Files

.github/workflows/ci.yml

Repository

koment

workspace

1 ---

2 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

3 name: CI

5 on:

6 push:

7 branches:

8 - main

9 pull_request:

10 branches:

11 - main

12 merge_group:

13 workflow_dispatch:

15 concurrency:

16 group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

17 cancel-in-progress: ${{ github.event_name == 'pull_request' }}

19 permissions:

20 contents: read

22 env:

23 MISE_DISABLE_TOOLS: github:koment-dev/koment

25 jobs:

26 quality:

27 name: quality

28 runs-on: ubuntu-24.04

29 permissions:

30 contents: read

31 steps:

32 - name: Checkout

33 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

34 with:

35 persist-credentials: false

37 - name: Cache Go

38 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

39 with:

40 path: |

41 ~/.cache/go-build

42 ~/go/pkg/mod

43 key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}

44 restore-keys: ${{ runner.os }}-go-

46 - name: Setup Mise

47 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

48 with:

49 experimental: true

50 install_args: --locked

52 - name: Check formatting

53 run: mise run fmt-check

55 - name: Check module metadata

56 run: mise run tidy-check

58 - name: Run go vet

59 run: mise run vet

61 - name: Check generated files

62 run: mise run generate-check

64 - name: Check repository layout

65 run: mise run layout-check

67 - name: Check annotations

68 run: mise run annotations

70 - name: Check maintained workspace

71 working-directory: examples/annotated-workspace

72 env:

73 EXPECTED: "8 annotations across 3 files: 5 ok, 1 ambiguous, 1 drifted, 1 orphaned"

74 run: |

75 tally="$(go run ../../cmd/koment check | tail -1)"

76 echo "$tally"

77 test "$tally" = "$EXPECTED"

78 for kind in why gotcha invariant anti-pattern; do

79 grep -q "^ type: $kind\$" .koment/annotations/*.yaml

80 done

82 - name: Check comment policy

83 run: mise run comments

85 - name: Check agent adapters

86 run: mise run agent-policy

88 - name: Lint and audit workflows

89 run: mise run workflow-lint

91 - name: Test release helpers

92 run: mise run release-helper-test

94 - name: Run govulncheck

95 run: mise run vulncheck

97 lint:

98 name: lint

99 runs-on: ubuntu-24.04

100 permissions:

101 contents: read

102 steps:

103 - name: Checkout

104 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

105 with:

106 persist-credentials: false

107

108 - name: Cache Go

109 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

110 with:

111 path: |

112 ~/.cache/go-build

113 ~/go/pkg/mod

114 key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}

115 restore-keys: ${{ runner.os }}-go-

116

117 - name: Setup Mise

118 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

119 with:

120 experimental: true

121 install_args: --locked

122

123 - name: Cache golangci-lint

124 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

125 with:

126 path: ~/.cache/golangci-lint

127 key: ${{ runner.os }}-golangci-lint-${{ hashFiles('go.sum', '.golangci.yml', '.mise/mise.lock') }}

128

129 - name: Run linter

130 run: mise run lint

131

132 test:

133 name: test

134 runs-on: ubuntu-24.04

135 permissions:

136 contents: read

137 steps:

138 - name: Checkout

139 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

140 with:

141 persist-credentials: false

142

143 - name: Cache Go

144 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

145 with:

146 path: |

147 ~/.cache/go-build

148 ~/go/pkg/mod

149 key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}

150 restore-keys: ${{ runner.os }}-go-

151

152 - name: Setup Mise

153 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

154 with:

155 experimental: true

156 install_args: --locked

157

158 - name: Run tests

159 run: mise run test

160

161 - name: Fuzz the parsers

162 env:

163 KOMENT_FUZZTIME: 30s

164 run: mise run fuzz

165

166 - name: Report coverage

167 run: go tool cover -func=coverage.out | tail -1

168

169 container:

170 name: container

171 runs-on: ubuntu-24.04

172 permissions:

173 contents: read

174 steps:

175 - name: Checkout

176 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

177 with:

178 persist-credentials: false

179

180 - name: Setup Mise

181 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

182 with:

183 experimental: true

184 install: false

185

186 - name: Resolve Go version

187 id: tools

188 run: echo "go=$(mise config get tools.go)" >> "$GITHUB_OUTPUT"

189

190 - name: Setup Buildx

191 uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

192

193 - name: Build image

194 uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0

195 with:

196 context: .

