Consolidate all microcodegen sources and release pipelines here

.github/workflows/crates-publish-tauri.yml

@@ -0,0 +1,101 @@
+name: Publish archiet-microcodegen-tauri to crates.io
+
+on:
+  push:
+    tags:
+      - 'tauri-v*'
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: archiet_microcodegen_tauri
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            archiet_microcodegen_tauri/target
+          key: ${{ runner.os }}-cargo-tauri-${{ hashFiles('archiet_microcodegen_tauri/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-tauri-
+
+      - name: Verify zero dependencies
+        run: |
+          deps=$(cargo metadata --no-deps --format-version 1 | python3 -c "
+          import json,sys
+          m = json.load(sys.stdin)
+          pkg = next(p for p in m['packages'] if p['name'] == 'archiet-microcodegen-tauri')
+          print(len(pkg['dependencies']))
+          ")
+          echo "Dependency count: $deps"
+          [ "$deps" -eq 0 ] || { echo "ERROR: generator must have zero runtime dependencies"; exit 1; }
+
+      - name: Build release binary
+        run: cargo build --release
+
+      - name: Smoke test — sample PRD generates files
+        run: |
+          ./target/release/archiet-microcodegen-tauri --sample > /tmp/sample.md
+          ./target/release/archiet-microcodegen-tauri /tmp/sample.md --out /tmp/tauri-out
+          echo "=== Generated files ==="
+          find /tmp/tauri-out -type f | sort
+          # Verify key files exist
+          test -f /tmp/tauri-out/src-tauri/Cargo.toml
+          test -f /tmp/tauri-out/src-tauri/src/lib.rs
+          test -f /tmp/tauri-out/src-tauri/src/db.rs
+          test -f /tmp/tauri-out/src-tauri/src/auth.rs
+          test -f /tmp/tauri-out/src-tauri/tauri.conf.json
+          test -f /tmp/tauri-out/src/ipc.ts
+          test -f /tmp/tauri-out/src/pages/Login.tsx
+          test -f /tmp/tauri-out/ARCHITECTURE.md
+          test -f /tmp/tauri-out/openapi.yaml
+          echo "All required files present ✓"
+
+      - name: Smoke test — ZIP output
+        run: |
+          ./target/release/archiet-microcodegen-tauri /tmp/sample.md --zip /tmp/tauri-out.zip
+          python3 -c "
+          import zipfile, sys
+          with zipfile.ZipFile('/tmp/tauri-out.zip') as z:
+              names = z.namelist()
+              print(f'ZIP contains {len(names)} files')
+              required = ['src-tauri/Cargo.toml', 'src-tauri/src/auth.rs', 'ARCHITECTURE.md', 'openapi.yaml']
+              for r in required:
+                  assert r in names, f'Missing: {r}'
+              print('ZIP validation passed ✓')
+          "
+
+      - name: Verify ARCHITECTURE.md has ArchiMate elements
+        run: |
+          grep -q "ApplicationComponent" /tmp/tauri-out/ARCHITECTURE.md
+          grep -q "DataObject" /tmp/tauri-out/ARCHITECTURE.md
+          echo "ArchiMate elements present ✓"
+
+      - name: Verify per-user isolation in generated commands
+        run: |
+          # Every entity command file must filter by user_id
+          for f in /tmp/tauri-out/src-tauri/src/commands/*_commands.rs; do
+            grep -q "user_id" "$f" || { echo "FAIL: $f missing user_id filter"; exit 1; }
+            grep -q "require_session" "$f" || { echo "FAIL: $f missing session check"; exit 1; }
+          done
+          echo "Per-user isolation verified ✓"
+
+      - name: Publish to crates.io
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
+        run: |
+          # --allow-dirty is safe here: the only uncommitted file is
+          # target/.rustc_info.json which cargo build writes during the
+          # smoke test steps above. It is not part of the published crate
+          # (excluded by .gitignore / Cargo.toml package exclude).
+          cargo publish --token "$CARGO_REGISTRY_TOKEN" --allow-dirty

