Consolidate all microcodegen sources and release pipelines here - #2
Consolidate all microcodegen sources and release pipelines here#2Anioko wants to merge 1 commit into
Conversation
aniekanasuquookono-web/archiet is being archived. It is also the build source for live packages on PyPI, npm, crates.io, NuGet, RubyGems, Packagist and pkg.go.dev — and GitHub Actions do not run on archived repositories. Left as was, archiving would have frozen every one of them with no way to ship a fix. Brought across: - scripts/microcodegen.py — the 1,396-line FastAPI engine behind PyPI archiet-microcodegen 0.2.3. Verified standalone: every non-stdlib import sits inside generated template strings, nothing reaches into the Flask app. - nine renderer directories (django, dotnet, flask, go, java, laravel, nestjs, rails, tauri) - eleven release workflows, tag triggers unchanged Excluded archiet_microcodegen_tauri/target/ — 251 tracked files and 17.3 MB of committed Rust build artifacts against 22 KB of actual source. .gitignore now covers build output across all nine ecosystems so it cannot recur. Added Apache-2.0. Every one of these repositories carried license: NONE, which means the packages people can already pip install and npm install are not legally usable. Apache-2.0 rather than MIT for the express patent grant and the contributor patent licence — the safer footing for a company-backed project whose IP strategy contemplates registered rights. Added PUBLISHING.md: the tag-to-package-to-registry map, the eight secrets that must be recreated here before anything can publish, and why the two Go and Laravel mirror repositories must stay where they are (module paths and Packagist names are bound to a repo URL; moving them breaks go install). The two Python packages are kept separate on purpose. microcodegen (root file, 1,122 lines, Flask, 0.1.0) and archiet-microcodegen (scripts/, 1,396 lines, FastAPI, 0.2.3) diverged while living in two repositories. Collapsing them would either change what pip install microcodegen produces or regress archiet-microcodegen from 0.2.3 to 0.1.0. Neither is worth doing to existing users for tidiness; reconciling the engines is its own change with a major version bump. Nothing publishes from this commit — releases are tag-triggered and the secrets do not exist here yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e312edf425
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let uid = require_session(&state, &token)?; | ||
| let db = state.db.lock().unwrap(); | ||
| db.execute("UPDATE {tbl} SET {set_list} WHERE id = ?{next} AND user_id = ?{next2}", rusqlite::params![{params_bare}id, uid]).map_err(|e| e.to_string())?; | ||
| db.query_row("SELECT {sel} FROM {tbl} WHERE id = ?1", [id], |row| Ok({ps} {{ |
There was a problem hiding this comment.
When an authenticated user calls a generated update_* command with another user's id, the UPDATE ... AND user_id = ? affects zero rows but this follow-up SELECT is only scoped by id, so it returns the other user's row instead of denying access. This breaks the per-user isolation contract for every generated Tauri entity update path; keep the read scoped by both id and user_id and check the update affected a row.
Useful? React with 👍 / 👎.
| - name: Activate Django pyproject.toml (runner is ephemeral — safe to overwrite) | ||
| run: cp pyproject-django.toml pyproject.toml |
There was a problem hiding this comment.
The django-v*.*.* release workflow always runs this cp, but this commit does not add pyproject-django.toml anywhere in the repository, so every Django PyPI release fails before building despite the source package being present. Add the package-specific pyproject file or build from an existing packaging configuration.
Useful? React with 👍 / 👎.
| - name: Activate Flask pyproject.toml (runner is ephemeral — safe to overwrite) | ||
| run: cp pyproject-flask.toml pyproject.toml |
There was a problem hiding this comment.
The flask-v*.*.* release workflow always runs this cp, but the repository only contains pyproject.toml and no pyproject-flask.toml, so Flask releases fail before python -m build can run. Add the package-specific pyproject file or point the workflow at an existing build configuration.
Useful? React with 👍 / 👎.
| defaults: | ||
| run: | ||
| working-directory: mcp_archiet |
There was a problem hiding this comment.
All run steps in this job use working-directory: mcp_archiet, but this commit does not add an mcp_archiet/ directory or its pyproject.toml, so the mcp-v*.*.* workflow fails on the first shell step before it can build or publish anything. Either add the MCP source tree or remove/retarget this release pipeline until the package exists.
Useful? React with 👍 / 👎.
| - name: Verify package files exist | ||
| run: | | ||
| test -d archiet_microcodegen_nestjs | ||
| test -f archiet_microcodegen_nestjs/package.json | ||
| test -f archiet_microcodegen_nestjs/bin/archiet-microcodegen-nestjs.js |
There was a problem hiding this comment.