197 push: false

198 load: true

199 tags: koment:ci

200 build-args: GO_VERSION=${{ steps.tools.outputs.go }}

201 cache-from: type=gha

202 cache-to: type=gha,mode=max

203

204 - name: Run binary

205 run: docker run --rm koment:ci help

206

207 - name: Exercise unified service

208 env:

209 SYNCHRONIZATION_TOKEN: ${{ secrets.GITHUB_TOKEN }}

210 run: |

211 set -euo pipefail

212 token="$RUNNER_TEMP/koment-synchronization-token"

213 printf '%s' "$SYNCHRONIZATION_TOKEN" > "$token"

214 chmod 0444 "$token"

215 docker run --detach --name koment-ci-service \

216 --publish 127.0.0.1:18080:8080 \

217 --mount type=bind,src="$PWD/testdata/server/repositories.yaml",dst=/config/repositories.yaml,readonly \

218 --mount type=bind,src="$token",dst=/config/synchronization-token,readonly \

219 koment:ci serve --config /config/repositories.yaml \

220 --github-token-file /config/synchronization-token \

221 --listen 0.0.0.0:8080 --trusted-proxies 127.0.0.1/32

222 cleanup() {

223 docker logs koment-ci-service

224 docker rm --force koment-ci-service

225 rm -f "$token"

226 }

227 trap cleanup EXIT

228 for attempt in $(seq 1 30); do

229 if curl --fail --silent http://127.0.0.1:18080/readyz; then

230 break

231 fi

232 if [ "$attempt" -eq 30 ]; then

233 exit 1

234 fi

235 sleep 2

236 done

237 curl --fail --silent http://127.0.0.1:18080/livez

238 test "$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:18080/r/koment/)" = 401

239

240 - name: Setup Helm

241 uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1

242

243 - name: Create Kind cluster

244 uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0

245

246 - name: Exercise Helm release

247 env:

248 SYNCHRONIZATION_TOKEN: ${{ secrets.GITHUB_TOKEN }}

249 run: |

250 set -euo pipefail

251 diagnostics() {

252 kubectl get deployments,pods,services --all-namespaces

253 kubectl describe pods --namespace default

254 kubectl logs deployment/koment-koment --namespace default || true

255 }

256 trap diagnostics ERR

257 kind load docker-image koment:ci --name chart-testing

258 kubectl create secret generic koment-synchronization \

259 --from-literal=github-token="$SYNCHRONIZATION_TOKEN"

260 helm upgrade --install koment distribution/helm/koment \

261 --set image.repository=koment \

262 --set-string image.tag=ci \

263 --set image.pullPolicy=Never \

264 --set github.existingSecret=koment-synchronization \

265 --wait --timeout 5m

266 helm test koment --logs --timeout 2m

267

268 setup-action:

269 name: setup-action (${{ matrix.os }})

270 runs-on: ${{ matrix.os }}

271 permissions:

272 contents: read

273 strategy:

274 fail-fast: false

275 matrix:

276 os:

277 - ubuntu-24.04

278 - macos-15

279 steps:

280 - name: Checkout

281 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

282 with:

283 persist-credentials: false

284

285 - name: Explain why the published release is not installed here

286 if: github.event_name == 'push'

287 run: |

288 echo "::notice::A push to main can be a release commit, whose tag becomes 'latest'" \

289 "minutes before its archives are uploaded. The release workflow verifies its own" \

290 "output once publication finishes."

