From 02833d76fbfcbdb86ee06f200e66f9a2c0b8e1e6 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Mon, 14 Sep 2026 16:10:04 -0500 Subject: [PATCH 1/2] fix(release): compilar policy.wasm antes de publicar el CLI; el README ES enlaza la captura ES MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dos hallazgos de revisión sobre la promoción #710, ambos reales: 1. `sdk-cli-release.yml` / `publish-npm`: tras #708 un tag `cli-vX.Y.Z` llega a `npm publish` sin haber compilado `src/rulesets/opa/policy.wasm` (gitignored; el build raíz es `tsc -b`). `prepublishOnly` copia rulesets y termina en `check:install-smoke`, que exige un wasm no trivial — existe porque 1.2.2 se publicó con 87 `.rego` y cero wasm. La primera release real del CLI moría en el último paso con todos los gates en verde. Se añade el mismo paso que ya tiene `npm-release.yml`: `npm run build:policy` + `test -f`. 2. `README.es.md`: la nota bajo la demo enlazaba `first-run-capture.md` en vez de `first-run-capture.es.md`, que existe. Co-Authored-By: Claude Opus 5 --- .github/workflows/sdk-cli-release.yml | 13 +++++++++++++ README.es.md | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sdk-cli-release.yml b/.github/workflows/sdk-cli-release.yml index 2122b24a..eed870c8 100644 --- a/.github/workflows/sdk-cli-release.yml +++ b/.github/workflows/sdk-cli-release.yml @@ -360,6 +360,19 @@ jobs: - name: Build every workspace run: npm run build + # `src/rulesets/opa/policy.wasm` is gitignored (root .gitignore:154), so a fresh + # runner does not have it and nothing above compiles it: the root build is + # `tsc -b`. `prepublishOnly` then runs copy-rulesets -> build -> copy-assets -> + # check:release-drift -> check:install-smoke, and the smoke check REQUIRES a + # non-trivial `rulesets/opa/policy.wasm` (that check exists because 1.2.2 + # shipped 87 .rego sources and zero wasm). Without this step the first + # `cli-v*` tag dies inside `npm publish`, after every gate above went green. + # Same step, same reason, as npm-release.yml. + - name: Compile the OPA policy bundle + run: | + npm run build:policy + test -f src/rulesets/opa/policy.wasm + - name: Build working-directory: ${{ env.CLI_DIR }} run: npm run build diff --git a/README.es.md b/README.es.md index c61cb8f9..41320c47 100644 --- a/README.es.md +++ b/README.es.md @@ -13,7 +13,7 @@ Terminal: evolith init, evolith validate; 133 reglas evaluadas, 26 omitidas, 9 bloqueantes no evaluadas reportadas como fallo; exit 2 -Salida real del CLI publicado sobre un repositorio vacío (2026-09-14, abreviada; captura completa de 71 filas). +Salida real del CLI publicado sobre un repositorio vacío (2026-09-14, abreviada; captura completa de 71 filas). From d065e46c8a094ab6e9d2cd88b1871fb8ae05d16d Mon Sep 17 00:00:00 2001 From: aarroyo Date: Mon, 14 Sep 2026 16:24:03 -0500 Subject: [PATCH 2/2] =?UTF-8?q?ci(guard=2066):=20declarar=20la=20reparaci?= =?UTF-8?q?=C3=B3n=20ES-only=20del=20enlace=20de=20README.es.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit El guard bilingüe vio README.es.md moverse sin README.md en 02833d76 y bloqueó `Validate documentation`, que es lo que existe para hacer. La edición es genuinamente unilateral: el enlace ES apuntaba a la captura EN y la mitad EN ya apuntaba a la suya, así que no hay contraparte que mover. Va a ALLOWED con su razón, como pide el propio guard para este caso. Co-Authored-By: Claude Opus 5 --- .harness/scripts/ci/66-validate-bilingual-sync.mjs | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.harness/scripts/ci/66-validate-bilingual-sync.mjs b/.harness/scripts/ci/66-validate-bilingual-sync.mjs index e8f56957..cc0608c2 100644 --- a/.harness/scripts/ci/66-validate-bilingual-sync.mjs +++ b/.harness/scripts/ci/66-validate-bilingual-sync.mjs @@ -70,9 +70,18 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '.. * That is why this stays empty rather than being deleted outright. A commit that is * genuinely and permanently one-sided — one whose counterpart will never move for any * reason — belongs here WITH its reason, because for that case the classifier has - * nothing to observe. Nothing in this repository is currently in that position. + * nothing to observe. One entry is in that position today: an ES-only link repair on + * README.es.md (the EN link was already right), declared below. */ -const ALLOWED = new Map([]); +const ALLOWED = new Map([ + [ + '02833d76', + 'ES-only link repair: README.es.md pointed the first-run capture at first-run-capture.md ' + + 'instead of first-run-capture.es.md (the EN half already pointed at its own file). No EN ' + + 'counterpart exists to change; README.md is touched by too many commits for convergedAfter ' + + 'to mean anything (see the note above). PR #711.', + ], +]); function fail(lines) { console.error(`\n\x1b[31m✗\x1b[0m ${GUARD}: ${lines[0]}`);