Ashutosh/skill ecosystem deps

.github/workflows/ci.yml

@@ -3,22 +3,43 @@ name: ci
   push:
     branches: ["**"]
   pull_request:
+permissions:
+  contents: read
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: "3.12"
-      - name: Run tests (frontmatter + roster + drift)
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - name: Prepare isolated npm CLI
+        run: |
+          umask 077
+          prefix="$(mktemp -d "$RUNNER_TEMP/npm-cli.XXXXXX")"
+          cd "$RUNNER_TEMP"
+          npm install --prefix "$prefix" --ignore-scripts --no-audit --no-fund --package-lock=false npm@11.19.1
+          printf '%s\n' "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+      - name: Run all offline tests
+        env:
+          npm_config_offline: "true"
+          npm_config_ignore_scripts: "true"
+          npm_config_audit: "false"
+          npm_config_fund: "false"
         run: make run_tests
       - name: Lint
         run: make lint
       - name: Leakage gate (no secrets / proprietary strings)
         run: |
           if grep -rniE 'adobe|astiwari|sensei-fs|AWS_BEARER|\.internal\b|\bcorp\.|firefly|\borion\b' \
-             skills site README.md NORTH_STAR.md .thunderkit; then
+             skills site bin README.md NORTH_STAR.md DEPENDENCIES.md .thunderkit; then
             echo "::error::leakage denylist hit"; exit 1
           fi
           echo "leakage gate clean"

.github/workflows/peers-watch.yml

@@ -0,0 +1,28 @@
+name: peers-watch
+"on":
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  watch:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - name: Resolve each host's required peer channel
+        run: |
+          set -eu
+          {
+            echo "## Peer channels"
+            for host in hermes opencode claude codex copilot; do
+              node bin/thunderkit.js peers --host "$host"
+            done
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-please.yml

@@ -1,49 +1,217 @@
-name: release-please
+name: Release
 "on":
   push:
-    branches: ["master"]
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Exact version; leave empty for automatic stable versioning
+        required: false
+        type: string
+      npm_tag:
+        description: Optional channel for an exact version
+        required: false
+        type: string
 
-permissions:
-  contents: write
-  pull-requests: write
-  id-token: write  # for the publish job (npm OIDC trusted publishing)
+permissions: {}
+concurrency:
+  group: npm-release
+  cancel-in-progress: false
+defaults:
+  run:
+    shell: bash
+env:
+  RELEASE_VERSION_INPUT: ${{ inputs.version }}
+  RELEASE_NPM_TAG_INPUT: ${{ inputs.npm_tag }}
+  npm_config_registry: https://registry.npmjs.org
+  GIT_CONFIG_GLOBAL: /dev/null
+  GIT_CONFIG_NOSYSTEM: "1"
 
