Repository navigation
chore(promotion): promote dev to main - #25
Merged
Merged
Conversation
## Spec and outcome - Spec or repository-only rationale: SPEC-001 (Accepted) and ADR-002. - Accepted outcome: provide verified setup and main Actions consuming exact releases from rootform-dev/rootform. - Explicit non-goals: no public release, Marketplace publication, major tag movement, semantic parsing, or repository visibility change. ## Done when and evidence - Done when command or protocol: `bun run verify` and deterministic double bundle build. - Evidence path or exact output: 114 tooling tests plus 18 runtime tests passed; actionlint, Gitleaks working tree/history, and bundle determinism passed locally. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: optional private-transition token is never logged; downloads require exact asset and checksum agreement. - Offline and determinism impact: runtime stays offline after explicit release download; committed bundles reproduce byte-for-byte. - Dependency or toolchain change: exact Bun 1.3.14 and Node 24 Action runtime with pinned direct dependencies. - Rollback path: revert squash commit; existing dev and main remain unchanged until merge. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: repository-only public-surface documentation cleanup. - Accepted outcome: README, contributing guide, and security policy describe durable usage and contribution behavior without migration status, repository visibility, private test credentials, or owner transition steps. - Explicit non-goals: no Action runtime, input, output, dependency, bundle, release, tag, license, or visibility change. ## Done when and evidence - Done when command or protocol: public-facing copy contains no temporary migration or private-repository instructions and complete gate passes. - Evidence path or exact output: final diff removes 32 lines and adds 8; foundation validation, typecheck, Biome, 114 tooling tests, 18 runtime tests, actionlint, bundle rebuild, public working-set scan, and 11-commit Gitleaks history scan passed. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: removes temporary credential guidance; private vulnerability-reporting path remains. - Offline and determinism impact: none; runtime and committed bundle unchanged. - Dependency or toolchain change: none. - Rollback path: revert `fa93d6f`. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
Authenticated exact-version requests resolve published releases only. Tokens can read private published releases but cannot authorize unfinished draft assets.
## Spec and outcome - Spec or repository-only rationale: SPEC-001 REQ-001, REQ-002, REQ-003, REQ-008, and REQ-009; implementation plan requires a clean private-release integration. - Accepted outcome: a manual least-privilege workflow installs one exact published private Rootform release through the shared setup entrypoint, then validates normalized version, executable SHA-256 shape, and binary-reported version. - Explicit non-goals: no Action tag or release, no repository visibility change, no main-entrypoint analysis, and no permission beyond Contents read. ## Done when and evidence - Done when command or protocol: merge after CI, dispatch published-release-integration.yml on dev with version 0.1.0-dev.2, and require all steps to pass. - Evidence path or exact output: local bun run verify reported Full verification passed; live GitHub run will provide the secret-backed cross-repository proof after merge. - Full gate: bun run verify ## Risk and privacy - Security/privacy impact: ROOTFORM_RELEASES_READ_TOKEN is passed only to the installer input; workflow never prints or persists it. - Offline and determinism impact: network access ends after exact release installation; verification invokes only installed binary and exact outputs. - Dependency or toolchain change: none; checkout remains pinned by full commit SHA. - Rollback path: remove the manual integration workflow in a normal reviewed pull request. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits. Remaining limit: live integration covers Linux amd64; supported platform mapping and negative paths remain covered by unit tests.
Keep Bun types coupled to the pinned runtime and update Biome independently to stable 2.5.11.
