ci(contracts): capture pinned OpenCLI descriptive schemas in isolation #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pinned upstream descriptive contracts | |
| on: | |
| push: | |
| branches: ['feature/2.0.x-contract-hardening'] | |
| paths: ['.github/workflows/upstream-contracts.yml'] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| capture: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: Install pinned OpenCLI without lifecycle scripts | |
| shell: bash | |
| run: | | |
| mkdir -p upstream-evidence "$RUNNER_TEMP/opencli-prefix" "$RUNNER_TEMP/opencli-isolated-home" | |
| npm view @jackwener/opencli@1.8.8 version gitHead dist --json > upstream-evidence/npm-provenance.json | |
| npm install --prefix "$RUNNER_TEMP/opencli-prefix" --ignore-scripts --no-audit --no-fund --save-exact @jackwener/opencli@1.8.8 | |
| - name: Capture only bounded version and structured help | |
| shell: bash | |
| run: | | |
| export HOME="$RUNNER_TEMP/opencli-isolated-home" | |
| CLI="$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli/dist/src/main.js" | |
| timeout 20 node "$CLI" --version > upstream-evidence/version.txt | |
| timeout 20 node "$CLI" --help -f json > upstream-evidence/root-help.json | |
| for namespace in browser daemon auth skills plugin adapter profile; do | |
| timeout 20 node "$CLI" "$namespace" --help -f json > "upstream-evidence/$namespace-help.json" | |
| done | |
| cp "$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli/cli-manifest.json" upstream-evidence/cli-manifest.json | |
| cp "$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli/package.json" upstream-evidence/package.json | |
| tar -czf upstream-evidence/opencli-package.tar.gz -C "$RUNNER_TEMP/opencli-prefix/node_modules/@jackwener/opencli" dist/src cli-manifest.json package.json | |
| node --version > upstream-evidence/node-version.txt | |
| date -u +%FT%TZ > upstream-evidence/captured-at.txt | |
| (cd upstream-evidence && sha256sum *.json *.txt *.tar.gz > SHA256SUMS) | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: opencli-1.8.8-descriptive-${{ github.sha }} | |
| path: upstream-evidence | |
| retention-days: 14 | |
| if-no-files-found: error |