.github/workflows/gem-publish-rails.yml

@@ -0,0 +1,109 @@
+name: Publish archiet-microcodegen-rails to RubyGems
+
+# Triggered on a git tag of the form rails-v*.*.* (e.g. rails-v0.1.0).
+# Builds and pushes the archiet-microcodegen-rails gem to rubygems.org.
+#
+# Founder setup (one-time):
+#   1. Create an API key at https://rubygems.org/profile/api_keys
+#      (scope: Push rubygems)
+#   2. Add it as repo secret: GEM_HOST_API_KEY
+#   3. Tag a release: git tag rails-v0.1.0 && git push origin rails-v0.1.0
+
+on:
+  push:
+    tags:
+      - "rails-v*.*.*"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Build gem only — do NOT push to RubyGems"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby 3.2
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.2"
+
+      - name: Verify gem source files exist
+        run: |
+          test -f archiet_microcodegen_rails/archiet-microcodegen-rails.gemspec
+          test -f archiet_microcodegen_rails/lib/archiet_microcodegen_rails.rb
+          test -f archiet_microcodegen_rails/bin/archiet-microcodegen-rails
+
+      - name: Syntax-check Ruby generator
+        run: ruby -c archiet_microcodegen_rails/lib/archiet_microcodegen_rails.rb
+
+      - name: Assert gemspec version matches tag
+        if: startsWith(github.ref, 'refs/tags/')
+        working-directory: archiet_microcodegen_rails
+        run: |
+          GEM_VER=$(ruby -e "require 'rubygems'; s=Gem::Specification.load('archiet-microcodegen-rails.gemspec'); puts s.version")
+          TAG_VER="${GITHUB_REF_NAME#rails-v}"
+          echo "gemspec: $GEM_VER  tag: $TAG_VER"
+          [ "$GEM_VER" = "$TAG_VER" ] || {
+            echo "::error::Version mismatch — update s.version in the gemspec to $TAG_VER before tagging."
+            exit 1
+          }
+
+      - name: Build gem
+        working-directory: archiet_microcodegen_rails
+        run: |
+          gem build archiet-microcodegen-rails.gemspec
+          ls -la *.gem
+
+      - name: Verify gem contents
+        working-directory: archiet_microcodegen_rails
+        run: |
+          GEM_FILE=$(ls *.gem | head -1)
+          gem contents "$GEM_FILE" --remote 2>/dev/null || gem unpack "$GEM_FILE" --target /tmp/gem-inspect
+          find /tmp/gem-inspect -name "archiet_microcodegen_rails.rb" | grep -q . || \
+            ( gem contents "$GEM_FILE" 2>/dev/null | grep -q "archiet_microcodegen_rails.rb" ) || {
+            echo "::error::Gem is missing lib/archiet_microcodegen_rails.rb"; exit 1;
+          }
+          echo "Gem contents verified."
+
+      - name: Verify GEM_HOST_API_KEY is set
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GEM_HOST_API_KEY: ${{ secrets.GEM_HOST_API_KEY }}
+        run: |
+          if [ -z "$GEM_HOST_API_KEY" ]; then
+            echo "::error::GEM_HOST_API_KEY secret is not set." >&2
+            echo "Create at https://rubygems.org/profile/api_keys" >&2
+            exit 1
+          fi
+          echo "GEM_HOST_API_KEY present (${#GEM_HOST_API_KEY} chars)"
+
+      - name: Push gem to RubyGems
+        if: startsWith(github.ref, 'refs/tags/')
+        working-directory: archiet_microcodegen_rails
+        env:
+          GEM_HOST_API_KEY: ${{ secrets.GEM_HOST_API_KEY }}
+        run: |
+          GEM_FILE=$(ls *.gem | head -1)
+          gem push "$GEM_FILE" || {
+            # "You have already pushed this version" is acceptable
+            [[ "$(gem push $GEM_FILE 2>&1)" == *"already been pushed"* ]] && echo "::notice::Version already pushed — skipping." || exit 1
+          }
+
+      - name: Upload gem artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: archiet-microcodegen-rails-gem
+          path: archiet_microcodegen_rails/*.gem
+          retention-days: 30
+
+      - name: Dry-run notice
+        if: github.event_name == 'workflow_dispatch'
+        run: echo "::notice::dry_run=true — gem built but NOT pushed to RubyGems."

