feat(ci): release-please pipeline to lint, test, and publish modules

.github/CONTRIBUTING.md

@@ -0,0 +1,21 @@
+# Contributing
+
+Pull requests are squash-merged, so the pull request title becomes the commit on `main` and drives
+the next version. The title must be a valid [Conventional Commit][conventional-commits]; CI rejects
+it otherwise.
+
+Allowed types: `feat`, `fix`, `chore`, `refactor`, `docs`, `test`, `perf`, `build`, `ci`, `style`,
+`revert`.
+
+- `fix:` triggers a patch release.
+- `feat:` triggers a minor release.
+- A `feat!:` prefix or a `BREAKING CHANGE:` footer triggers a major release.
+
+Before opening a pull request, run the checks locally from the module directory:
+
+```sh
+wippy lint --level error
+wippy test
+```
+
+[conventional-commits]: https://www.conventionalcommits.org

.github/workflows/ci.yml

@@ -0,0 +1,12 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+  push:
+    branches: [main]
+
+jobs:
+  ci:
+    if: ${{ github.repository != 'wippyai/template-module' }}
+    uses: wippyai/template-module/.github/workflows/reusable-ci.yml@v1

.github/workflows/release.yml

@@ -0,0 +1,15 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    if: ${{ github.repository != 'wippyai/template-module' }}
+    uses: wippyai/template-module/.github/workflows/reusable-release.yml@v1
+    secrets: inherit

.github/workflows/reusable-ci.yml

@@ -0,0 +1,76 @@
+name: Reusable CI
+
+on:
+  workflow_call:
+    inputs:
+      wippy-version:
+        description: Tag of the wippyai/runtime release providing the wippy binary
+        type: string
+        default: v0.3.12a
+      module-dir:
+        description: Directory containing wippy.yaml
+        type: string
+        default: .
+      lint-level:
+        description: Minimum lint severity that fails the build (error, warning, hint)
+        type: string
+        default: error
+
+permissions:
+  contents: read
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Install wippy runtime
+        env:
+          GH_TOKEN: ${{ github.token }}
+          WIPPY_VERSION: ${{ inputs.wippy-version }}
+        run: |
+          set -euo pipefail
+          tmp="$(mktemp -d)"
+          gh release download "$WIPPY_VERSION" --repo wippyai/runtime \
+            --pattern wippy-linux-amd64 --pattern SHA256SUMS --dir "$tmp"
+          ( cd "$tmp" && sha256sum --ignore-missing -c SHA256SUMS )
+          mkdir -p "$HOME/.wippy/bin"
+          install -m 0755 "$tmp/wippy-linux-amd64" "$HOME/.wippy/bin/wippy"
+          echo "$HOME/.wippy/bin" >> "$GITHUB_PATH"
+          "$HOME/.wippy/bin/wippy" version
+
+      - name: Lint
+        working-directory: ${{ inputs.module-dir }}
+        env:
+          LINT_LEVEL: ${{ inputs.lint-level }}
+        run: wippy lint --level "$LINT_LEVEL" --no-color
+
+      - name: Test
+        working-directory: ${{ inputs.module-dir }}
+        run: wippy test --silent
+
+  pr-title:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - name: Enforce Conventional Commit pull request title
+        uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          types: |
+            feat
+            fix
+            chore
+            refactor
+            docs
+            test
+            perf
+            build
+            ci
+            style
+            revert

.github/workflows/reusable-release.yml

@@ -0,0 +1,104 @@
+name: Reusable Release
+
+on:
+  workflow_call:
+    inputs:
+      wippy-version:
+        description: Tag of the wippyai/runtime release providing the wippy binary
+        type: string
+        default: v0.3.12a
+      module-dir:
+        description: Directory containing wippy.yaml
+        type: string
+        default: .
+      publish:
+        description: Publish to the registry when a release is cut
+        type: boolean
+        default: true
+    secrets:
+      RELEASE_PLEASE_APP_ID:
+        description: GitHub App ID for release-please (preferred over RELEASE_PLEASE_TOKEN)
+        required: false
+      RELEASE_PLEASE_APP_PRIVATE_KEY:
+        description: GitHub App private key paired with RELEASE_PLEASE_APP_ID
+        required: false
+      RELEASE_PLEASE_TOKEN:
+        description: PAT fallback for release-please when no GitHub App is configured
+        required: false
+      WIPPY_TOKEN:
+        description: Registry token used by wippy publish
+        required: false
+      WIPPY_REGISTRY:
+        description: Registry URL override (defaults to the wippy built-in)
+        required: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Detect GitHub App configuration
+        id: cfg
+        env:
+          APP_ID: ${{ secrets.RELEASE_PLEASE_APP_ID }}
+        run: |
+          set -euo pipefail
+          if [ -n "${APP_ID:-}" ]; then
+            echo "use_app=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "use_app=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Mint GitHub App token
+        id: app-token
+        if: ${{ steps.cfg.outputs.use_app == 'true' }}
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_PLEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}
+
+      - name: Run release-please
+        id: release
+        uses: googleapis/release-please-action@v5
+        with:
+          token: ${{ steps.app-token.outputs.token || secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+      - name: Check out the released revision
+        if: ${{ steps.release.outputs.release_created && inputs.publish }}
+        uses: actions/checkout@v7
+
+      - name: Install wippy runtime
+        if: ${{ steps.release.outputs.release_created && inputs.publish }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          WIPPY_VERSION: ${{ inputs.wippy-version }}
+        run: |
+          set -euo pipefail
+          tmp="$(mktemp -d)"
+          gh release download "$WIPPY_VERSION" --repo wippyai/runtime \
+            --pattern wippy-linux-amd64 --pattern SHA256SUMS --dir "$tmp"
+          ( cd "$tmp" && sha256sum --ignore-missing -c SHA256SUMS )
+          mkdir -p "$HOME/.wippy/bin"
+          install -m 0755 "$tmp/wippy-linux-amd64" "$HOME/.wippy/bin/wippy"
+          echo "$HOME/.wippy/bin" >> "$GITHUB_PATH"
+
+      - name: Publish to the Wippy registry
+        if: ${{ steps.release.outputs.release_created && inputs.publish }}
+        working-directory: ${{ inputs.module-dir }}
+        env:
+          WIPPY_TOKEN: ${{ secrets.WIPPY_TOKEN }}
+          WIPPY_REGISTRY: ${{ secrets.WIPPY_REGISTRY }}
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          set -euo pipefail
+          if [ -z "${WIPPY_TOKEN:-}" ]; then
+            echo "WIPPY_TOKEN secret is required to publish" >&2
+            exit 1
+          fi
+          [ -z "${WIPPY_REGISTRY:-}" ] && unset WIPPY_REGISTRY
+          wippy publish --version "$VERSION" --create

.github/workflows/self-test.yml

@@ -0,0 +1,12 @@
+name: Self Test
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+  push:
+    branches: [main]
+
+jobs:
+  ci:
+    if: ${{ github.repository == 'wippyai/template-module' }}
+    uses: ./.github/workflows/reusable-ci.yml

.github/workflows/tag-major.yml

@@ -0,0 +1,26 @@
+name: Update major tag
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+
+permissions:
+  contents: write
+
+jobs:
+  move-major:
+    if: ${{ github.repository == 'wippyai/template-module' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Move the major tag to this release
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          major="${TAG%%.*}"
+          git tag -f "$major"
+          git push -f origin "refs/tags/$major"

.gitignore

@@ -3,6 +3,8 @@
 /runtime
 /dist
 /build
+/.wippy
+*.wapp
 
 # Dependency directories
 /node_modules

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}