291

292 - name: Install koment

293 id: setup

294 if: github.event_name != 'push'

295 uses: ./

296

297 - name: Verify installation

298 if: github.event_name != 'push'

299 env:

300 INSTALLED_VERSION: ${{ steps.setup.outputs.version }}

301 run: |

302 command -v koment

303 koment version

304 test -n "$INSTALLED_VERSION"

305 koment version | grep -q "$INSTALLED_VERSION"

306

307 commit-lint:

308 name: commit-lint

309 runs-on: ubuntu-24.04

310 permissions:

311 contents: read

312 steps:

313 - name: Checkout

314 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

315 with:

316 persist-credentials: false

317 fetch-depth: 0

318

319 - name: Collect subjects

320 id: subjects

321 env:

322 EVENT_NAME: ${{ github.event_name }}

323 PR_TITLE: ${{ github.event.pull_request.title }}

324 MR_HEAD: ${{ github.event.merge_group.head_sha }}

325 MR_BASE: ${{ github.event.merge_group.base_sha }}

326 run: |

327 set -euo pipefail

328 tmp=$(mktemp)

329 trap 'rm -f "$tmp" "$tmp.new"' EXIT HUP INT TERM

330 case "$EVENT_NAME" in

331 pull_request)

332 printf '%s\n' "$PR_TITLE" >> "$tmp"

333 git log --format=%s "$GITHUB_SHA" ^origin/main >> "$tmp"

334 ;;

335 merge_group)

336 git log --format=%s "$MR_HEAD" ^"$MR_BASE" >> "$tmp"

337 ;;

338 push)

339 git log --format=%s "$GITHUB_SHA" ^"$GITHUB_SHA~1" >> "$tmp"

340 git log --format=%s "$GITHUB_SHA" ^origin/main >> "$tmp"

341 ;;

342 esac

343 : > "$tmp.new"

344 sort -u "$tmp" | while IFS= read -r line; do

345 [ -z "$line" ] && continue

346 case "$line" in

347 'Merge '*) continue ;;

348 esac

349 printf '%s\n' "$line" >> "$tmp.new"

350 done

351 mv "$tmp.new" "$tmp"

352 { echo "subjects<<EOF"; cat "$tmp"; echo "EOF"; } >> "$GITHUB_OUTPUT"

353

354 - name: Lint subjects

355 env:

356 SUBJECTS: ${{ steps.subjects.outputs.subjects }}

357 run: ./scripts/commitlint.sh <<< "$SUBJECTS"

358

359 windows-archive:

360 name: windows-archive (advisory)

361 runs-on: windows-2025

362 permissions:

363 contents: read

364 steps:

365 - name: Install the published Windows archive the way Scoop and WinGet do

366 if: github.event_name != 'push'

367 shell: pwsh

368 env:

369 KOMENT_SOURCE: koment-dev/koment

370 run: |

371 $ErrorActionPreference = 'Stop'

372

373

          $resolved = (Invoke-WebRequest -Uri "https://github.com/$env:KOMENT_SOURCE/releases/latest" -UseBasicParsing).BaseResponse.RequestMessage.RequestUri.AbsoluteUri

374 $tag = ($resolved -split '/')[-1]

375 $version = $tag.TrimStart('v')

376 if ($version -notmatch '^\d+\.\d+\.\d+') {

377 throw "could not resolve a koment release from $resolved"

378 }

379

380 $archive = "koment_${version}_windows_amd64.zip"

381 $base = "https://github.com/$env:KOMENT_SOURCE/releases/download/$tag"

382 $work = New-Item -ItemType Directory -Force -Path (Join-Path $env:RUNNER_TEMP 'koment-windows')

383

384 Write-Host "installing koment $version (windows/amd64)"

385 Invoke-WebRequest -Uri "$base/$archive" -OutFile (Join-Path $work $archive) -UseBasicParsing

386

          Invoke-WebRequest -Uri "$base/koment_${version}_checksums.txt" -OutFile (Join-Path $work 'checksums.txt') -UseBasicParsing

387

388 $listed = Select-String -Path (Join-Path $work 'checksums.txt') -Pattern " $([regex]::Escape($archive))$"

389 if (-not $listed) {

390 throw "$archive is not listed in the release checksum manifest"

