Repository navigation
feat: adopt cross-repo tooling (migration safety, hooks, config schema, verify-all) - #141
Merged
Merged
Conversation
github-actions
Bot
added
area: scripts
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+21
to
+28
| const stdout = execFileSync(cmd, args, { | ||
| encoding: "utf-8", | ||
| cwd, | ||
| timeout, | ||
| input, | ||
| env: { ...process.env, NO_COLOR: "1", ...env }, | ||
| stdio: ["pipe", "pipe", "pipe"], | ||
| }); |
Introduce scripts/lib (common.sh, colors.sh, pipeline-config.js) so scripts share one set of log helpers, project-root resolution, and a reader for .claude/pipeline.config.json, plus a Vitest harness under scripts/__tests__ and the pnpm test/verify/validate scripts. Adapted from the Aurelius scripts/lib pattern. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…eline.config.json Drop the duplicated color and log definitions from every script. run-tests.sh now enforces tdd.coverageThreshold via the json-summary reporter, security-scan.sh honors security.audit.level/failOnVulnerability/checkLockfile, load-test.sh defaults VUs, duration and k6 thresholds from testing.*, and check-types.sh reports 'any' usage when qualityGate.noAnyTypes is set. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
check-destructive-migrations.js scans migration SQL for DROP/TRUNCATE/unbounded DELETE after stripping comments, with a per-file allowlist marker, and generate-migration.sh runs it before applying when database.blockDestructiveMigrations is on. schema-drift.ts compares the Drizzle schema against a production database in lenient (PR gate) or strict (daily) mode; schema-drift.yml and schema-applied.yml ship as generated-project workflows. Adapted from the Bridleway migration-safety scripts. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…uality reminders PreToolUse: secret-guard blocks staging .env/.dev.vars/key files and forced adds; prod-db-guard blocks drizzle-kit push and DROP/TRUNCATE against production. PostToolUse: coverage-check, migration-safety-reminder and quality-gate-reminder. Hooks read the stdin JSON contract, fail open on malformed input, and are covered by scripts/__tests__/hooks.test.js. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Strict draft 2020-12 schema for every section of pipeline.config.json, and validate-pipeline-config.js (ajv) with structural checks the schema cannot express: phase dependency targets, cycles, reachability, defaultTarget in targets, and coverage-threshold consistency. The config now points $schema at the project schema. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Reports required software, optional tools, Claude Code plugins and project state as [PASS]/[FAIL]/[SKIP]/[INFO] lines with a summary block and --json. The claude CLI and plugins never block readiness. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
check-doc-counts.sh fails when Markdown claims about agent, skill, script or command counts disagree with disk. verify-all.sh runs every local check with --json/--ci/--skip/--include and skips checks whose subject is absent; it backs the new /verify-all and /ci slash commands. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…pts, install migration checks Generated Cloudflare projects disable workers_dev and preview URLs in production, stamp COMMIT_SHA on deploy, get deploy:staging/deploy:production scripts, and refuse a bare deploy. Every project now ships a pnpm-workspace.yaml allowing esbuild (and workerd) install scripts under pnpm 10 through 12, pins packageManager, and receives the destructive-DDL check, schema-drift script, and both schema workflows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add a script-tests job (pnpm test, schema validation, doc counts) and extend the structural job to hooks and JS scripts. The husky pre-commit hook now also checks JS syntax, settings.json, the config schema, and doc counts. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add scripts/README.md, describe the hooks and /verify-all and /ci in CLAUDE.md, and correct the plugin and script counts that had drifted. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Drop the PROJECT_ROOT variable left unused after the shared-lib refactor, add shell directives to the sourced lib files, guard the cd in verify-all, and annotate the hook lib variable consumed by sourcing hooks. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
PAMulligan
force-pushed
the
feature/tooling-adoption
branch
from
September 9, 2026 20:40
e17847d to
68abf49
Compare
3 of 4 tasks
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts tooling patterns from sibling repos (Aurelius, Bridleway, Maecenas, FantasyPlanner, optia-backend) that close gaps Nerva's own config and docs already promised but nothing enforced.
check-destructive-migrations.jsscans migration SQL for DROP/TRUNCATE/unbounded DELETE with a per-file allowlist marker;generate-migration.shruns it before applying. Generated projects getschema-drift.ts(Drizzle schema vs production DB, lenient PR gate and strict daily mode) plusschema-drift.ymlandschema-applied.ymlworkflows that degrade gracefully without thePROD_DATABASE_URLsecret..claude/settings.jsonwires a secret guard and a prod-DB guard (PreToolUse, blocking) and coverage, migration-safety and quality-gate reminders (PostToolUse).scripts/libreplaces the duplicated color/log blocks; scripts now readtdd.coverageThreshold,security.audit.*,testing.loadTest*anddatabase.blockDestructiveMigrationsfrompipeline.config.json, which were previously inert.pipeline.config.jsonand an ajv validator with phase-graph cycle/reachability checks.check-doc-counts.sh(fixes the plugin/script count drift in CLAUDE.md and README),check-prerequisites.sh, andverify-all.shbacking new/verify-alland/cicommands.scripts/__tests__, run by a newscript-testsCI job and extended pre-commit hook.workers_dev/preview_urls, stampsCOMMIT_SHA, getsdeploy:staging/deploy:production, refuses a bare deploy.pnpm-workspace.yamlallowing esbuild/workerd install scripts (onlyBuiltDependenciesfor pnpm 10,allowBuildsfor pnpm 11+) and pinpackageManager. Without it, project generation fails under pnpm 12 withERR_PNPM_IGNORED_BUILDSoutside the repo checkout.Docs:
scripts/README.md,docs/api-development/migration-safety.md,docs/onboarding/hooks.md.Test plan
pnpm test: 264 tests, 8 files passscripts/verify-all.sh: all applicable checks pass on the framework repotemplates/snippets:pnpm typecheckpasses under cloudflare, node and lambda tsconfigs--cloudflareand--nodeprojects (on pnpm 12): install,pnpm typecheck,pnpm test,pnpm db:check-destructivepass;pnpm run deployis refused--lambda --dry-runkeepsdeploy.ymlalongside the two schema workflowsscript-testsandgenerated-projectsjobs green on this PR🤖 Generated with Claude Code