ci: discover the test matrix with `pgpm ls`; smoke-test templates; template DX cleanup by pyramation · Pull Request #53 · constructive-io/pgpm-boilerplates

pyramation · 2026-09-17T02:33:59Z

Summary

Fixes the generated workspace CI and a set of DX defects found by scaffolding the templates with published pgpm@5.33.0.

Generated CI (pgpm/workspace/.github/workflows/ci.yml)

The placeholder matrix: package: [package-a, package-b] is replaced by a discover job: packages=$(pnpm exec pgpm ls --paths --json) (pgpm ls landed in pgpm 5.33.0; the template now requires pgpm ^5.33.0). Paths are workspace-relative, so the test step is cd ./${{ matrix.package }} && pnpm test; the test job is skipped when the list is [].
No more PGPM_VERSION: 5.30.6 + npm install -g pgpm: both jobs use the workspace's own pgpm via pnpm exec pgpm, so discovery, tune, and admin-users all run the same CLI the workspace pins.

Supply-chain policy — no more pinned inventory
A fresh scaffold's pnpm install failed with ERR_PNPM_NO_MATURE_MATCHING_VERSION graphile-storage-registry@0.2.0: the template exempted first-party names via @constructive-io/pnpm-policy@0.3.2's inventory, which predates that package. Both workspace templates now drop the two pinned inventory devDependencies and list first-party names directly, using the packages: key from pnpm-policy@0.6.0 (constructive-io/dev-utils#131):

scopes: [ "@constructive-io", ..., "@agentic-kit", "@inquirerer" ]
packages:
  - pgpm
  - graphile-storage-registry
  - ...   # 68 names: every unscoped first-party package a fresh scaffold resolves

pnpm-workspace.yaml is regenerated with the published pnpm-policy@0.6.0 and committed; pnpm-policy is bumped to ^0.6.0. Upstream Graphile packages not published by us (@dataplan/*, @graphile/lru, @graphile-contrib/*) are no longer exempt.

Other template fixes

README: cd packages/your-module → cd "$(pnpm exec pgpm ls --paths | head -1)".
Module lint is check-only (eslint .); --fix moved to lint:fix. Root pnpm lint no longer rewrites files.
Workspace version script no longer runs git add -A.

Repo CI (.github/workflows/ci.yml)
New smoke job on PRs: pgpm init workspace + pgpm init with the published pgpm, then pnpm install --lockfile-only — deliberately without a release-age override, so a template that pins something its own policy quarantines fails here instead of on the user's machine.

Link to Devin session: https://app.devin.ai/sessions/dd4055c50bcf4b1e8e604211038aaa82
Open in Devin Desktop: https://app.devin.ai/desktop/session/dd4055c50bcf4b1e8e604211038aaa82?variant=devin
Requested by: @pyramation

devin-ai-integration · 2026-09-17T02:34:02Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

tenki-reviewer · 2026-09-17T02:38:25Z

Review complete. 🟠 1 high

💬 Inline comments (1)

🟠 Empty packages/ aborts discover step — ci.yml:21

PR #53 adds .github/workflows/ci.yml (a template smoke test that inits a workspace, inits a module, and installs) and refactors pgpm/workspace/.github/workflows/ci.yml to discover packages/*/ modules at runtime via ls/jq, feeding a dynamic test matrix gated by has_packages, plus a single safegres database audit job that gates on security grade and perf baseline.

One high-severity defect was found in the new discovery logic.

Files	Change
`.github/workflows/ci.yml`	Adds a new smoke-test workflow for template generation.
`pgpm/workspace/.github/workflows/ci.yml`	Replaces the hardcoded test matrix with runtime package discovery and adds a gated safegres audit job.

The discover step's ls -d packages/*/ pipeline aborts under the default bash -e -o pipefail shell when packages/ is empty or missing, so the has_packages guard meant to handle the empty case is unreachable exactly when a freshly generated workspace needs it.

_{Reviewed commit: 3dc8080}

tenki-reviewer

Adds a smoke-test CI workflow and converts the pgpm workspace test job to dynamic package discovery, gating the test matrix on a has_packages output.

Key findings

🟠 Empty packages/ aborts discover step — ci.yml:21

tenki-reviewer · 2026-09-17T02:41:03Z

+          packages=$(ls -d packages/*/ 2>/dev/null | xargs -n1 basename 2>/dev/null | jq -Rsc 'split("\n")[:-1]')
+          echo "packages=${packages:-[]}" >> "$GITHUB_OUTPUT"
+          echo "has_packages=$([ "${packages:-[]}" != "[]" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"


🟠 bug · high

Empty packages/ aborts discover step

The packages=$(ls -d packages/*/ ...) pipeline aborts the step whenever packages/ is missing or empty (pgpm/workspace/.github/workflows/ci.yml:21): 2>/dev/null hides the ls error but not its non-zero exit code, and under GitHub Actions' default bash -e -o pipefail runner shell that failed command substitution terminates the step before the packages=[] fallback and has_packages guard on the following lines run. Any freshly generated workspace (which ships no packages/ directory) therefore gets a red discover job, and the has_packages output added to make the empty case harmless is unreachable exactly when it is needed.

