feat(scripts+ci): swap governance TS-allowlist check to AffineScript-compiled .deno.js#311
Merged
hyperpolymath merged 2 commits intoMay 30, 2026
Conversation
…compiled .deno.js Depends on: #310 Closes the second half of the seed-PR plan from #283: now that the .affine source actually compiles and runs (#310), wire the workflow at the AffineScript-compiled output. ## Changes 1. `scripts/check-ts-allowlist.deno.js` (NEW, 344 lines) - Generated by `affinescript compile --deno-esm` from the post-#310 `.affine` source. Self-contained Deno-ESM bundle with inlined runtime shims for the codegen-known externs (walkRecursive, regexMatch, readTextFile, exit, consoleError) and the public `split` / `ends_with` helpers. Auto-invokes `await main()` at module load — same shape Deno runs the existing `.ts` with. 2. `.github/workflows/governance-reusable.yml:193` - `deno run ... check-ts-allowlist.ts` → `... check-ts-allowlist.deno.js` - Comment block explains the dual-target window: .ts is kept for the regression suite (`scripts/tests/check-ts-allowlist-test.sh`) and for parallel-validation; retirement is a separate follow-up. ## Why ship the compiled artifact (vs compile-in-CI) Compile-in-CI would require an AffineScript toolchain in the workflow (currently OCaml + dune + the affinescript repo checked out as a dep). The compiler is deterministic for this surface; committing the output keeps CI provider-free and matches the precedent in `affinescript/tests/codegen-deno/*.deno.js` (committed golden files). Drift between source and committed output is the obvious risk. A follow-up PR will add a `just check-ts-allowlist-drift` recipe (recompile + diff) wired into a non-blocking CI lint, mirroring the golden-file maintenance pattern in the affinescript repo. ## Verification End-to-end runtime test of the compiled output (per PR #310 commit msg b046787): empty dir -> exit 0, success line src/Foo.ts violation -> exit 1, error block + file list mod.ts (filename ok) -> exit 0 scripts/x.ts (dir ok) -> exit 0 Workflow YAML linting: this change is one line of `run:` text; the governance-reusable.yml workflow is unchanged in shape, only its script target moves. ## Test plan - [ ] CI green on this branch (note: AS scanner / Hypatia / SPARK Theatre Gate may need to acknowledge the new committed .deno.js as a generated artifact; ignore findings tagged as generated) - [ ] `scripts/tests/check-ts-allowlist-test.sh` still passes against the unchanged .ts archetype - [ ] Caller repos using `governance-reusable.yml` show green "Check for TypeScript" steps after merge Refs #239 (umbrella TS→AffineScript), #241 (STEP 2 tail-batch-1). Follow-up plan: add drift-detection lint; then a separate PR retires the .ts archetype after a parallel-validation window. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Closed
3 tasks
…o.js runtime Mirrors the workflow swap in this PR. Three updates to `docs/EXEMPTION-MECHANISMS.adoc`: 1. Layer 4a description — point at `scripts/check-ts-allowlist.affine` as the source of truth, note the compiled `.deno.js` is what the workflow actually runs. 2. History — add a fourth bullet covering standards#283 / #310 / #311: the TS→AffineScript port arc, with the dual-target rationale spelled out (`.ts` kept for regression suite + parallel-validation; `.deno.js` is the workflow target). 3. Cross-references — replace the single `.ts` line with three lines covering all three files (.affine source / .deno.js runtime / .ts archetype) and what each is for. Reduces "which file should I edit?" ambiguity for the next contributor. No behavioural change; pure doc alignment so the prose matches the workflow + source layout after #311 lands. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on: #310
Second half of the seed-PR plan from #283: once the
.affinesource actually compiles + runs (#310), wire the workflow at the AffineScript-compiled output.Changes
scripts/check-ts-allowlist.deno.js(NEW, 344 lines)affinescript compile --deno-esmfrom the post-fix(scripts): make check-ts-allowlist.affine compile cleanly (follow-up to #283) #310.affinesource. Self-contained Deno-ESM bundle: inlined runtime shims for codegen-known externs (walkRecursive, regexMatch, readTextFile, exit, consoleError) + thesplit/ends_withhelpers. Auto-invokesawait main()at module load — same shape Deno runs the existing .ts with..github/workflows/governance-reusable.yml:193deno run ... check-ts-allowlist.ts→... check-ts-allowlist.deno.jsscripts/tests/check-ts-allowlist-test.sh) and for parallel-validation; retirement is a separate follow-up after the validation window.Why ship the compiled artifact (vs compile-in-CI)
Compile-in-CI would require an AffineScript toolchain in the workflow (OCaml + dune + affinescript repo as a dep). The compiler is deterministic for this surface; committing the output keeps CI provider-free and matches the precedent in
affinescript/tests/codegen-deno/*.deno.js(committed golden files).Drift between source and committed output is the obvious risk. Follow-up will add a
just check-ts-allowlist-driftrecipe (recompile + diff) wired into a non-blocking CI lint.Verification
End-to-end runtime test of the compiled output (matches the runtime fix in PR #310 commit b046787):
src/Foo.tsviolationmod.ts(filename ok)scripts/x.ts(dir ok)Test plan
.deno.jsas a generated artifact (ignore findings tagged as generated)scripts/tests/check-ts-allowlist-test.shstill passes against the unchanged .ts archetype (no behavioural change to .ts)governance-reusable.ymlshow green "Check for TypeScript" steps after mergeRefs #239 (umbrella TS→AffineScript), #241 (STEP 2 tail-batch-1). Follow-up plan: add drift-detection lint, then a separate PR retires the .ts archetype after the parallel-validation window.
Generated with Claude Code