## Spec and outcome - Spec or repository-only rationale: `specs/002-pull-request-reporting/spec.md` (Accepted). - Accepted outcome: publish CLI-owned architecture diff, policy, provenance, annotation, comment, and fixed artifact evidence for pull requests. - Explicit non-goals: semantic parsing in Action, Git fetching, `pull_request_target`, custom check runs, PDF output, dialect installation, or release publication. ## Done when and evidence - Done when command or protocol: `bun run verify`; real same-repository changed and unchanged pull-request runs update one marker-owned comment. - Evidence path or exact output: `specs/002-pull-request-reporting/evidence/e2e.md`; proof PR #9; changed run 33447403911; unchanged run 33447592934; comment 5485676893; final quality run 33448082670. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: dedicated optional comment token; fork and non-PR writes blocked; release and comment credentials masked and removed from CLI child environments. - Offline and determinism impact: CLI remains offline after verified install; only opt-in comment upsert and existing artifact upload use network. Report order, byte ceilings, and artifact inventory are fixed. - Dependency or toolchain change: none. - Rollback path: remove additive inputs, outputs, report modules, comment client, and diff artifacts; default SPEC-001 behavior remains isolated. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: SPEC-001 REQ-008 and accepted ADR-002 toolchain amendment. - Accepted outcome: pin Bun and @types/bun to 1.4.0 locally and in CI, then regenerate committed bundles deterministically. - Explicit non-goals: no public input, output, release, permission, network, or Rootform-consumption behavior change. ## Done when and evidence - Done when command or protocol: `bun run verify`. - Evidence path or exact output: 114 tooling tests and 20 runtime tests passed; actionlint, working-tree secret scan, history secret scan, and deterministic bundle verification passed. - Full gate: `bun run verify` passed. ## Risk and privacy - Security/privacy impact: none; no credential scope, permission, external data flow, or public behavior change. - Offline and determinism impact: no runtime network change; committed bundles reproduced deterministically. - Dependency or toolchain change: Bun and @types/bun pinned to 1.4.0; lockfile and bundles generated by that exact toolchain. - Rollback path: restore Bun 1.3.14 and @types/bun 1.3.14; regenerate lockfile and committed bundles; rerun full verification. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: `specs/003-ci-dialect-preparation/spec.md` (SPEC-003, accepted 2026-09-01) with `docs/adr/004-ci-dialect-preparation-boundary.md` - Accepted outcome: an Action run prepares its own Rootform environment before analyzing anything — it isolates a Rootform home for the job, invokes the CLI initialization command once with the caller's execution mode, reports the preparation outcome, exposes the resulting lock, and offers an opt-out cache of immutable dialect payload - Explicit non-goals: no provider discovery, dialect selection, lock reading, download, store management, policy, diff, or coverage reimplemented in Node; no repository content mutated; no `terraform init` or `tofu init`; `setup` still only installs; no release, tag move, or visibility change; no credential passed to the CLI ## Done when and evidence - Done when command or protocol: `bun run verify` - Evidence path or exact output: `Full verification passed.` — 165 tests across 20 files, `Foundation validation passed (121 Git candidate paths).`, `Action bundles are committed, deterministic, and Node-only.`, both Gitleaks scans reporting `no leaks found` - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: preparation runs with the same credential-stripped environment as every other CLI command, proven against a real child process in `src/network-boundary.test.ts -t "keeps credentials out of preparation"`; the Rootform home is created under `RUNNER_TEMP`, exported as `ROOTFORM_HOME`, and never published as an output, in the Job Summary, or in an artifact - Offline and determinism impact: preparation is the only step allowed to acquire dialects and `offline` removes even that; one preparation runs per job before analysis, so every later command observes the same resolved set; a restored cache entry is never authoritative because the CLI re-verifies every dialect by digest afterwards - Dependency or toolchain change: adds `@actions/cache@6.2.0`, pinned exactly, required by REQ-006 for restoring immutable dialect payload - Rollback path: remove the additive inputs and outputs, the preparation and cache modules, the preparation report section, and the home isolation; SPEC-001 analysis and SPEC-002 reporting are ordered after preparation and share no state with it ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits. ## Remaining limits Real network acquisition is not exercised: the official dialect source is not yet reachable, so preparation is proven with vendored dialects, a preloaded home, offline mode, and injected fakes. No download path is claimed as tested.