.github/workflows/go-publish.yml

@@ -0,0 +1,99 @@
+name: Publish archiet-microcodegen-go to pkg.go.dev
+
+# pkg.go.dev auto-indexes Go modules from GitHub once a semver tag exists.
+# Because the Go module path is github.com/aniekanasuquookono-web/archiet-microcodegen-go,
+# the files must live in the separate repo archiet-microcodegen-go (go install requires
+# a module at the root of its own repo, not a monorepo subdirectory).
+#
+# This workflow syncs archiet_microcodegen_go/ -> the external repo and tags it.
+#
+# Founder setup (one-time):
+#   1. Create repo https://github.com/aniekanasuquookono-web/archiet-microcodegen-go
+#   2. Create a fine-grained PAT with Contents: Read+Write on that repo
+#   3. Add it as secret: MICROCODEGEN_GO_PAT
+#   4. Tag a release: git tag go-v0.1.0 && git push origin go-v0.1.0
+
+on:
+  push:
+    tags:
+      - "go-v*.*.*"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Sync to external repo but do NOT tag (no pkg.go.dev publish)"
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-and-tag:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify Go source exists
+        run: |
+          test -d archiet_microcodegen_go
+          test -f archiet_microcodegen_go/go.mod
+          test -f archiet_microcodegen_go/main.go
+
+      - name: Assert go.mod module matches external repo
+        run: |
+          MOD=$(grep '^module ' archiet_microcodegen_go/go.mod | awk '{print $2}')
+          echo "Module path: $MOD"
+          [ "$MOD" = "github.com/aniekanasuquookono-web/archiet-microcodegen-go" ] || {
+            echo "::error::go.mod module must be github.com/aniekanasuquookono-web/archiet-microcodegen-go"; exit 1;
+          }
+
+      - name: Verify MICROCODEGEN_GO_PAT is set
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          MICROCODEGEN_GO_PAT: ${{ secrets.MICROCODEGEN_GO_PAT }}
+        run: |
+          if [ -z "$MICROCODEGEN_GO_PAT" ]; then
+            echo "::error::MICROCODEGEN_GO_PAT secret is not set." >&2
+            exit 1
+          fi
+          echo "MICROCODEGEN_GO_PAT present"
+
+      - name: Sync to external repo
+        env:
+          MICROCODEGEN_GO_PAT: ${{ secrets.MICROCODEGEN_GO_PAT }}
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
+        run: |
+          git config --global user.email "ci@archiet.com"
+          git config --global user.name "Archiet CI"
+          git clone https://x-access-token:${MICROCODEGEN_GO_PAT}@github.com/aniekanasuquookono-web/archiet-microcodegen-go ext-go
+          cp -r archiet_microcodegen_go/. ext-go/
+          cd ext-go
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No file changes."
+          else
+            git commit -m "chore: sync from archiet monorepo ${GITHUB_SHA::7}"
+            if [ "$DRY_RUN" != "true" ]; then
+              git push origin main
+            else
+              echo "::notice::dry_run — not pushing to external repo."
+            fi
+          fi
+
+      - name: Tag external repo
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          MICROCODEGEN_GO_PAT: ${{ secrets.MICROCODEGEN_GO_PAT }}
+        run: |
+          # Tag format for go install: v0.1.0 (strip the "go-" monorepo prefix)
+          TAG_VER="${GITHUB_REF_NAME#go-}"
+          echo "Tagging external repo as $TAG_VER"
+          cd ext-go
+          if git rev-parse "$TAG_VER" >/dev/null 2>&1; then
+            echo "::notice::Tag $TAG_VER already exists in external repo — skipping."
+          else
+            git tag "$TAG_VER" -m "Release $TAG_VER"
+            git push origin "$TAG_VER"
+            echo "::notice::Tagged external repo as $TAG_VER — pkg.go.dev will index within minutes."
+          fi