Skip to content

docs(ado-script): fix garbled text and bundle drift in ado-script.md #2151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
github-actions wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs(ado-script): fix garbled text and bundle drift in ado-script.md #2151

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 20 additions & 5 deletions docs/ado-script.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ pipeline** as runtime helpers. Today it produces the following shipped bundles:
the target tip at depth 1. Cross-org repositories are partitioned into a
separate trusted credential scope and passed with validated
organization/project/repository coordinates. The checkout remote must match
those coordinates exactly before the Bearer reaches REST or git; mismatch or
those coordinates exactly before attempting REST or git; mismatch or
preparation failure stops the trusted task before Agent/executor execution.
Same-org per-dir failures remain isolated warnings. The bearer remains
shell-local or in masked `SYSTEM_ACCESSTOKEN` env and spawned-git
Expand Down Expand Up @@ -207,7 +207,7 @@ Resolution is single-pass: nested markers inside an inlined body are not
re-expanded.

The bundle lives at `import.js` and ships in the same
`ado-script.zip` release asset as `gate.js` and the ten
`ado-script.zip` release asset as `gate.js` and the nine
`exec-context-*.js` bundles listed in the workspace layout, so
pipelines download it through the same Agent-job asset flow.
`import.js` uses only the Node standard library, so the ncc bundle is
Expand Down Expand Up @@ -654,6 +654,18 @@ scripts/ado-script/
│ ├── prepare-pr-base/ # prepare-pr-base.js entry point + create-pull-request base-ref fetch/deepen
│ │ ├── index.ts # main(): fetch/deepen target branch + set origin/HEAD so mcp.rs finds a diff base
│ │ └── __tests__/ # unit tests for fetch/deepen + origin/HEAD + benign-failure paths
│ ├── ado-proxy/ # ado-proxy.js entry point + credential-isolated ADO policy proxy
│ │ ├── index.ts # main(): starts the trusted HTTP proxy server
│ │ ├── server.ts # HTTP server, request routing
│ │ ├── policy.ts # scope/capability policy evaluation
│ │ ├── scope.ts # organization-relative current/additional scope index
│ │ ├── catalog.ts # versioned deny-by-default read-operation catalog
│ │ ├── catalog.gen.json # generated by `cargo run -- export-ado-proxy-catalog`
│ │ ├── route.ts / upstream.ts / response.ts / headers.ts / token.ts / config.ts / api-version.ts / ca.ts / log.ts
│ │ └── *.test.ts # per-module unit tests + `proxy.e2e.test.ts`
│ ├── azure-wif-refresh/ # azure-wif-refresh.js entry point + renewable WIF assertion sidecar
│ │ ├── index.ts # main(): rotate a private token file for user-defined stdio MCP servers
│ │ └── __tests__/ # unit tests for rotation and isolation behaviour
│ ├── trigger-e2e/ # test-only: FACT_META gate-spec table + trigger-evaluation E2E scenarios (not a bundle)
│ │ ├── gate-spec.ts # FACT_META mirror of Rust Fact::ALL; drift-guarded by export-fact-catalog + fact-catalog.gen.json
│ │ ├── fact-catalog.gen.json # generated by `cargo run -- export-fact-catalog`; deep-compared by gate-spec.test.ts
Expand All @@ -675,7 +687,9 @@ scripts/ado-script/
├── conclusion.js # ncc bundle output (gitignored)
├── approval-summary.js # ncc bundle output (gitignored)
├── github-app-token.js # ncc bundle output (gitignored)
└── prepare-pr-base.js # ncc bundle output (gitignored)
├── prepare-pr-base.js # ncc bundle output (gitignored)
├── ado-proxy.js # ncc bundle output (gitignored)
└── azure-wif-refresh.js # ncc bundle output (gitignored)
```

The release workflow (`.github/workflows/release.yml`) runs
Expand All @@ -685,8 +699,9 @@ captures every bundle, including `gate.js`, `import.js`,
`exec-context-manual.js`, `exec-context-pipeline.js`,
`exec-context-ci-push.js`, `exec-context-workitem.js`,
`exec-context-schedule.js`, `exec-context-pr-checks.js`,
`exec-context-repo.js`, `conclusion.js`, `approval-summary.js`, and
`github-app-token.js` — into the
`exec-context-repo.js`, `conclusion.js`, `approval-summary.js`,
`github-app-token.js`, `prepare-pr-base.js`, `ado-proxy.js`, and
`azure-wif-refresh.js` — into the
`ado-script.zip` release asset. Pipelines download that asset at
runtime by URL pinned to the compiler's `CARGO_PKG_VERSION`, verify
its SHA-256 against the `checksums.txt` asset, then extract.
Expand Down