## Spec and outcome - Spec or repository-only rationale: repository-only visibility preparation after complete public-history and GitHub metadata audit. - Accepted outcome: public docs stop publishing local version-freeze policy, describe enforceable branch/security controls, and state honestly that no supported consumer Action tag exists yet. - Explicit non-goals: no Action runtime, input, output, tag, release, Marketplace, dependency, or bundle change. ## Done when and evidence - Done when command or protocol: `bun run verify` exits 0; repository history, Actions logs, PR metadata, and retained artifacts scan without secrets or private paths. - Evidence path or exact output: 114 tooling tests and 51 runtime tests passed; Gitleaks scanned 25 commits and 23.41 MB with no leaks; 46 Actions logs and five artifacts produced no private-path or secret candidate. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: removes temporary local version policy from current public surface and documents required public branch/security controls. - Offline and determinism impact: none; documentation-only change. - Dependency or toolchain change: none. - Rollback path: revert this documentation commit; do not change repository visibility until audit remains green. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: repository-only CI cleanup after `rootform-dev/rootform` became public. - Accepted outcome: published-release integration installs exact public Rootform release without a repository secret, and repository gate prevents regression. - Explicit non-goals: no Action runtime, input, output, bundle, tag, release, or Marketplace change. ## Done when and evidence - Done when command or protocol: `bun run verify` passes; hosted integration installs `0.1.0` with empty `github-token`. - Evidence path or exact output: 115 tooling tests and 51 runtime tests passed; actionlint and full Gitleaks history pass. - Full gate: `bun run verify`. ## Risk and privacy - Security/privacy impact: removes obsolete `ROOTFORM_RELEASES_READ_TOKEN` dependency from public-release proof. - Offline and determinism impact: none; exact version, API digest, archive checksum, and binary version checks remain. - Dependency or toolchain change: none. - Rollback path: revert this CI-only commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: SPEC-001 REQ-001/REQ-002 verified release installation contract. - Accepted outcome: Usage examples select supported immutable Rootform 0.1.1 release. - Explicit non-goals: No Action runtime, input, output, tag, dependency, or historical ADR change. ## Done when and evidence - Done when command or protocol: `bun run verify` exits 0 and published-release integration installs exact public 0.1.1. - Evidence path or exact output: Local full verification passed (115 tooling tests, 51 runtime tests, actionlint, secret scans, bundle sync); workflow run 33954067814 passed. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: None; documentation-only version correction. - Offline and determinism impact: None; exact immutable version remains pinned. - Dependency or toolchain change: None. - Rollback path: Revert this documentation commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
…ndation-minor-and-patch group (#14) Bumps the foundation-minor-and-patch group with 1 update: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome). Updates `@biomejs/biome` from 2.5.11 to 2.5.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/biomejs/biome/releases">@biomejs/biome's releases</a>.</em></p> <blockquote> <h2>Biome CLI v2.5.12</h2> <h2>2.5.12</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.</p> <pre lang="astro"><code><Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} /> </code></pre> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed Astro attribute names being split on <code>:</code> and <code>.</code> inside an expression, such as <code>{x && <button x-on:keyup.enter={go} client:load.foo />}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed a bare <code>></code> in the children of an Astro expression being treated as markup, such as <code>{x && <div>a > b</div>}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.</p> <pre lang="astro"><code>{x && <div><!-- first -->text<!-- last --></div>} {cond && <a></a><!-- c --><b></b>} </code></pre> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed <code>is:raw</code> children inside an Astro expression being read as JSX, such as <code>{x && <div is:raw>{not js} < & text</div>}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as <code>{items.map((i) => <li>it's {i}</li>)}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed the children of a <code><script></code> or <code><style></code> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.