391 }

392 $expected = ($listed.Line -split '\s+')[0]

393 $actual = (Get-FileHash -Path (Join-Path $work $archive) -Algorithm SHA256).Hash.ToLower()

394 if ($expected -ne $actual) {

395 throw "${archive}: expected $expected, got $actual"

396 }

397 Write-Host "${archive}: OK"

398

399 $extracted = Join-Path $work 'extracted'

400 Expand-Archive -Path (Join-Path $work $archive) -DestinationPath $extracted -Force

401 foreach ($member in @('koment.exe', 'LICENSE', 'README.md')) {

402 if (-not (Test-Path (Join-Path $extracted $member))) {

403 throw "$member is not at the root of $archive"

404 }

405 }

406 Write-Host 'archive root carries koment.exe, LICENSE and README.md'

407

408 $reported = (& (Join-Path $extracted 'koment.exe') version) -join ' '

409 Write-Host $reported

410 if ($reported -notmatch [regex]::Escape($version)) {

411 throw "koment.exe reported '$reported', which does not name $version"

412 }

413

414 helm:

415 name: helm

416 runs-on: ubuntu-24.04

417 permissions:

418 contents: read

419 steps:

420 - name: Checkout

421 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

422 with:

423 persist-credentials: false

424

425 - name: Setup Mise

426 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

427 with:

428 experimental: true

429 install_args: --locked

430

431 - name: Lint chart

432 run: mise run helm-lint

433

434 - name: Render supported modes

435 run: mise run helm-template

436

437 editor:

438 name: editor

439 runs-on: ubuntu-24.04

440 permissions:

441 contents: read

442 steps:

443 - name: Checkout

444 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

445 with:

446 persist-credentials: false

447

448 - name: Setup Mise

449 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

450 with:

451 experimental: true

452 install: false

453

454 - name: Install the pinned Go toolchain

455 run: |

456 set -euo pipefail

457 mise install go --locked

458 echo "$(mise where go)/bin" >> "$GITHUB_PATH"

459

460 - name: Cache cross-compilation

461 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

462 with:

463 path: |

464 ~/.cache/go-build

465 ~/go/pkg/mod

466 key: ${{ runner.os }}-go-cross-${{ hashFiles('go.sum') }}

467 restore-keys: ${{ runner.os }}-go-cross-

468

469 - name: Install locked editor tools

470 run: mise --cd integrations/editors/vscode install --locked

471

472 - name: Install editor packaging tools

473 run: mise --cd integrations/editors/vscode exec -- npm ci

474

475 - name: Test extension protocol

476 run: mise run extension-test

477

478 - name: Build the archives the extension bundles

479 run: |

480 set -euo pipefail

481 test "$(go env GOVERSION)" = "go$(mise config get tools.go)"

482 version=0.0.0-ci

483 mkdir -p archives

484 cp LICENSE README.md archives/

485 for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do

486 os=${target%/*}

487 arch=${target#*/}

488 binary=koment

489 [ "$os" = windows ] && binary=koment.exe

490 CGO_ENABLED=0 GOOS=$os GOARCH=$arch go build -trimpath -o "archives/${binary}" ./cmd/koment

491 name="koment_${version}_${os}_${arch}"

492 if [ "$os" = windows ]; then

493 (cd archives && zip -q "${name}.zip" "$binary" LICENSE README.md && rm "$binary")

494 else

495 (cd archives && tar -czf "${name}.tar.gz" "$binary" LICENSE README.md && rm "$binary")

496 fi

497 done

498 rm archives/LICENSE archives/README.md

499 (cd archives && sha256sum ./*.tar.gz ./*.zip | sed 's| \./| |' > "koment_${version}_checksums.txt")

500

501 - name: Validate every VSIX

502 run: |

503 set -euo pipefail

504 version=0.0.0-ci

505 manifest=integrations/editors/vscode/package.json

506 cp "$manifest" "$RUNNER_TEMP/package.json"

507 trap 'cp "$RUNNER_TEMP/package.json" "$manifest"' EXIT

508 node -e "