The npm package declares and the workflow verifies archiet_microcodegen_nestjs/bin/archiet-microcodegen-nestjs.js, but that file is not added in this commit, so both workflow_dispatch dry runs and nestjs-v*.*.* tag publishes fail at this test -f before npm pack. Add the bin script or update package.json and the workflow to the actual entrypoint.
Useful? React with 👍 / 👎.
| - name: Verify gem source files exist | ||
| run: | | ||
| test -f archiet_microcodegen_rails/archiet-microcodegen-rails.gemspec | ||
| test -f archiet_microcodegen_rails/lib/archiet_microcodegen_rails.rb | ||
| test -f archiet_microcodegen_rails/bin/archiet-microcodegen-rails |
There was a problem hiding this comment.
The gemspec includes bin/* and declares archiet-microcodegen-rails as the executable, and this workflow requires archiet_microcodegen_rails/bin/archiet-microcodegen-rails, but no bin/ file is added for the Rails package. As written, every Rails gem release fails at the source-file verification step; add the executable wrapper or remove the executable declaration and checks.
Useful? React with 👍 / 👎.
| - name: Verify composer.json and PHP files exist | ||
| run: | | ||
| test -f archiet_microcodegen_laravel/composer.json | ||
| test -f archiet_microcodegen_laravel/bin/archiet-microcodegen-laravel.php |
There was a problem hiding this comment.
The Laravel package's composer.json advertises bin/archiet-microcodegen-laravel.php, and this workflow verifies that same file, but the commit adds only composer.json and README.md under archiet_microcodegen_laravel/. Any laravel-v*.*.* release or dry run therefore fails immediately at this check; add the CLI script before enabling the Packagist sync.
Useful? React with 👍 / 👎.
1 participant
aniekanasuquookono-web/archietis being archived. It is also the build source for live packages on PyPI, npm, crates.io, NuGet, RubyGems, Packagist and pkg.go.dev — and GitHub Actions do not run on archived repositories. Left as-is, archiving freezes every one of them with no way to ship a fix.Verified live before starting:
What moved
scripts/microcodegen.py— the 1,396-line FastAPI engine behindarchiet-microcodegen0.2.3. Verified standalone: every non-stdlib import sits inside generated template strings; nothing reaches into the Flask app.What deliberately did not move
archiet_microcodegen_tauri/target/— 251 tracked files, 17.3 MB of committed Rust build artifacts, against 22 KB of actual source. The directory is now 4 files..gitignorecovers build output across all nine ecosystems so it cannot recur.Decisions made, so you can overrule them
Apache-2.0, not MIT. Every one of these repos carried
license: NONE— meaning the packages people can alreadypip installare not legally usable. Apache-2.0 for the express patent grant and contributor patent licence: the safer footing for a company-backed project whose IP strategy contemplates registered rights. One-file swap if you disagree.The two Python packages stay separate.
microcodegen(root, 1,122 lines, Flask, 0.1.0) andarchiet-microcodegen(scripts/, 1,396 lines, FastAPI, 0.2.3) diverged while living in two repos. Collapsing them either changes whatpip install microcodegenproduces, or regressesarchiet-microcodegenfrom 0.2.3 to 0.1.0. Neither is worth doing to existing users for tidiness. Reconciling the engines is its own change with a major version bump and a migration note.The Go and Laravel mirrors stay put.
go-publish.ymlandpackagist-publish-laravel.ymlsync intoaniekanasuquookono-web/archiet-microcodegen-goand-laravelrather than publishing from here, because Go module paths and Packagist names are bound to a repository URL. Moving them breaksgo installfor anyone who already has it.Before merging — and before archiving anything
Nothing publishes from this commit. Releases are tag-triggered and the secrets don't exist here yet. Eight must be recreated in Settings → Secrets and variables → Actions:
PYPI_API_TOKEN_MICROCODEGEN·PYPI_API_TOKEN·NPM_TOKEN·CRATES_IO_TOKEN·NUGET_API_KEY·GEM_HOST_API_KEY·MICROCODEGEN_GO_PAT·MICROCODEGEN_LARAVEL_PAT+PACKAGIST_API_TOKENThen run one workflow with
dry_run: trueand confirm the artifact builds before archivingarchiet.PUBLISHING.mdhas the full tag → package → registry → secret map.Not addressed here
README.mdstill describes only the root Flask generator. It should introduce the monorepo and the nine renderers — but that is customer-facing copy on the one asset with external traction, and worth writing deliberately rather than bolting onto this change.