</p> <pre lang="astro"><code>{cond && <style>a { color: red }</style>} {cond && <script>let x = {a: 1};</script>} </code></pre> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Added support for template literal attribute values inside an Astro expression, such as <code>{x && <C data-x=`t${x}` />}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed unquoted attribute values being rejected inside an Astro expression, such as <code>{x && <a class=foo maxlength=255 href=/about>go</a>}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed a template literal nested inside <code>${}</code> breaking the rest of an Astro file, such as <code>const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as <code>const unsafe = /[/"]/;</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11508">#11508</a> <a href="https://github.com/biomejs/biome/commit/54f3a2ea2765c80df11d04e47cd8da0354f5f7ca"><code>54f3a2e</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Added the nursery rule <a href="https://biomejs.dev/linter/rules/use-flat-math-min-max/"><code>useFlatMathMinMax</code></a>. Because <code>Math.min()</code> and <code>Math.max()</code> accept any number of arguments, the rule reports unnecessary nested calls to the same method:</p> <pre lang="js"><code>Math.max(Math.max(a, b), c); </code></pre> <p>The fix flattens this expression to <code>Math.max(a, b, c)</code>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md">@biomejs/biome's changelog</a>.</em></p> <blockquote> <h2>2.5.12</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.</p> <pre lang="astro"><code><Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} /> </code></pre> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed Astro attribute names being split on <code>:</code> and <code>.</code> inside an expression, such as <code>{x && <button x-on:keyup.enter={go} client:load.foo />}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed a bare <code>></code> in the children of an Astro expression being treated as markup, such as <code>{x && <div>a > b</div>}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.</p> <pre lang="astro"><code>{x && <div><!-- first -->text<!-- last --></div>} {cond && <a></a><!-- c --><b></b>} </code></pre> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed <code>is:raw</code> children inside an Astro expression being read as JSX, such as <code>{x && <div is:raw>{not js} < & text</div>}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as <code>{items.map((i) => <li>it's {i}</li>)}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed the children of a <code><script></code> or <code><style></code> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.</p> <pre lang="astro"><code>{cond && <style>a { color: red }</style>} {cond && <script>let x = {a: 1};</script>} </code></pre> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Added support for template literal attribute values inside an Astro expression, such as <code>{x && <C data-x=`t${x}` />}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed unquoted attribute values being rejected inside an Astro expression, such as <code>{x && <a class=foo maxlength=255 href=/about>go</a>}</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed a template literal nested inside <code>${}</code> breaking the rest of an Astro file, such as <code>const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11440">#11440</a> <a href="https://github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878"><code>b88f1ea</code></a> Thanks <a href="https://github.com/Princesseuh"><code>@Princesseuh</code></a>! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as <code>const unsafe = /[/"]/;</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11508">#11508</a> <a href="https://github.com/biomejs/biome/commit/54f3a2ea2765c80df11d04e47cd8da0354f5f7ca"><code>54f3a2e</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Added the nursery rule <a href="https://biomejs.dev/linter/rules/use-flat-math-min-max/"><code>useFlatMathMinMax</code></a>. Because <code>Math.min()</code> and <code>Math.max()</code> accept any number of arguments, the rule reports unnecessary nested calls to the same method:</p> <pre lang="js"><code>Math.max(Math.max(a, b), c); </code></pre> <p>The fix flattens this expression to <code>Math.max(a, b, c)</code>.</p> </li> <li> <p><a href="https://redirect.github.com/biomejs/biome/pull/11585">#11585</a> <a href="https://github.com/biomejs/biome/commit/c5c8315cc2174b52834513d4c01edd09341e46cd"><code>c5c8315</code></a> Thanks <a href="https://github.com/Netail"><code>@Netail</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11475">#11475</a>: <code>noUnresolvedImports</code> no longer reports Bun runtime built-in modules (<code>bun</code>, <code>bun:bundle</code>, <code>bun:ffi</code>, <code>bun:jsc</code>, <code>bun:sqlite</code>, <code>bun:test</code>).