fix: align scaffold output with current ecosystem patterns#45
Merged
TMHSDigital merged 1 commit intomainfrom Apr 26, 2026
Merged
fix: align scaffold output with current ecosystem patterns#45TMHSDigital merged 1 commit intomainfrom
TMHSDigital merged 1 commit intomainfrom
Conversation
Dependency ReviewThe following issues were found:
License Issues.github/workflows/validate.yml
OpenSSF Scorecard
Scanned Files
|
The scaffold under scaffold/templates/ drifted from the patterns adopted
across the 9 existing tool repos. New tool repos created from the scaffold
required substantial post-creation fixes to reach current standards. This
change brings scaffold output forward to current and adds CI regression
protection.
Per DTD#41, eight named gaps:
- validate.yml.j2: add validate-counts job that compares skills/ and
rules/ directory counts against README.md (DTD#39 pattern from Plaid).
- drift-check.yml.j2: new template, pinned to drift-check@v1.9 with
mode: self and gh-summary format.
- release.yml.j2: now consumes release-doc-sync@v1, adopts Blender's
initial-release version-handling branch (holds version at current
manifest value when no prior tag exists), and adds floating major and
major.minor tag automation (git tag -f then push --force).
- label-sync.yml.j2: new template using Home-Lab's self-healing per-label
gh label create --force pattern (DTD#4).
- dependabot.yml.j2: new template with github-actions ecosystem entry
plus pip ecosystem for the mcp-server directory when --mcp-server is
set.
- CLAUDE.md.j2: add **Version:** 0.1.0 / **License:** / **Author:** lines
so release-doc-sync can rewrite the version line on every release.
- ROADMAP.md.j2: add <!-- standards-version: --> marker and
**Current:** v0.1.0 line so release-doc-sync can update it.
- AGENTS.md.j2: confirmed already carries the standards-version marker;
no change needed.
Two additional gaps from the Blender v0.1.1 compliance fix:
- LICENSE.j2 (gap 9): the cc-by-nc-nd-4.0 default branch is now aligned
byte-for-byte with Plaid's LICENSE: copyright "TM Hospitality Strategies"
(the ecosystem entity name, not the GitHub org), the canonical CC text,
and a trailing SPDX-License-Identifier: CC-BY-NC-ND-4.0 line. The
previous text used {{ author_name }} (defaulting to "TMHSDigital") and
was missing the SPDX identifier.
- CONTRIBUTING.md.j2 (gap 10): standards/licensing.md mandates the
inbound DCO + license grant in every CONTRIBUTING.md (verbatim grant
paragraph plus Signed-off-by guidance). The scaffold now emits this
section. Existing tool repos that predate this change need a backfill
PR per repo, tracked separately.
Pre-existing scaffold bugs surfaced and fixed in the same diff so the
scaffold output actually parses as valid YAML now:
- pages.yml.j2 used a per-line {% raw %}${{ }}{% endraw %} pattern that
Jinja2's trim_blocks=True collapsed onto adjacent lines, producing
invalid YAML at the environment.url / runs-on boundary.
- release.yml.j2 had the same trim_blocks collapse pattern on every
${{ }} reference and additionally used the broken plain-scalar
python3 -c "..." form in the version-update step.
- validate.yml.j2 used the same broken plain-scalar python3 -c "..."
form across three steps; rewritten as block-scalar python3 << 'PYEOF'
heredocs which match Plaid's pattern.
CI regression protection (.github/workflows/validate.yml):
- validate-scaffold now installs PyYAML alongside Jinja2, and after the
dry-run runs yaml.safe_load on every emitted .yml file. This catches
any future trim_blocks-style escaping bug at PR time.
- validate-scaffold gained a Scaffold regression checks for DTD#41
patterns step that greps for each named pattern (validate-counts,
drift-check@v1.9, release-doc-sync@v1, initial-release branch,
floating major tag, self-healing labels, github-actions ecosystem,
**Version:** line, **Current:** line, standards-version markers,
TM Hospitality Strategies copyright, SPDX identifier, DCO).
- File-existence list extended to cover release.yml, stale.yml,
drift-check.yml, label-sync.yml, dependabot.yml.
Existing tool repos are unaffected by this change. Future scaffold-
generated repos land at current standards from creation, with no
post-creation cleanup required.
Closes #41
Made-with: Cursor
TMHSDigital
force-pushed
the
fix/scaffold-drift-dtd41
branch
from
c359f2d to
58bd127
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns scaffold output with current ecosystem patterns and adds CI regression protection so this drift cannot recur silently.
Scope
Eight named gaps from #41 plus two surfaced during the Blender v0.1.1 compliance fix.
From #41
drift-check@v1.9,mode: selfmeta-repo-ref: v1(DTD#42 fixed the default)v$new_version,v$major,v$major.$minoron every releasegh label create --forcepattern (DTD#4)github-actionsecosystem pluspipformcp-server/when applicable**Version:** 0.1.0and**Current:** v0.1.0lines added sorelease-doc-synccan rewrite them; ROADMAP gains<!-- standards-version: -->marker; AGENTS.md.j2 already had its markerBeyond #41
Gap 9, LICENSE template. Verified the scaffold's CC-BY-NC-ND-4.0 default branch. Two issues found and fixed:
{{ author_name }}defaulting toTMHSDigital; corrected toTM Hospitality Strategies(the ecosystem entity name used by every existing tool repo).Gap 10, CONTRIBUTING.md DCO. Verified DCO is documented in
standards/licensing.mdandstandards/security.md. The standard mandates a verbatim inbound grant paragraph in every CONTRIBUTING.md plus DCO sign-off guidance. The scaffold now emits this section. Existing tool repos that predate this change need backfill PRs per repo, tracked separately.Pre-existing scaffold bugs surfaced and fixed
While verifying the dry-run output, three pre-existing Jinja2 / YAML bugs in scaffolded files turned up. Each rendered output that strict YAML parsers reject. They were never caught because the meta-repo's
validate-scaffoldjob only didtest -f. Fixed in the same diff to keep scaffold output usable.pages.yml.j2: per-line{% raw %}${{ }}{% endraw %}pattern collapses adjacent lines undertrim_blocks=True, producing invalid YAML at theenvironment.url/runs-onboundary.release.yml.j2: same collapse pattern across many steps; rewritten with multi-line{% raw %}blocks.validate.yml.j2: three steps used a broken plain-scalarrun: python3 -c "..."form spanning multiple lines (an inner:becomes a YAML mapping separator). Rewritten as block-scalarpython3 << 'PYEOF'heredocs to match Plaid's pattern.CI regression protection
.github/workflows/validate.ymlvalidate-scaffoldjob:PyYAMLalongside Jinja2.yaml.safe_loadon every emitted.ymlfile. Catches any future trim_blocks escaping bug at PR time.Scaffold regression checks for DTD#41 patternsstep greps for each named pattern (validate-counts,drift-check@v1.9,release-doc-sync@v1, initial-release branch, floating major tag, self-healing labels,github-actionsecosystem,**Version:**line,**Current:**line, standards-version markers,TM Hospitality Strategiescopyright, SPDX identifier, DCO).Verification
Local dry-run with
--mcp-server --skills 2 --rules 1and again without--mcp-server. Both passyaml.safe_loadfor all generated .yml files and all 15 regression-check patterns.Impact
Closes #41.