509 const p = require('./integrations/editors/vscode/package.json');

510 p.version = '$version';

511 require('fs').writeFileSync('integrations/editors/vscode/package.json', JSON.stringify(p, null, 2) + '\n');

512 "

513 ./integrations/editors/vscode/package-vsix.sh "$version" archives dist >/dev/null

514

515 for pair in linux-x64:koment linux-arm64:koment darwin-x64:koment darwin-arm64:koment \

516 win32-x64:koment.exe win32-arm64:koment.exe; do

517 target=${pair%%:*}

518 expected=${pair##*:}

519 package="dist/koment-vscode_${version}_${target}.vsix"

520 carried=$(unzip -l "$package" | awk '/extension\/bin\//{print $NF}' | sed 's|extension/bin/||')

521 test "$carried" = "$expected" || {

522 echo "::error::$package carries '$carried', expected '$expected'"

523 exit 1

524 }

525 unzip -p "$package" extension.vsixmanifest | grep -q "TargetPlatform=\"${target}\"" || {

526 echo "::error::$package is not declared for $target"

527 exit 1

528 }

529 echo "$package: $expected for $target"

530 done

531

532 universal="dist/koment-vscode_${version}.vsix"

533 if unzip -l "$universal" | grep -q 'extension/bin/'; then

534 echo "::error::the universal package must carry no binary"

535 exit 1

536 fi

537 echo "$universal: no binary, falls back to PATH"

538

539 plugins:

540 name: plugins

541 runs-on: ubuntu-24.04

542 permissions:

543 contents: read

544 steps:

545 - name: Checkout

546 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

547 with:

548 persist-credentials: false

549

550 - name: Setup Go

551 uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

552 with:

553 go-version-file: go.mod

554 cache: true

555

556 - name: Validate plugin manifests

557 run: |

558 set -euo pipefail

559

          for manifest in integrations/agent-plugins/claude/.claude-plugin/plugin.json integrations/agent-plugins/codex/plugins/koment/.codex-plugin/plugin.json integrations/agent-plugins/opencode/plugin.json; do

560 jq empty "$manifest"

561 name=$(jq -r '.name' "$manifest")

562 version=$(jq -r '.version' "$manifest")

563 entrypoint=$(jq -r '.entrypoint // empty' "$manifest")

564 test -n "$name" || { echo "::error::$manifest: name is empty"; exit 1; }

565 test -n "$version" || { echo "::error::$manifest: version is empty"; exit 1; }

566 root_version=$(jq -re '.["."]' .release-please-manifest.json)

567 if [ "$version" != "$root_version" ]; then

568 echo "::error::$manifest version ($version) does not match root ($root_version)"

569 exit 1

570 fi

571 if [ -n "$entrypoint" ]; then

572 dir=$(dirname "$manifest")

573 test -f "$dir/$entrypoint" || { echo "::error::$manifest entrypoint $entrypoint not found"; exit 1; }

574 fi

575 echo "$manifest: $name@$version OK"

576 done

577

578 - name: Validate the Codex marketplace

579 run: |

580 set -euo pipefail

581 marketplace=integrations/agent-plugins/codex/.agents/plugins/marketplace.json

582 plugin=integrations/agent-plugins/codex/plugins/koment

583

          jq -e '.name == "koment-dev" and .plugins == [{"name":"koment","source":{"source":"local","path":"./plugins/koment"},"policy":{"installation":"AVAILABLE","authentication":"ON_INSTALL"},"category":"Productivity"}]' "$marketplace"

584 jq -e '.mcpServers == "./.mcp.json" and .skills == "./skills/"' "$plugin/.codex-plugin/plugin.json"

585

          jq -e '.mcpServers.koment.command == "koment" and .mcpServers.koment.args == ["mcp", "--write"]' "$plugin/.mcp.json"

586

          jq -e '.hooks.PreToolUse[0].hooks[0].command == "koment agents hook pre-tool" and .hooks.Stop[0].hooks[0].command == "koment agents hook stop"' "$plugin/hooks/hooks.json"