</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/biomejs/biome/commit/0a31d7c4e1f6cc1b3e08af4aef2ad4b97f6b4f1c"><code>0a31d7c</code></a> ci: release (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11530">#11530</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/a20f44a3eb2086e65a6d8077eb89ab81f4d73130"><code>a20f44a</code></a> feat: noBunModules (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11597">#11597</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/1fc42ed80a00e3ca86d44de8e1f66707061eb862"><code>1fc42ed</code></a> feat(lint/js): add noThisOutsideOfClass (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11596">#11596</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/6c7fd273848765547dba547e550fc319df7455a0"><code>6c7fd27</code></a> feat(lint/js/vue): add noVueDeprecatedScopedSlots (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11593">#11593</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/f4e5ebb40e64d4488166bf0f2b7d8d96a6118016"><code>f4e5ebb</code></a> feat(lint): add useModernMathApis (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11581">#11581</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/54f3a2ea2765c80df11d04e47cd8da0354f5f7ca"><code>54f3a2e</code></a> feat(lint/js): add <code>useFlatMathMinMax</code> (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11508">#11508</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/1d6210b8ef6a2d2d83ea16e6fb95c124fd370690"><code>1d6210b</code></a> feat(lint/js): add <code>noUnmodifiedLoopCondition</code> (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11491">#11491</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/2d559316e00764b0843d3d483d4a093fb566de57"><code>2d55931</code></a> feat(js_analyze): added a React naming convention rule (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11554">#11554</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/ee69e0e8a90e6231a3b208cda4b3e65ad8b2006a"><code>ee69e0e</code></a> fix(schema): domains (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11565">#11565</a>)</li> <li><a href="https://github.com/biomejs/biome/commit/f5d7896f7115a2d57962471f6d7abfafddb07918"><code>f5d7896</code></a> feat(lint/js): add <code>noInvalidFileInputAccept</code> (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11497">#11497</a>)</li> <li>See full diff in <a href="https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.12/packages/@biomejs/biome">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Spec and outcome - Spec or repository-only rationale: Accepted SPEC-004, Release-set preparation. - Accepted outcome: prepare only exact external Dialects and Policy Packs selected by rootform.lock; preserve CLI authority; expose bounded preparation evidence. - Explicit non-goals: no Rootform semantic reimplementation, no lock mutation, no release, tag, package, or publication. ## Done when and evidence - Done when command or protocol: bun run verify - Evidence path or exact output: 115 tooling tests and 52 runtime tests passed; TypeScript, Biome, actionlint 1.7.12, deterministic Node-only bundle, working-set gitleaks, full-history gitleaks, and git diff --check passed. - Full gate: bun run verify ## Risk and privacy - Security/privacy impact: CLI child environment remains credential-stripped; reports omit package source, runner paths, raw Terraform, and secrets. - Offline and determinism impact: only explicit preparation may access network; restored cache never replaces CLI verification; dist rebuild is deterministic. - Dependency or toolchain change: no dependency change; biome schema URL aligned with pinned 2.5.12. - Rollback path: revert this PR before any Action release or tag. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: SPEC-005 (`specs/005-rootform-document-wording/spec.md`). Rootform retired the name "Architecture IR"; the saved JSON is a Rootform document (`contracts/rootform-document.md` in rootform-dev/rootform). - Accepted outcome: `action.yml` output descriptions and the README name the saved JSON a Rootform document. - Explicit non-goals: no input, output, artifact, or file name changes (`architecture`, `baseline-architecture`, `diff-*` keep their names); no runtime or `dist/` change; historical specs and ADRs untouched. ## Done when and evidence - Done when command or protocol: `rg -n "Architecture IR" action.yml README.md` prints nothing; `bun run verify` passes. - Evidence path or exact output: local `bun run verify` → 52 pass / 0 fail, no leaks (tree and full history), "Full verification passed." - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: none; descriptive text only. - Offline and determinism impact: none. - Dependency or toolchain change: none. - Rollback path: revert this commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
…12.0.10 (#18) Dependabot patch updates validated by current public CI.