 jobs:
-  release-please:
-    runs-on: ubuntu-latest
+  gate:
+    if: ${{ github.repository == 'thunderock/thunderkit' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
     outputs:
-      release_created: ${{ steps.rp.outputs.release_created }}
-      tag_name: ${{ steps.rp.outputs.tag_name }}
+      action: ${{ steps.plan.outputs.action }}
+      record_sha256: ${{ steps.plan.outputs.record_sha256 }}
+      artifact_id: ${{ steps.upload.outputs.artifact-id }}
     steps:
-      - id: rp
-        uses: googleapis/release-please-action@v4
-        with:
-          release-type: node
-          # Config + manifest live in the repo so the next version is computed
-          # from Conventional Commits since the last tag — no manual bump.
-          config-file: .release-please-config.json
-          manifest-file: .release-please-manifest.json
+      - id: environment
+        name: Initialize isolated configuration paths
+        run: |
+          printf '%s\n' \
+            "npm_config_userconfig=$RUNNER_TEMP/npm-userconfig" \
+            "npm_config_globalconfig=$RUNNER_TEMP/npm-globalconfig" \
+            "npm_config_cache=$RUNNER_TEMP/npm-cache" \
+            "GH_CONFIG_DIR=$RUNNER_TEMP/gh-config" \
+            >> "$GITHUB_ENV"
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+          set-safe-directory: false
+      - id: node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - id: python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - id: npm
+        name: Prepare isolated npm CLI
+        run: |
+          umask 077
+          : > "$npm_config_userconfig"
+          : > "$npm_config_globalconfig"
+          prefix="$(mktemp -d "$RUNNER_TEMP/npm-cli.XXXXXX")"
+          cd "$RUNNER_TEMP"
+          npm install --prefix "$prefix" --ignore-scripts --no-audit --no-fund --package-lock=false npm@11.19.1
+          printf '%s\n' "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+      - id: tools
+        name: Verify tools and source
+        run: |
+          node -e 'if (process.versions.node.split(".")[0] !== "24") process.exit(1)'
+          test "$(npm --version)" = '11.19.1'
+          python3 -c 'import sys; assert sys.version_info[:2] == (3, 12)'
+          for tool in git gh make; do command -v "$tool" > /dev/null; done
+          api_help="$(gh api --help)"
+          for flag in --include --method; do [[ "$api_help" == *"$flag"* ]]; done
+          release_help="$(gh release create --help)"
+          for flag in --repo --verify-tag --target --title --generate-notes --prerelease --latest; do [[ "$release_help" == *"$flag"* ]]; done
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+      - id: plan
+        name: Validate and prepare release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node tools/release/plan.mjs --workspace "$RUNNER_TEMP/release"
+      - id: tests
+        name: Test the stamped source
+        if: ${{ success() && steps.plan.outputs.action == 'publish' }}
+        run: |
+          cd "$RUNNER_TEMP/release/source"
+          make run_tests && make lint && npm test
+          node --test tests/release_*.test.mjs
+          make site
+      - id: verify
+        name: Verify unchanged bundle after tests
+        if: ${{ success() && steps.plan.outputs.action == 'publish' }}
+        env:
+          RELEASE_RECORD_SHA256: ${{ steps.plan.outputs.record_sha256 }}
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import { createHash } from 'node:crypto';
+          import { readFileSync } from 'node:fs';
+          import { join } from 'node:path';
+          const bundle = join(process.env.RUNNER_TEMP, 'release', 'bundle');
+          const bytes = readFileSync(join(bundle, 'release-plan.json'));
+          assert.match(process.env.RELEASE_RECORD_SHA256, /^[a-f0-9]{64}$/);
+          assert.equal(createHash('sha256').update(bytes).digest('hex'), process.env.RELEASE_RECORD_SHA256);
+          const record = JSON.parse(bytes);
+          assert.equal(record.action, 'publish');
+          assert.equal(record.release.tarball.file, 'package.tgz');
+          const tarball = readFileSync(join(bundle, 'package.tgz'));
+          assert.equal(tarball.length, record.release.tarball.size);
+          assert.equal('sha512-' + createHash('sha512').update(tarball).digest('base64'), record.release.tarball.integrity);
+          NODE
+      - id: upload
+        if: ${{ success() && steps.plan.outputs.action == 'publish' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/release/bundle/release-plan.json
+            ${{ runner.temp }}/release/bundle/package.tgz
+          if-no-files-found: error
+          overwrite: false
+          archive: true
 
