Own product verification and release checks in native tasks

.github/dependency-policy.json

@@ -11,7 +11,8 @@
   "managed_dependencies": [
     "aviorstudio/gdam-actions/*",
     "nicodes/komizo-actions/*",
-    "nicodes/komizo/*"
+    "nicodes/komizo/*",
+    "nicodes/tools/*"
   ],
   "sensitive_dependencies": [
     "*clerk*",

.github/readme-source.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "sha256": "b0008a20f0336bdc0cade112310947098eadf2e3ce51e9f65fc07d0be8c8c47d",
+  "sha256": "b86f55067c7d834c18cc3426a6ab3a61507b688b0b95fe7074d31c2d1a50852f",
   "history": {
     "forbidden_commits": [
       "0eb77f25b1b2c0df30fb7a80abb435bf5bd65724"

.github/workflows/cd.yml

@@ -25,12 +25,12 @@ jobs:
     steps:
     - name: Check out source
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-    - name: Set up locked komizo
-      uses: nicodes/komizo/setup@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
+    - name: Set up development tools
+      uses: nicodes/tools/setup@091101094fedf5ce2e67c339c1c9c842d6a662dc
       env:
         GH_TOKEN: ${{ github.token }}
     - name: Validate and build the redirect
-      run: komizo check
+      run: mise run check
     - name: Configure GitHub Pages
       uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d
     - name: Upload the static site

.github/workflows/ci.yml

@@ -26,22 +26,16 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
-    - name: Set up locked komizo
-      uses: nicodes/komizo/setup@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
+    - name: Set up development tools
+      uses: nicodes/tools/setup@091101094fedf5ce2e67c339c1c9c842d6a662dc
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 5
     - name: Record tested integration identity
       if: github.event_name == 'pull_request'
       env:
         EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
-      run: 'komizo exec --tools python -- bash -euo pipefail <<''KOMIZO_COMMAND''
-
-        python3 "$CICD_ENGINEERING/helpers/integration-identity.py"
-
-        KOMIZO_COMMAND
-
-        '
+      run: python3 "$TOOLS_ROOT/helpers/integration-identity.py"
     - name: Upload artifacts
       if: github.event_name == 'pull_request'
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
@@ -52,9 +46,10 @@ jobs:
         retention-days: 7
         include-hidden-files: true
     - name: Check project
-      uses: nicodes/komizo/run@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
-      with:
-        target: check
+      shell: bash
+      run: |-
+        set -euo pipefail
+        mise run check
     - name: Upload artifacts
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
       with:

.github/workflows/dependency-policy.yml

@@ -26,8 +26,8 @@ concurrency:
 jobs:
   auto-merge:
     name: Apply dependency policy
-    if: github.ref == 'refs/heads/main' && (github.event_name != 'pull_request_target' || (github.event.pull_request.user.login == 'dependabot[bot]'
-      && github.event.pull_request.draft == false))
+    if: github.ref == 'refs/heads/main' && (github.event_name != 'pull_request_target' || (github.event.pull_request.user.login
+      == 'dependabot[bot]' && github.event.pull_request.draft == false))
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
@@ -44,16 +44,14 @@ jobs:
         persist-credentials: false
         ref: main
       timeout-minutes: 3
-    - name: Set up locked komizo
-      uses: nicodes/komizo/setup@2ca94e2fd4bb05f41bb228e9c366e5cc733c75e6
-      env:
-        GH_TOKEN: ${{ github.token }}
-      timeout-minutes: 5
     - name: Reconcile verified dependency updates
-      run: komizo dependencies apply --output "$RUNNER_TEMP/dependency-report.json"
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
+      uses: nicodes/tools/dependencies@091101094fedf5ce2e67c339c1c9c842d6a662dc
+      with:
+        apply: 'true'
+        output: ${{ runner.temp }}/dependency-report.json
     - name: Upload artifacts
       if: always()
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9

.gitignore

@@ -1,6 +1,3 @@
 .artifacts/
 __pycache__/
-
-.komizo.mise*.toml
-
-.komizo.mise*.lock
+/.ci-tools/

README.md

@@ -1,7 +1,20 @@
-<!-- Generated from private documentation source. Do not edit directly. Source SHA256: f9e57e7ccb79e8911a4fdc009f1b3f2c892868f526b2d41ebddb77c6e7018a2f -->
+<!-- Generated from private documentation source. Do not edit directly. Source SHA256: d31ab1b43185c1f1c5090c763313e3290c3a8f92e76c0ee517bb0229d036beec -->
 
 # aviorstudio.github.io
 
 Static redirect to [Avior Studio](https://www.avior.studio/).
 
-Install the [komizo release](https://github.com/nicodes/komizo#install) matching `komizo.lock`, then run `komizo check`. Use `komizo describe` to inspect the applicable stages.
+Install [mise](https://mise.jdx.dev/) and run `mise install`, then run `mise run check`. Use `mise tasks ls` to inspect the applicable stages.
+
+## Contributor verification
+
+Tool versions and native tasks live in `mise.toml`. Prepare the pinned helper source and run the complete gate:
+
+```sh
+git clone https://github.com/nicodes/tools.git .ci-tools
+git -C .ci-tools checkout --detach 091101094fedf5ce2e67c339c1c9c842d6a662dc
+mise install
+mise run check
+```
+
+Native build and test commands retain source and output checks, with receipts in `.artifacts/verification`. Existing product release rules and artifacts remain owned by this repository. End users install the product’s published distribution.

mise.toml

@@ -0,0 +1,25 @@
+[tools]
+"python" = "3.13.11"
+"actionlint" = "1.7.12"
+
+[env]
+TOOLS_ROOT = "{{ get_env(name='TOOLS_ROOT', default=config_root ~ '/.ci-tools') }}"
+GOTOOLCHAIN = "local"
+PYTHONDONTWRITEBYTECODE = "1"
+
+[tasks."lint"]
+run = ["python3 scripts/check.py", "actionlint"]
+
+[tasks."build"]
+run = "python3 \"$TOOLS_ROOT/helpers/verification.py\" build --name build --artifact .artifacts/dist -- mise run _build"
+
+[tasks."_build"]
+run = ["python3 scripts/check.py --build"]
+hide = true
+
+[tasks."_check-stages"]
+run = [{"task" = "lint"}, {"task" = "build"}]
+hide = true
+
+[tasks."check"]
+run = [{"task" = "lint"}, {"task" = "build"}]