci-tests.mjs remaining - name: Upload detailed verification logs if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: production-ci-remaining path: .artifacts/ci-logs @@ -146,13 +149,14 @@ jobs: SKILL: ${{ needs.skill.result }} REMAINING: ${{ needs.remaining.result }} run: test "$QUICK" = success && test "$SKILL" = success && test "$REMAINING" = success - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha || github.event.pull_request.head.sha || github.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Install checksum-pinned Goose shell: bash run: | @@ -178,15 +182,16 @@ jobs: run: node scripts/candidate-transfer.mjs pack .artifacts/candidate .artifacts/candidate.json - name: Upload canonical frozen candidate if: github.event_name == 'push' && github.ref == 'refs/heads/develop' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: evaluation-candidate-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} + archive: true # Promotion verifies and extracts the API ZIP archive path: .artifacts/candidate.json retention-days: 14 if-no-files-found: error - name: Upload detailed verification logs if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: production-ci-projection path: .artifacts/ci-logs diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index ef690ec8..1677a03c 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -16,15 +16,16 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.12' - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - run: pip install --require-hashes -r docs/requirements.txt - run: bash scripts/build-documentation.sh - run: python3 scripts/test-documentation-integrity.py @@ -35,12 +36,12 @@ jobs: echo "PLAYWRIGHT_MODULE=$PWD/.artifacts/documentation/browser/node_modules/playwright-core/index.mjs" >> "$GITHUB_ENV" echo "CHROMIUM_PATH=/usr/bin/google-chrome" >> "$GITHUB_ENV" - run: node scripts/test-documentation-browser.mjs - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: documentation-site path: .artifacts/documentation/site include-hidden-files: true - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: documentation-screenshots @@ -55,14 +56,14 @@ jobs: pages: write environment: github-pages steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Configure publication identity run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: documentation-site path: .artifacts/documentation/site diff --git a/.github/workflows/promote-production.yml b/.github/workflows/promote-production.yml index 878ba928..cb0cb232 100644 --- a/.github/workflows/promote-production.yml +++ b/.github/workflows/promote-production.yml @@ -35,13 +35,14 @@ jobs: outputs: source_sha: ${{ steps.request.outputs.source_sha }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - id: request env: GH_TOKEN: ${{ github.token }} @@ -69,13 +70,14 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve.outputs.source_sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Await canonical exact-SHA develop verification (no duplicate suite) id: proof env: @@ -91,7 +93,7 @@ jobs: actions: read pull-requests: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve.outputs.source_sha }} fetch-depth: 0 @@ -104,9 +106,10 @@ jobs: test "$(git rev-parse HEAD)" = "$VERIFIED_SHA" case "$SOURCE_BRANCH" in develop) ;; *) exit 1 ;; esac git switch -c "$SOURCE_BRANCH" - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Install checksum-pinned Goose run: | curl --fail --location --retry 3 https://github.com/aaif-goose/goose/releases/download/v1.57.0/goose-x86_64-unknown-linux-gnu.tar.bz2 -o /tmp/goose.tar.bz2 diff --git a/.github/workflows/promotion-pr.yml b/.github/workflows/promotion-pr.yml index 76738ea5..9da446e8 100644 --- a/.github/workflows/promotion-pr.yml +++ b/.github/workflows/promotion-pr.yml @@ -16,13 +16,14 @@ jobs: pull-requests: read actions: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Verify request with trusted base-tree code only env: GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/reproducibility.yml b/.github/workflows/reproducibility.yml index 8192ac4b..dc4933e1 100644 --- a/.github/workflows/reproducibility.yml +++ b/.github/workflows/reproducibility.yml @@ -23,13 +23,14 @@ jobs: source_sha=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/branches?per_page=100" | jq -r 'add | map(select(.name == "develop")) | .