-  # Publish in the SAME run. A GitHub Release created with GITHUB_TOKEN never
-  # triggers other workflows (`on: release` stays silent), so publishing must be
-  # chained here rather than listening for the release event.
   publish:
-    needs: release-please
-    if: ${{ needs.release-please.outputs.release_created == 'true' }}
-    runs-on: ubuntu-latest
+    needs: gate
+    if: ${{ github.repository == 'thunderock/thunderkit' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.gate.result == 'success' && needs.gate.outputs.action == 'publish' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     permissions:
-      contents: read
+      contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - id: environment
+        name: Initialize isolated configuration paths
+        run: |
+          printf '%s\n' \
+            "npm_config_userconfig=$RUNNER_TEMP/npm-userconfig" \
+            "npm_config_globalconfig=$RUNNER_TEMP/npm-globalconfig" \
+            "npm_config_cache=$RUNNER_TEMP/npm-cache" \
+            "GH_CONFIG_DIR=$RUNNER_TEMP/gh-config" \
+            >> "$GITHUB_ENV"
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ needs.release-please.outputs.tag_name }}
-      - uses: actions/setup-node@v4
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+          set-safe-directory: false
+      - id: node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-      - run: npm install -g npm@latest
-      - name: Verify the pack contents (skills + bin, no repo noise)
-        run: npm pack --dry-run
-      - name: Publish to npm (OIDC trusted publishing, public)
-        run: npm publish --provenance --access public
+          package-manager-cache: false
+      - id: python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - id: npm
+        name: Prepare isolated npm CLI
+        run: |
+          umask 077
+          : > "$npm_config_userconfig"
+          : > "$npm_config_globalconfig"
+          prefix="$(mktemp -d "$RUNNER_TEMP/npm-cli.XXXXXX")"
+          cd "$RUNNER_TEMP"
+          npm install --prefix "$prefix" --ignore-scripts --no-audit --no-fund --package-lock=false npm@11.19.1
+          printf '%s\n' "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+      - id: tools
+        name: Verify tools and source
+        run: |
+          node -e 'if (process.versions.node.split(".")[0] !== "24") process.exit(1)'
+          test "$(npm --version)" = '11.19.1'
+          python3 -c 'import sys; assert sys.version_info[:2] == (3, 12)'
+          for tool in git gh make; do command -v "$tool" > /dev/null; done
+          api_help="$(gh api --help)"
+          for flag in --include --method; do [[ "$api_help" == *"$flag"* ]]; done
+          release_help="$(gh release create --help)"
+          for flag in --repo --verify-tag --target --title --generate-notes --prerelease --latest; do [[ "$release_help" == *"$flag"* ]]; done
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+      - id: handoff
+        name: Require exact artifact identity
+        env:
+          RELEASE_ARTIFACT_ID: ${{ needs.gate.outputs.artifact_id }}
+          RELEASE_RECORD_SHA256: ${{ needs.gate.outputs.record_sha256 }}
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          assert.match(process.env.RELEASE_ARTIFACT_ID, /^[1-9][0-9]*$/);
+          assert.match(process.env.RELEASE_RECORD_SHA256, /^[a-f0-9]{64}$/);
+          NODE
+      - id: download
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          artifact-ids: ${{ needs.gate.outputs.artifact_id }}
+          path: ${{ runner.temp }}/release-bundle
+          merge-multiple: true
+          digest-mismatch: error
+      - id: publish
+        name: Publish the verified tarball
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_RECORD_SHA256: ${{ needs.gate.outputs.record_sha256 }}
+        run: node tools/release/publish.mjs --bundle "$RUNNER_TEMP/release-bundle"

.gitignore

@@ -2,15 +2,24 @@
 __pycache__/
 *.pyc
 
-# thunderkit lane execution is machine-local (worktrees + dispatch run records)
-.thunderkit/runs/
+# Repository-local context
+.thunderkit/*
+!.thunderkit/NORTH_STAR.md
+!.thunderkit/PHILOSOPHY.md
+!.thunderkit/config.json
 wt-*/
 
 # macOS
 .DS_Store
 
-# oh-my-claudecode / harness state written by tk-test CLI probes — never ours to commit
+# Local tool state
+.omo/
+.omo-tmp/
+.omh/
 .omc/
+.planning/
+node_modules/
+*.tgz
 
 # Note: site/_site IS committed (GitHub Pages serves it, and tests/site_drift.py
-# gates the committed skills.json against skills/ on disk).
+# checks the complete public file set, contents and local links).