[policy] Make CI reproducible from clean clones

Change-Id: I7f656d1c5432ab839eebb4bc44b0815671750a5e

Author: heimanba

package.json

@@ -34,7 +34,8 @@
 		"dev": "bun run dev:server & bun run dev:webui & wait",
 		"dev:webui": "bun run --cwd apps/webui dev",
 		"dev:server": "bun run --cwd apps/server dev",
-		"typecheck": "bun run typecheck:scripts && bun run typecheck:sdk && bun run typecheck:cli && bun run typecheck:playbooks && bun run typecheck:playground && bun run typecheck:webui && bun run typecheck:server",
+		"typecheck": "bun run build:sdk && bun run typecheck:scripts && bun run typecheck:sdk && bun run typecheck:cli && bun run typecheck:playbooks && bun run typecheck:playground && bun run typecheck:webui && bun run typecheck:server",
+		"build:sdk": "bun run --cwd packages/sdk build",
 		"typecheck:scripts": "tsc -p scripts/tsconfig.json --noEmit",
 		"typecheck:sdk": "bun run --cwd packages/sdk typecheck",
 		"typecheck:cli": "bun run --cwd packages/cli typecheck",

scripts/open-source.test.ts

@@ -24,6 +24,14 @@ function publicWorktreeFiles(): string[] {
 		.filter((file) => file && isReadableRegularFile(resolve(root, file)));
 }
 
+function publicWorktreeFilesMatching(predicate: (file: string) => boolean): string[] {
+	return publicWorktreeFiles().filter(predicate);
+}
+
+function isVisiblePath(file: string): boolean {
+	return file.split("/").every((segment) => !segment.startsWith("."));
+}
+
 function output(command: string[]): string {
 	const result = Bun.spawnSync(command, { cwd: root, stdout: "pipe", stderr: "pipe" });
 	if (result.exitCode !== 0) throw new Error(result.stderr.toString());
@@ -45,7 +53,9 @@ describe("open-source repository invariants", () => {
 	});
 
 	test("published packages have no runtime dependency on private workspaces", () => {
-		const packageFiles = output(["rg", "--files", "-g", "package.json"]).trim().split("\n").filter(Boolean);
+		const packageFiles = publicWorktreeFilesMatching(
+			(file) => isVisiblePath(file) && (file === "package.json" || file.endsWith("/package.json")),
+		);
 		const manifests = packageFiles.map(
 			(file) =>
 				JSON.parse(readFileSync(resolve(root, file), "utf8")) as {
@@ -91,7 +101,7 @@ describe("open-source repository invariants", () => {
 	});
 
 	test("all local Markdown links resolve", () => {
-		const files = output(["rg", "--files", "-g", "*.md"]).trim().split("\n").filter(Boolean);
+		const files = publicWorktreeFilesMatching((file) => isVisiblePath(file) && file.endsWith(".md"));
 		const missing: string[] = [];
 		for (const file of files) {
 			const body = readFileSync(resolve(root, file), "utf8");
@@ -106,10 +116,9 @@ describe("open-source repository invariants", () => {
 	});
 
 	test("third-party GitHub Actions are pinned to full commit SHAs", () => {
-		const workflows = output(["rg", "--files", ".github/workflows", "-g", "*.yml", "-g", "*.yaml"])
-			.trim()
-			.split("\n")
-			.filter(Boolean);
+		const workflows = publicWorktreeFilesMatching(
+			(file) => file.startsWith(".github/workflows/") && (file.endsWith(".yml") || file.endsWith(".yaml")),
+		);
 		const unpinned: string[] = [];
 		for (const file of workflows) {
 			const body = readFileSync(resolve(root, file), "utf8");

scripts/verify.test.ts

@@ -45,6 +45,17 @@ describe("verification profiles", () => {
 	test("rejects an explicit BASE that is not a commit", () => {
 		expect(() => resolveComparisonBase("not-a-real-commit")).toThrow("is not a commit");
 	});
+
+	test("falls back when a push base disappeared after a GitHub history rewrite", () => {
+		const previous = process.env.GITHUB_ACTIONS;
+		process.env.GITHUB_ACTIONS = "true";
+		try {
+			expect(resolveComparisonBase("not-a-real-commit")).toBeTruthy();
+		} finally {
+			if (previous === undefined) delete process.env.GITHUB_ACTIONS;
+			else process.env.GITHUB_ACTIONS = previous;
+		}
+	});
 });
 
 describe("publish manifest", () => {

scripts/verify.ts

@@ -54,8 +54,11 @@ function gitCommitExists(ref: string): boolean {
 
 export function resolveComparisonBase(explicitBase = process.env.BASE): string | undefined {
 	if (explicitBase && !/^0+$/.test(explicitBase)) {
-		if (!gitCommitExists(explicitBase)) throw new Error(`Verification BASE '${explicitBase}' is not a commit.`);
-		return explicitBase;
+		if (gitCommitExists(explicitBase)) return explicitBase;
+		if (process.env.GITHUB_ACTIONS !== "true") {
+			throw new Error(`Verification BASE '${explicitBase}' is not a commit.`);
+		}
+		console.warn(`Verification BASE '${explicitBase}' is unavailable after a history rewrite; using a local fallback.`);
 	}
 	return output(["git", "merge-base", "HEAD", "origin/HEAD"]) || output(["git", "rev-parse", "HEAD^"]) || undefined;
 }