[0].commit.sha // empty') [[ "$source_sha" =~ ^[a-f0-9]{40}$ ]] echo "sha=$source_sha" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ steps.source.outputs.sha }} persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '22.22.2' + node-version: '26.13.0' # Latest LTS, pinned for reproducibility (2026-11-10) + package-manager-cache: false - name: Install checksum-pinned Goose run: | curl --fail --location --retry 3 https://github.com/aaif-goose/goose/releases/download/v1.57.0/goose-x86_64-unknown-linux-gnu.tar.bz2 -o /tmp/goose.tar.bz2 @@ -47,7 +48,7 @@ jobs: run: node scripts/ci-step.mjs exhaustive node scripts/test.mjs --profile=full - name: Upload detailed verification logs if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: exhaustive-ci-logs path: .artifacts/ci-logs diff --git a/AGENTS.md b/AGENTS.md index 605f56a0..686ea668 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -153,6 +153,21 @@ permission; action-specific current authorization remains mandatory. | Documentation | `bash scripts/build-documentation.sh`; `python3 scripts/test-documentation-integrity.py`; `node scripts/test-documentation-browser.mjs` (configured Python/Zensical/Chromium) | References: [contribution/build setup](CONTRIBUTING.md), [promotion/rollback](docs/branch-migration.md), [documentation setup/publication](docs/documentation.md). +## Current CI toolchain + +- CI pins Node.js **26.13.0 LTS** (official release index inspected 2026-11-10), + separately from the unchanged supported runtime minimum **22.22.2**. +- All five `.github/workflows` use full-SHA action pins with release comments; + action internals use Node24, not the Node version installed for build/test commands. +- Keep `package-manager-cache: false` on setup-node: offline reconstruction and + privileged promotion must not silently acquire automatic npm caching. +- Canonical candidate upload explicitly uses `archive: true`: promotion authenticates + the API ZIP digest and streams its unique `candidate.json` member. Do not change to + raw upload without adapting that transport contract. Documentation keeps hidden files. +- `tests/test_ci_verification.test.ts` checks current pins, exact CI Node identity, + cache policy, ZIP transport and existing trust boundaries. Local checks do not prove + GitHub runner/action execution or the live artifact-service round trip. + ## Test design and execution pitfalls - Each test documents a distinct product guarantee and identifies the wrong observable result it detects. Delete mock-echo, copied-algorithm and duplicate cases; assert exact outcomes and relevant boundaries. Green mocks and test count are not acceptance. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 305570f9..e980a1ef 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -54,7 +54,7 @@ Creating a branch does not authorize an automated agent to commit or push. Follo ## Development prerequisites -- **Node.js 22+** for the contained runtimes and Node-based tooling. Routine CI uses Node.js 22.22.2. +- **Node.js 22+** for the contained runtimes and Node-based tooling. Routine CI pins Node.js 26.13.0 LTS. - **Git**; **Beads (`bd`)** for task tracking. **Make** is optional. - Full verification also needs the verified **Goose 1.57.0** executable and a supported browser for integration/accessibility checks. See [.github/workflows/development-ci.yml](.github/workflows/development-ci.yml) for CI prerequisites. diff --git a/README.md b/README.md index f257111c..5e89f9c7 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ [![Servier Powered](https://raw.githubusercontent.com/servierhub/.github/main/badges/powered.svg)](https://servier.com/en/) -> **Current distribution 0.8.2.