Let the reusable sync workflow install the pm CLI from a caller-chosen npm project directory

Merged
UN
8d ago
+237-17

Callers without a root package.json fail at dependency installation even when their pinned pm CLI lives in an npm project below the repository root. The reusable sync workflow now accepts npm-project-dir (default .); pm-rust can pass npm-project-dir: tests/oracle.

The workflow validates the directory after checkout and before npm caching/install: relative path, no parent segments, canonical workspace containment and package.json required. NUL-delimited canonical-path reads preserve symlink targets exactly. The selected project supplies npm installation, the CLI PATH entry, SDK resolution and the post-import script. Git and tracker operations stay at the repository root; the publication allowlist and path predicate are byte-identical.

Contract tests execute shell extracted from the real workflow. They compare default output files byte for byte with the legacy commands, install from a subdirectory without a root manifest, reject invalid paths and replay a nonempty import with the real pinned CLI/SDK and packed extension.

Validation:

  • Focused tests: 13/13 passed; zero failures, skips, cancellations or todo.
  • Nine behavioral controls: 18 expected failures, zero unexpected passes; each command/validator revert is recorded in the pm item, including the symlink-newline regression.
  • npm run release:check and bun run release:check both exited 0: 676/676 tests each, with zero failures, skips, cancellations or todo. Each ran with a fresh HOME and global/system Git configuration disabled. Both measured exact coverage across 13 authored modules: 10,040/10,040 lines and statements, 255/255 functions, and 2,832/2,832 branches. Existing thresholds and dependency pins are unchanged.

Closes #129.

PM item: pm-github-z5z1.

Summary by Sourcery

Enable reusable sync workflows to install and run the pinned pm CLI from a caller-selected npm project while keeping synchronization and publication rooted at the repository.

New Features:

  • Allow callers to select a validated npm project directory for dependency installation, CLI resolution, SDK access, and post-import scripts.
  • Preserve repository-root Git, tracker, and publication behavior when the npm project is located in a subdirectory.

Bug Fixes:

  • Support reusable workflow callers without a root package.json by installing dependencies from a nested npm project.
  • Reject unsafe, out-of-workspace, malformed, or manifest-less npm project paths before caching or installation.

Enhancements:

  • Update caller documentation and examples to describe the npm project directory contract and nested-project usage.

Documentation:

  • Document the new npm-project-dir input, its validation requirements, lockfile requirements, and nested caller configuration.

Tests:

  • Add workflow contract coverage for default and nested npm projects, invalid paths, symlink and newline edge cases, root publication scope, and post-import behavior.

Chores:

  • Record the feature work and its history in the project management metadata.

Summary by cubic

Callers without a root package.json fail at dependency installation even when their pinned pm CLI lives in an npm project below the repository root. The reusable sync workflow now accepts npm-project-dir (default .) and uses that directory for npm ci --ignore-scripts, the CLI node_modules/.bin PATH entry, SDK resolution, and the caller post-import script. Git and tracker operations stay at the repository root and the publication allowlist is unchanged. Closes #129.

Details

  • The directory is validated after checkout and before npm caching/install: relative path, no .. segments, canonical workspace containment, and a package.json required.
  • NUL-delimited canonical-path reads preserve symlink targets exactly, rejecting a symlink target whose name ends in a newline.
  • Replaced a parenthesized Bash traversal regex with an equivalent case path-segment pattern so the publication auditor no longer misreads it as publish invocations.