📋 Prompt for AI Agents

In pgpm/workspace/.github/workflows/ci.yml line 21, the packages=$(ls -d packages/*/ 2>/dev/null | xargs -n1 basename 2>/dev/null | jq -Rsc 'split("\n")[:-1]') assignment aborts the discover step under bash -e -o pipefail when packages/ is missing or empty, because ls returns non-zero. Append || packages='[]' to that assignment (keeping lines 22-23 unchanged) so an empty packages/ yields packages=[] and has_packages=false, letting the downstream if: needs.discover.outputs.has_packages == 'true' guard skip the test job instead of failing the whole run.

…stall

… of pinning an inventory

…ty names

socket-security · 2026-09-17T07:15:24Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pnpm-policy@0.5.0 ⏵ 0.6.0	^-7		⁺¹	⁺¹

View full report

pyramation added 2 commits September 17, 2026 02:31

ci: discover workspace packages and smoke test templates

fb268b0

ci: smoke test templates on pull requests

3dc8080

devin-ai-integration Bot assigned pyramation Sep 17, 2026

tenki-reviewer Bot reviewed Sep 17, 2026

View reviewed changes

ci: discover workspace packages with pgpm ls

d944947

pyramation mentioned this pull request Sep 17, 2026

feat(pgpm): add pgpm ls for listing workspace modules constructive-io/constructive#1841

Merged

devin-ai-integration Bot changed the title ~~ci: discover workspace packages for the test matrix; smoke-test templates on PRs~~ ci: discover workspace packages with pgpm ls; smoke-test templates on PRs Sep 17, 2026

pyramation added 8 commits September 17, 2026 03:34

ci: allow fresh dependency metadata in template smoke test

294a9a1

chore(deps): require pgpm ^5.33.0 in the workspace template

e337634

ci(workspace): use the workspace's pgpm instead of a pinned global in…

c77bfae

…stall

docs(workspace): point the README at the scaffolded module path

0f58438

fix(module): make lint check-only, add lint:fix

c1916c7

fix(workspace): version script no longer stages the whole tree

f09324b

fix(workspace): list first-party packages in pnpm-policy.yaml instead…

6569a2a

… of pinning an inventory

ci: smoke test enforces the template's release-age policy

31842ff

devin-ai-integration Bot changed the title ~~ci: discover workspace packages with pgpm ls; smoke-test templates on PRs~~ ci: discover the test matrix with pgpm ls; smoke-test templates; template DX cleanup Sep 17, 2026

pyramation added 2 commits September 17, 2026 05:18

fix(workspace): exempt the @agentic-kit scope and remaining first-par…

d4d7abe

…ty names

chore(workspace): require pnpm-policy ^0.6.0 for packages: support

f49b5a7

pyramation merged commit eecfb55 into main Sep 17, 2026
4 checks passed

This was referenced Sep 17, 2026

Revert "ci: discover the test matrix with pgpm ls; smoke-test templates; template DX cleanup" #55

Merged

ci: ship an empty literal test matrix that pgpm init fills in #56

Merged

Navigation Menu

Repository navigation

ci: discover the test matrix with `pgpm ls`; smoke-test templates; template DX cleanup - #53

ci: discover the test matrix with `pgpm ls`; smoke-test templates; template DX cleanup#53
pyramation merged 13 commits into
mainfrom
feat/ci-discover-matrix

pyramation commented Sep 17, 2026 •

edited by devin-ai-integration Bot

Loading

Uh oh!

devin-ai-integration Bot commented Sep 17, 2026

Uh oh!

tenki-reviewer Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

tenki-reviewer Bot left a comment •

edited

Loading

Uh oh!

tenki-reviewer Bot Sep 17, 2026

Uh oh!

socket-security Bot commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

pyramation commented Sep 17, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Sep 17, 2026

🤖 Devin AI Engineer

Uh oh!

tenki-reviewer Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💬 Inline comments (1)

Uh oh!

tenki-reviewer Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tenki-reviewer Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pyramation commented Sep 17, 2026 •

edited by devin-ai-integration Bot

Loading

tenki-reviewer Bot commented Sep 17, 2026 •

edited

Loading

tenki-reviewer Bot left a comment •

edited

Loading