587

588 - name: Validate declared slash commands

589 run: |

590 set -euo pipefail

591 manifest=integrations/agent-plugins/claude/.claude-plugin/plugin.json

592 commands=$(jq -r '.commands // empty' "$manifest")

593 test -n "$commands" || { echo "::error::$manifest declares no commands directory"; exit 1; }

594 root=$(dirname "$(dirname "$manifest")")

595 dir=$root/$commands

596 test -d "$dir" || { echo "::error::$manifest points at $commands, which is not a directory"; exit 1; }

597 found=0

598 for command in "$dir"*.md; do

599 test -e "$command" || break

600 head -n1 "$command" | grep -qx -- '---' \

601 || { echo "::error::$command has no frontmatter"; exit 1; }

602 grep -qE '^description: .+' "$command" \

603 || { echo "::error::$command has no description"; exit 1; }

604 found=$((found + 1))

605 echo "$command OK"

606 done

607 test "$found" -gt 0 || { echo "::error::$dir contains no commands"; exit 1; }

608 echo "$found slash commands validated"

609

610 - name: Package self-contained plugins

611 run: |

612 ./scripts/package-agent-plugins.sh 0.0.0-ci "$RUNNER_TEMP/plugin-packages"

613 (cd "$RUNNER_TEMP/plugin-packages/opencode-npm" && npm pack --dry-run --json) \

614 | jq -e '[.[0].files[].path] | sort == ["LICENSE", "README.md", "index.js", "package.json", "plugin.json"]'

615

616 - name: Test the OpenCode plugin protocol client

617 run: npm --prefix integrations/agent-plugins/opencode test

618

619 - name: Test inactive plugin behavior

620 run: ./scripts/agent-plugins-smoke.sh

621

622 zed:

623 name: zed

624 runs-on: ubuntu-24.04

625 permissions:

626 contents: read

627 steps:

628 - name: Checkout

629 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

630 with:

631 persist-credentials: false

632

633 - name: Setup Mise

634 uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5

635 with:

636 experimental: true

637 install: false

638

639 - name: Install the pinned Rust toolchain

640 run: mise --cd integrations/editors/zed install --locked

641

642 - name: Assert the extension carries the repository version

643 run: |

644 set -euo pipefail

645 root=$(jq -re '.["."]' .release-please-manifest.json)

646 declared=$(grep -m1 '^version = ' integrations/editors/zed/extension.toml | cut -d'"' -f2)

647 if [ "$declared" != "$root" ]; then

648 echo "::error::integrations/editors/zed/extension.toml version ($declared) does not match root ($root)"

649 exit 1

650 fi

651 echo "integrations/editors/zed/extension.toml: $declared OK"

652

653 - name: Reject an unformatted or lint-failing extension

654 run: mise --cd integrations/editors/zed run check

655

656 - name: Build the WebAssembly extension

657 run: |

658 set -euo pipefail

659 mise --cd integrations/editors/zed run build

660 artifact=integrations/editors/zed/target/wasm32-wasip2/release/koment_zed.wasm

661 test -f "$artifact" || { echo "::error::$artifact was not produced"; exit 1; }

662 echo "built $artifact ($(stat -c%s "$artifact") bytes)"

663

664 ci:

665 if: ${{ always() }}

666 name: ci

667 needs:

668 - commit-lint

669 - container

670 - editor

671 - helm

672 - lint

673 - plugins

674 - quality

675 - test

676 - zed

677 runs-on: ubuntu-24.04

678 permissions: {}

679 steps:

680 - name: Reject failed, cancelled, or skipped jobs

681

        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}

682 run: exit 1

683

684 - name: Accept successful jobs

685

        if: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }}

686 run: echo "All CI jobs passed"

Readiness uses a job token; shared runners share anonymous GH limits

why ·ok L220

Readiness gates on a completed repository snapshot, so the service is only ready once it has read a tree from GitHub. Unauthenticated GitHub API calls are limited to 60 an hour per source address, and hosted runners share addresses, so this step failed whenever another job on the same address had spent the budget. The job token raises the limit and makes readiness depend on koment rather than on who else was building at the time.

