diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 0000000..7d22894 --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,23 @@ +{ + "extraKnownMarketplaces": { + "compound-engineering-plugin": { + "source": { + "source": "github", + "repo": "EveryInc/compound-engineering-plugin" + } + }, + "integral-productivity-internal": { + "source": { + "source": "github", + "repo": "Integral-Productivity/marketplace-internal" + } + } + }, + "enabledPlugins": { + "compound-engineering@compound-engineering-plugin": true, + "integral-productivity-engineering@integral-productivity-internal": true, + "software-architecture@integral-productivity-internal": true, + "product-architecture@integral-productivity-internal": true, + "lean-management@integral-productivity-internal": true + } +} diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..b4d0de8 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# Default code-owner. Tier 3 standard from devops-excellence (ADR-001). +* @kraigparkinson diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..2f0a901 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,20 @@ +Closes # + +## Summary + +- +- + +## Test plan + +- [ ] +- [ ] + + diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..9af9e65 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,17 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + day: monday + time: "08:00" + timezone: America/Los_Angeles + open-pull-requests-limit: 10 + labels: + - dependencies + - github-actions + commit-message: + prefix: chore(deps) + include: scope diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml new file mode 100644 index 0000000..96fd5ef --- /dev/null +++ b/.github/workflows/auto-merge.yml @@ -0,0 +1,48 @@ +# Auto-merge caller for Tier 3 plugin repos, which call the PUBLIC +# reusable-workflows host. This is deliberately NOT identical to the Tier 1/2 +# templates: those call the PRIVATE devops-excellence reusable and forward the +# whole-vault OP_SERVICE_ACCOUNT_TOKEN, whereas the public reusable declares +# only the SCOPED OP_AUTOMERGE_PUBLIC_TOKEN (read-only on the ip-automation-public +# vault, per ADR-045 / ip-bots#207). GitHub also blocks a public repo from +# calling a private reusable workflow, which is why Tier 3 uses the public host. +# Passing OP_SERVICE_ACCOUNT_TOKEN here is an UNDECLARED secret and fails the run +# at compile time (startup_failure — "workflow file issue"). +# +# The tier3-claude-plugin and tier3-omnifocus-plugin copies of this file are +# byte-identical by design (the fitness spec sources one governance set for both). +# +# `closed` is included in pull_request.types (added per devops-excellence#519) +# so the reusable's close-linked-issues job can fire post-merge. That job +# mints an ip-labeler token (issues:write) — ip-automerge deliberately holds +# none, per ip-bots ADR-026 — via a SECOND scoped public token, +# OP_LABELER_PUBLIC_TOKEN, mirroring OP_AUTOMERGE_PUBLIC_TOKEN's ADR-045 +# pattern but for the ip-labeler PEM. See ADR-075. +# +# A THIRD scoped public token, OP_AUDITOR_PUBLIC_TOKEN, mints an +# ip-org-auditor token (read-only) that powers ONLY the resolve step inside +# close-linked-issues — resolving closingIssuesReferences needs both +# pull-requests:read and issues:read, which neither github.token nor +# ip-labeler alone carries. See devops-excellence#536-538 and ADR-078. +# +# `labeled`/`unlabeled` are included (devops-excellence#520 / ADR-080) so the +# reusable's hold-for-review check re-evaluates when that label is applied to +# or removed from an already-open PR, not only at open/push time. + +name: Auto-Merge + +on: + pull_request: + types: [opened, synchronize, reopened, closed, labeled, unlabeled] + +permissions: + contents: write + pull-requests: write + +jobs: + auto-merge: + name: Auto-Merge + uses: Integral-Productivity/reusable-workflows/.github/workflows/reusable-auto-merge.yml@v1 + secrets: + OP_AUTOMERGE_PUBLIC_TOKEN: ${{ secrets.OP_AUTOMERGE_PUBLIC_TOKEN }} + OP_LABELER_PUBLIC_TOKEN: ${{ secrets.OP_LABELER_PUBLIC_TOKEN }} + OP_AUDITOR_PUBLIC_TOKEN: ${{ secrets.OP_AUDITOR_PUBLIC_TOKEN }} diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml new file mode 100644 index 0000000..418c38d --- /dev/null +++ b/.github/workflows/claude.yml @@ -0,0 +1,36 @@ +# Standard @claude on-demand bot caller. See tier1/.github/workflows/claude.yml +# for the rationale on the `if:` gate — it is required, do not remove it. + +name: Claude Code + +# REQUIRED — mirrors reusable-claude.yml's permissions. A workflow_call reusable +# can only USE permissions the caller GRANTS; without this block the validator +# rejects the call at startup (0-second startup_failure on every trigger). See +# tier1/.github/workflows/claude.yml for the full rationale. +permissions: + contents: write + pull-requests: write + issues: write + id-token: write + actions: read + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + issues: + types: [opened, assigned] + pull_request_review: + types: [submitted] + +jobs: + claude: + if: | + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + uses: Integral-Productivity/reusable-workflows/.github/workflows/reusable-claude.yml@v1 + secrets: + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}