** The contained agent-plugin CLI supplies evaluation, +> **Current distribution 0.8.3.** The contained agent-plugin CLI supplies evaluation, > history/inspect, grading and export; the separate helper renders exported HTML. > Legacy creator CLIs/native archives and historical import remain retired. > Active host guidance targets current stable releases; versioned compatibility @@ -28,7 +28,7 @@ Four creators cover authoring and validation; a fifth Skill helps package execut | Status | Value | |---|---| -| Distribution | `0.8.2` | +| Distribution | `0.8.3` | | Portable plugin target | Agent Plugins `1.0.0` | | Verified host integration | Goose `1.47.0` | | Git installation requirement | Node.js 22+; creator code and dependencies included | diff --git a/RELEASES.md b/RELEASES.md index ba33c6fd..67e2ca99 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -9,6 +9,23 @@ and local staged installer have been retired and removed from current tooling. No native compatibility or newly published release is claimed by this cleanup. Historical compatibility evidence and third-party/vendor sources remain retained. +## 0.8.3 — current CI actions and Node LTS + +PATCH release: updates CI infrastructure without changing CLI behavior or the +supported Node.js runtime minimum (22.22.2). CI pins Node.js 26.13.0 LTS; +GitHub Actions use their declared Node24 runtime independently. + +- Latest stable full-SHA action pins: checkout 7.0.1, setup-node 7.1.0, + setup-python 7.1.0, upload-artifact 7.0.2 and download-artifact 8.0.2. +- Disable automatic npm caching and preserve the authenticated canonical ZIP + artifact transport, checkout refs, permissions and approval/provenance gates. +- Official release manifests and Node release index inspected 2026-11-10. + Local Node26 build/tests/typecheck/lint and CI contracts verified; GitHub action + execution and artifact-service round trip require exact-source CI evidence. +- No Goose update or new host-support commitment is introduced. See the + [versioned compatibility evidence](skills/plugin-creator/references/compatibility-matrix.md#083--ci-toolchain-update-2026-11-11). + + ## 0.6.1 — report overview and judge diagnostics - Explicit source Skill/Plugin identity and complete frozen campaign overview, with diff --git a/docs/production-README.md b/docs/production-README.md index b7a927a5..c4ee0907 100644 --- a/docs/production-README.md +++ b/docs/production-README.md @@ -4,7 +4,7 @@ Reusable authoring instructions and comparative Skill/Plugin evaluation. -**0.8.2 — Git distribution.** Installations receive the generated `main` tree. +**0.8.3 — Git distribution.** Installations receive the generated `main` tree. Local source changes do not update remote installations until verified promotion. Goose is the verified reference host for plugin installation; other hosts and native model/profile compatibility require separate evidence. diff --git a/docs/site/en/reference.md b/docs/site/en/reference.md index ea1363ee..abd2c104 100644 --- a/docs/site/en/reference.md +++ b/docs/site/en/reference.md @@ -12,7 +12,7 @@ Use this page to look up recorded versions, paths, command boundaries, and sourc | Verified host integration | Goose 1.47.0, not a claim about latest Goose | | Git-installed creator runtime | Node.js 22+; compiled code and production dependencies included | | Native release runtime | Platform-specific Bun executable; no Node.js requirement | -| Contributor tooling | Node.js 22+ and pinned Bun 1.3.12; routine CI uses Node.js 22.22.2 | +| Contributor tooling | Node.js 22+ and pinned Bun 1.3.12; routine CI pins Node.js 26.13.0 LTS | | License | [CeCILL-C](https://github.com/bioinfornatics/agent-plugins/blob/develop/LICENSE) | Verification of Goose does not establish compatibility with another host. See the [recorded Goose plugin reference](https://github.com/bioinfornatics/agent-plugins/blob/develop/skills/plugin-creator/references/goose-plugin-format.md) for revision-specific details. diff --git a/docs/site/fr/reference.md b/docs/site/fr/reference.md index 695a7b3f..2073b209 100644 --- a/docs/site/fr/reference.md +++ b/docs/site/fr/reference.md @@ -12,7 +12,7 @@ Consultez cette page pour retrouver les versions consignées, les chemins, les l | Intégration vérifiée avec l'hôte | Goose 1.47.0, sans affirmation sur la dernière version | | Exécution des créateurs installés depuis Git | Node.js 22+ ; code compilé et dépendances de production inclus | | Exécution des versions natives | Exécutable Bun propre à la plateforme ; Node.js non requis | -| Outils de contribution | Node.js 22+ et Bun 1.3.12 épinglé ; la CI courante utilise Node.js 22.22.2 | +| Outils de contribution | Node.js 22+ et Bun 1.3.12 épinglé ; la CI courante épingle Node.js 26.13.0 LTS | | Licence | [CeCILL-C](https://github.com/bioinfornatics/agent-plugins/blob/develop/LICENSE) | La vérification de Goose ne démontre pas la compatibilité avec un autre hôte. Consultez la [référence Goose consignée pour les plugins](https://github.com/bioinfornatics/agent-plugins/blob/develop/skills/plugin-creator/references/goose-plugin-format.md) pour les détails liés à la révision. diff --git a/plugin.json b/plugin.json index 0b9552ed..859138fc 100644 --- a/plugin.json +++ b/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "agent-plugins", - "version": "0.8.2", + "version": "0.8.3", "description": "Reusable capability authoring Skills and comparative Skill/Plugin evaluation CLI", "extensions": { "io.github.bioinfornatics.agent-plugins.runtime": { diff --git a/skills/plugin-creator/references/compatibility-matrix.md b/skills/plugin-creator/references/compatibility-matrix.md index 0ccddeab..4247238b 100644 --- a/skills/plugin-creator/references/compatibility-matrix.md +++ b/skills/plugin-creator/references/compatibility-matrix.md @@ -143,3 +143,19 @@ range or its lower boundary. Linked [0.8.2 change record](https://github.com/bioinfornatics/agent-plugins/blob/develop/RELEASES.md#082--conditional-skill-context-and-host-identities). Release metadata is not publication/tagging or host-integration evidence. + +## 0.8.3 — CI toolchain update (2026-11-11) + +Source revision is the commit carrying the 0.8.3 release record. This is a CI +infrastructure update, not a host-version or installation-contract change. +[Node release index](https://nodejs.org/dist/index.json) inspected 2026-11-10 +identifies Node26.13.0 as LTS. The pinned official action manifests declare Node24. +Exact action versions/SHAs and CI identity are checked in the source CI contracts. + +| agent-plugin | Host/runtime version | Evidence | Status | +|---|---|---|---| +| 0.8.3 source candidate | Node.js 26.13.0; Linux x64 | Checksum-verified official runtime; local build, app tests, typecheck/lint and CI/provenance contracts | Locally tested; hosted CI and artifact-service round trip unverified until exact-source execution | +| 0.8.3 | GitHub Actions Node24 | [checkout 7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1), [setup-node 7.1.0](https://github.com/actions/setup-node/releases/tag/v7.1.0), [setup-python 7.1.0](https://github.com/actions/setup-python/releases/tag/v7.1.0), [upload-artifact 7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2), [download-artifact 8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2) and pinned action.yml inspected | Documented; local configuration verified, not hosted action execution | +| 0.8.3 | Goose1.57.0 unchanged; other hosts not executed | No host adapter or instruction change; minimum Node22.22.2 unchanged | Existing limitations retained; declared host support range remains unestablished | + +Linked [0.8.3 change record](https://github.com/bioinfornatics/agent-plugins/blob/develop/RELEASES.md#083--current-ci-actions-and-node-lts). diff --git a/tests/test_ci_verification.test.ts b/tests/test_ci_verification.test.ts index 9901e7b0..f7c242f7 100644 --- a/tests/test_ci_verification.test.ts +++ b/tests/test_ci_verification.test.ts @@ -1,6 +1,6 @@ import test from 'node:test'; import assert from 'node:assert/strict'; -import {readFileSync} from 'node:fs'; +import {readFileSync,readdirSync} from 'node:fs'; import {spawnSync} from 'node:child_process'; import {validateShardPlan,loadTestPlan,discoverAppTests,remainingRootTests,retiredGuarantees} from '../scripts/ci-test-plan.mjs'; import {selectCanonicalRun,validateCanonicalJobs,awaitCanonicalVerification,requiredJobs,selectCandidateArtifact} from '../scripts/production-verification.mjs'; @@ -56,6 +56,35 @@ test('current root contracts remain mandatory and historical native campaigns ar }); import {parse} from '../apps/agent-plugin/node_modules/yaml/dist/index.js'; const yaml={load:parse}; +// Detect stale action runtimes/toolchains and transport defaults that break frozen promotion. +test('all CI workflows pin reviewed Node24 actions and the current exact Node LTS',()=>{ + const actions:Record={ + 'actions/checkout':'3d3c42e5aac5ba805825da76410c181273ba90b1', + 'actions/setup-node':'949feb2413d6458794dcd2491c4babbbce0c15c1', + 'actions/upload-artifact':'cf430e030ddbb5b0abf93d22962f4752f3646cd9', + 'actions/download-artifact':'9000827ccba6bdab643e8b6fd33ac0654aef8333', + 'actions/setup-python':'6d4fd22b20465ccc0f7354476588e8df7c9ca0e0', + }; + for(const file of readdirSync(root+'.github/workflows').filter(f=>/\.ya?ml$/.test(f))){ + const workflow:any=yaml.load(readFileSync(root+'.github/workflows/'+file,'utf8')); + for(const job of Object.values(workflow.jobs) as any[])for(const step of job.steps??[]){ + if(!step.uses)continue; + const [action,sha]=step.uses.split('@'); + assert.equal(sha,actions[action],file+': '+step.uses); + assert.match(sha,/^[a-f0-9]{40}$/); + if(action==='actions/setup-node'){ + assert.equal(step.with['node-version'],'26.13.0',file); + assert.equal(step.with['package-manager-cache'],false,file); + } + } + } + const ci:any=yaml.load(readFileSync(root+'.github/workflows/development-ci.yml','utf8')); + const candidate=ci.jobs.verify.steps.find((s:any)=>s.name==='Upload canonical frozen candidate'); + assert.equal(candidate.with.archive,true,'promotion consumes a digest-bound ZIP, not a raw file'); + const docs:any=yaml.load(readFileSync(root+'.github/workflows/documentation.yml','utf8')); + const site=docs.jobs.build.steps.find((s:any)=>s.with?.name==='documentation-site'); + assert.equal(site.with['include-hidden-files'],true); +}); test('workflow DAG stops expensive jobs on quick failure and requires all shards',()=>{ const ci:any=yaml.load(readFileSync(root+'.github/workflows/development-ci.yml','utf8')),promotion:any=yaml.load(readFileSync(root+'.github/workflows/promote-production.yml','utf8')); assert.equal(ci.jobs.skill.needs,'quick');assert.equal(ci.jobs.remaining.needs,'quick');assert.deepEqual(ci.jobs.skill.strategy.matrix.shard,[1,2,3,4]);assert.equal(ci.jobs.skill.strategy['fail-fast'],false); @@ -144,7 +173,7 @@ test('trusted promotion preflight rejects request drift before and after canonic test('current CI uses Node/offline build and checksum-pinned Goose without claiming native fixtures',()=>{ for(const file of ['development-ci.yml','reproducibility.yml']){ const text=readFileSync(root+'.github/workflows/'+file,'utf8'); - assert.match(text,/22\.22\.2/);assert.match(text,/prepare-development\.mjs/); + assert.match(text,/26\.13\.0/);assert.match(text,/prepare-development\.mjs/); assert.match(text,/v1\.57\.0/);assert.match(text,/e54036f3b7f95d3b0d7854c09465af5ef52a28c7fa03d2497d0ea68a6382282d/); assert.match(text,/sha256sum -c -/);assert.match(text,/GOOSE_TEST_BINARY=/);assert.match(text,/CI_REQUIRE_GOOSE_HOST=1/); assert.doesNotMatch(text,/setup-bun|build-bun-executables|apps\/.*-creator-cli/);