2026-08-0401KZ5JZCPEJGHRG1VAQRKXVNSD

Published-release checks remain advisory

anti-pattern ·ok L673

windows-archive and setup-action exercise the last published release rather than this pull request. Their failures can describe a runner-image change, a GitHub download outage or a release problem without saying anything about the commit under review. They remain visible jobs, but putting either in the ci needs list would make external release state a code-merge requirement.

2026-08-0401KZ5NA2SJ0EEYBVEN1B97YB1N

Only the ci aggregate is required; its name equals its job id

invariant ·ok L664

Every job's name equals its id, so a required check names the job that produced it. The aggregate is called ci rather than test because a job that runs the tests should be allowed to be called test.

The branch ruleset requires only this job. It already fails when any dependency failed, was cancelled or was skipped, so listing the others as required checks duplicated that logic in a second place that no test covers. Adding a job to needs now gates merges without touching repository settings.

2026-08-0401KZ6416GSBA5CRC4XJZC6TTFQ

Install checks must not race publication

gotcha ·ok L286

A push to main can be a release commit. release-please creates the GitHub release, and latest flips to the new tag immediately, but publish binaries has not uploaded the archives yet. On 0.5.0 that window was two minutes twelve seconds, and this job downloaded latest inside it and got a 404. The archives are not a property of the commit being tested, so the release workflow verifies its own output once publication finishes.

2026-08-0501KZ8AMCGJ8VBAMFREXKF9DGEZ

Plugins job gates merges without ruleset edit

invariant ·ok L539

The ci job's aggregate gate runs under always() so the ruleset-required status still resolves even when an upstream job was cancelled or skipped. The reject step uses `contains(needs.*.result, ...)` rather than iterating jobs: adding plugins here means a failed plugins run blocks a merge without a ruleset edit. This is the same pattern the annotation at 01KZ6416GSBA5 already states — do not duplicate it in branch rules.

2026-08-0601KZCASF2T50H6A5VYW8DP71T7

Plugin manifests must match release-please version exactly

invariant ·ok L566

Every manifest that carries a version must pin the exact value in .release-please-manifest.json rather than drift toward it. A mismatch would mean the release attaches archives stamped with a version release-please never wrote to the file, which silently breaks anyone pinning a file:// reference against the tag.

Show the rest

The `jq -re '.["."]'` is the whole check. This read `jq -r '.version'` until 2026-08-19, and that key does not exist — the manifest is `{".": "3.0.0"}`. It returned the string "null", the guard below it was written as `if [ -n "$root_version" ]`, and so the comparison was skipped on every run since the job was written. The gate this annotation described had never once fired.

`-re` is deliberate: `-e` exits non-zero if the key is missing, so the same mistake now fails the job instead of quietly disabling it. Do not soften it back to a presence check.

2026-08-0601KZCASJZECBQRVWJBDFBQ8JDD

CI never installs the contributor self-pin

why ·ok L22

The root mise configuration pins a released koment only for contributor editor and MCP sessions. Every repository gate runs the working tree through Go and does not consume that pin. A cold CI cache previously installed and attested the unused binary independently in each job; the concurrent GitHub API calls exhausted the installation rate limit and failed every real gate before it ran. Disabling only this tool keeps the contributor pin active locally while making CI install exactly the tools its jobs can use.

2026-08-1901M0D9K2JXYM0JZFZ502W4ATJE

Restore Go caches before mise installs Go tools

invariant ·ok L26

The quality, lint and test jobs restore the Go cache before Setup Mise. Setup Mise installs locked Go-based tools such as govulncheck and therefore writes modules into ~/go/pkg/mod. Restoring actions/cache afterwards makes GNU tar refuse to overwrite those files, discards the entire cache and leaves a successful job with a repeatable warning. Keep this order in every job that combines the shared Go cache with a full mise install.

2026-08-2001M0F3H3AKNZ2XWZ5394DK5AKK