## Spec and outcome - Spec or repository-only rationale: accepted SPEC-006 and ADR-006. - Accepted outcome: six autonomous GitHub-native entrypoints share verified installation, exact project preparation and faithful CLI reporting. Raw inputs produce one Form; supplied Forms retain their path and bytes. Evidence is published before the CLI gate. - Explicit non-goals: Terraform execution, provider credentials, semantic JSON interpretation, implicit Policy selection, mutable CLI version resolution, separate operand outputs, or a new CLI release. ## Done when and evidence - Done when command or protocol: full local gate plus real public consumers on five native runners, cross-job offline source-cache restoration, and serialized current-HEAD PR reporting. - Evidence path or exact output: specs/006-github-native-actions/evidence/preflight.md; 77 runtime tests / 518 assertions; ten actual published-CLI integration cases; cold Node 24 installation and isolated TLS OCI/offline proof. Public evidence: [five native platforms](https://github.com/rootform-dev/action-qualification/actions/runs/37007845589), [offline cache restoration](https://github.com/rootform-dev/action-qualification/actions/runs/37007845642), [integrated negative gate/report](https://github.com/rootform-dev/action-qualification/actions/runs/37007845525), and [obsolete HEAD attempt](https://github.com/rootform-dev/action-qualification/actions/runs/37007553675/attempts/2) all passed. One bot comment ID/body survived the obsolete rerun; downloaded integrated artifact has exactly five derived files and its complete Markdown is preserved in the comment. Public evidence is in qualification.md. - Full gate: `bun run verify` passed, including workflow lint, working-set/history secret scans and generated bundle correspondence. ## Risk and privacy - Security/privacy impact: Forms and CLI reports are explicit derived evidence. Artifacts use an allowlist; raw inputs never upload. Comments require opt-in, same-repository PR and native job serialization. CLI child environment excludes GitHub/Action credentials. - Offline and determinism impact: exact immutable CLI release, API/checksum/manifest/executable verification; source cache binds platform/version/exact lock and re-verifies through CLI init. Stable job-local home enables cross-job cache versions. - Dependency or toolchain change: cache SDK 6.3.0; Node 24 runtime retained; Bun-only pinned dependencies and corrected Biome schema. - Rollback path: pin previous reviewed Action commit; no published ref is moved. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: SPEC-006, owner-approved complete review clarification. - Accepted outcome: every Markdown-producing Action call requests `--details`. Reports keep one identity and major result blocks, with audit detail last. Inline size limits retain CLI-written primary statements and evidence links; complete output files and artifacts retain every entry. - Explicit non-goals: semantic parsing, new inputs/outputs, dependency changes, CLI publication, or moving the published v1 ref. ## Done when and evidence - Done when command or protocol: `bun run verify`; `ROOTFORM_TEST_FIXTURES=<clean exact public fixture checkout> bun run test:integration`; public qualification PR 3. - Evidence path or exact output: 80 runtime tests / 538 assertions and 115 tooling tests pass. Ten genuine published-binary integrations at 0.1.0-pr.117.1 reject compact preview wording. Report tests cover current and legacy CLI hierarchy, exact statements/counts and large exhaustive detail. Final public execution and rendered result are tracked in [qualification PR 3](rootform-dev/action-qualification#3). - Full gate: `bun run verify` passed, including workflow lint, working-set/history secret scans and reproducible committed bundle. ## Risk and privacy - Security/privacy impact: no permission or artifact inventory change. Complete derived reports replace compact previews; raw inputs remain excluded. PR commenting stays opt-in with existing HEAD/run/concurrency guards. - Offline and determinism impact: no acquisition or semantic behavior change. Reports are generated in the same existing CLI calls. - Dependency or toolchain change: none. - Rollback path: pin the previous reviewed immutable Action commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: accepted SPEC-006, REQ-009; user-facing adoption and complete Action references. - Accepted outcome: root README starts with the integrated Action; each primitive has a short task guide linking its canonical complete input/output reference in Rootform user docs. All raw-plan examples include the matching saved plan. - Explicit non-goals: no public input/output, runtime, distribution bundle, token or release changes. ## Done when and evidence - Done when command or protocol: `bun run verify`; inspect all six README examples against current manifests and canonical user-documentation routes. - Evidence path or exact output: full verification passed, including unit/integration tests, spec gate, workflow analysis, working-set and full-history secret scans, and unchanged action bundle. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: no raw evidence publication; existing fork, token and opt-in comment guidance retained. - Offline and determinism impact: exact version and lock-content rules retained; setup/init remain optional. - Dependency or toolchain change: none. - Rollback path: revert the documentation commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, customer Terraform material, private AI material, or generated build output enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
## Spec and outcome - Spec or repository-only rationale: SPEC-006 REQ-009; user-requested reference coherence and concise descriptions. - Accepted outcome: All six manifests describe inputs and outputs concisely. Primitive token descriptions cover release requests only; compare exposes a Comparison Form path. Preserve exact-version reuse, saved-plan pairing, Policy selection, artifact boundaries, retention and comment prerequisites. - Explicit non-goals: No input/output rename, default, required-state, runtime, bundle, tag or release change. ## Done when and evidence - Done when command or protocol: Parse each manifest before and after, remove input/output descriptions and compare the remaining metadata; all six match exactly. - Evidence path or exact output: Six manifests updated; only input/output descriptions changed. Shared source and committed bundles unchanged. - Full gate: `bun run verify` passed, including foundation, typecheck, formatter, unit tests, actionlint, secret scans and bundle reproduction. ## Risk and privacy - Security/privacy impact: None; documented boundaries preserved. - Offline and determinism impact: None; runtime unchanged. - Dependency or toolchain change: None. - Rollback path: Revert this documentation commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
…rward (#24) ## Spec and outcome - Spec or repository-only rationale: Repository-only release automation, recorded in `docs/adr/007-promoted-releases-and-major-tags.md` from the owner direction of 2026-10-07: `main` moves only by promotion of validated `dev`, a breaking change is a new major version, and the major tag names a qualified compatible release. - Accepted outcome: `quality` runs on pull requests into `dev` and `main` only, with a guard that accepts only a fast-forward promotion from this repository's `dev`. `promote.yml` fast-forwards `main` to the exact head that passed `quality`. `release.yml` no longer runs on push: an owner dispatch on `main` requires `quality` and a published release integration against a stable Rootform release on that exact commit, runs semantic-release with default rules (breaking means major), resumes a tag pushed without its release, then moves the major tag forward to the new release. `publish-v1.yml` is removed. The commit range check runs where commits enter `dev`, because a promotion carries already gated commits, including Dependabot commits exempt from that check. - Explicit non-goals: No release, tag or major tag change in this pull request, no change to the Action runtime surface or bundle, no immutable release setting change. ## Done when and evidence - Done when command or protocol: `bun run verify` passes in a clean clone, and the foundation validator refuses a push-triggered release workflow and any rule that ships a breaking change below major. - Evidence path or exact output: Clean clone of `4204219`: `install_rc=0`, `verify_rc=0` ("Full verification passed."), commit range check `range_rc=0`. `bun test scripts`: 117 pass, 0 fail. actionlint passes. History since `v0.1.0` contains two breaking commits (`17cf0cb` #19, `001be5e` #16), so the first release under default rules is `v1.0.0`, matching the documented `@v1` refs. - Full gate: `bun run verify` ## Risk and privacy - Security/privacy impact: The release job adds `actions: read` and `checks: read`; `contents: write` stays limited to the release and promotion jobs. The major tag only moves forward to a commit that descends from its current target. - Offline and determinism impact: None; the published bundle is unchanged. - Dependency or toolchain change: None. - Rollback path: Revert this squash commit on `dev`. No tag or release exists from it. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec and outcome
devintomainunderdocs/adr/007-promoted-releases-and-major-tags.md. Every commit in the range entereddevthrough a reviewed pull request gated byquality.mainfast-forwards fromf4a5febto170bde7(20 commits, docs: refine public action surface #2 through ci(release): release promoted main on dispatch and move major tags forward #24) oncequalitypasses on this exact head. The promotion publishes no release and moves no tag; the first release, computed asv1.0.0from the breaking commits feat(action)!: prepare only lock-selected external packages #16 and feat!: redesign github actions around forms and native reports #19, stays a separate owner dispatch.Done when and evidence
qualitypasses on this head; thengh workflow run promote.yml --ref dev -f pull_request=<this number>fast-forwardsmainand no workflow starts from the push.f4a5feb..170bde7matchesdev;mainis its ancestor. The last change, ci(release): release promoted main on dispatch and move major tags forward #24, passedqualityin run 37700745987 and a clean-clonebun run verify.bun run verifyRisk and privacy
mainreceives the dispatch-only release workflow before any release can run from it; nothing publishes on push.dev.devand promote again;mainnever rewinds.Review checklist