diff --git a/.agents/commands/pr.md b/.agents/commands/pr.md index afd84e95..6950c0c8 100644 --- a/.agents/commands/pr.md +++ b/.agents/commands/pr.md @@ -1,6 +1,6 @@ # /pr - Create or Update a Pull Request -Create or update the PR for the current branch. Invoking `/pr` authorizes the qualified push required for this workflow. +Create or update the PR for the current branch. Invoking `/pr` authorizes the qualified push, attestation comment, and screenshot publication required for this workflow. ## Instructions @@ -95,10 +95,12 @@ Follow `docs/local-e2e.md` rather than duplicating its commands. Use the trusted Before signing or publishing screenshot evidence, fetch `origin/main` and run `git diff --exit-code origin/main -- .github/local-validation/recipe.json .github/local-validation/policy.json .github/local-validation/registry.json`. Stop if any differ: checkout-relative inputs are trusted only after this check. A PR changing the trust inputs must first get those changes reviewed and landed through the trusted default-branch process. -The qualified push may happen before or after the local run, but before posting verify that local HEAD, the remote branch, and the pull request head all equal the signed SHA. Use the documented `local-validation post` command when this workflow or the user authorizes posting; never fabricate a receipt from logs or raw test results and never post the status manually. Screenshot posting is a separate, explicit action and is required only when authorized and material. +The qualified push may happen before or after the local run, but before posting verify that local HEAD, the remote branch, and the pull request head all equal the signed SHA. Use the documented `local-validation post` command when this workflow or the user authorizes posting; never fabricate a receipt from logs or raw test results and never post the status manually. After posting a successful mobile E2E attestation, publish both final-run screenshots with `scripts/local-validation/post-screenshots.sh --post` using the same attestation digest, retained state directory, pinned AgentSCM binary, and iOS/Android artifact directories. Follow the exact invocation in `docs/local-e2e.md`. This is required for every PR with mobile E2E evidence, including CI migrations; `/pr` authorizes the upload and PR comment without another confirmation. Verify that the comment contains both images and binds the current PR head and attestation. A new attested head requires matching screenshots; never reuse screenshots from another run or commit. + +Screenshot publication is part of completing PR delivery, not an optional follow-up. If credentials, artifacts, or upload services are unavailable, report the blocker and leave screenshot delivery outstanding; do not call the PR fully qualified or ready to merge. Do not rerun passing suites just to republish retained valid artifacts. For policy-exempt PRs without a mobile run, state that screenshots are not applicable rather than inventing evidence or running unnecessary mobile suites. Do not run a duplicate broad suite immediately before the producer: its trusted recipe already owns the serial `bun run e2e:ios` then `bun run e2e:android` run. A valid receipt remains usable across an unrelated base fast-forward when its bound merge-base and other context are unchanged. Describe `agentscm/local-validation` as worker-asserted coverage with the limitations in `docs/local-e2e.md`, not as GitHub-run mobile testing or a currently enforced required check unless the live ruleset was verified. ### 8. Register and report -Immediately register the full PR URL with the host thread when a PR-link tool is available. Report the URL, pushed SHA, qualification evidence, signed SHA and posting result when applicable, and any disclosed unverified behavior. +Immediately register the full PR URL with the host thread when a PR-link tool is available. Report the URL, pushed SHA, qualification evidence, signed SHA, attestation and screenshot-comment URLs when applicable (or the explicit screenshot blocker/not-applicable reason), and any disclosed unverified behavior. diff --git a/.agents/rules/test-verification.md b/.agents/rules/test-verification.md index 3b615917..702c971f 100644 --- a/.agents/rules/test-verification.md +++ b/.agents/rules/test-verification.md @@ -48,6 +48,6 @@ When the native merge gate applies, `docs/local-e2e.md` is canonical. Produce th Raw platform evidence may remain useful through review while no relevant edit invalidates it, but it is not the delivery attestation. The final attestation must cover the exact clean committed HEAD after every plan move, documentation commit, and fix, binding its tree, base ref, and merge-base. A later base fast-forward alone does not invalidate a receipt when the bound merge-base and other context remain unchanged. -The producer owns one serial iOS-then-Android recipe run; do not add a duplicate broad suite immediately beforehand. Never create an attestation from logs or raw test output, never post a status manually, and post the actual attestation only through the documented CLI when the active workflow or user authorizes posting. Before posting, verify the pull request remote head equals the signed SHA. Screenshot publication is separate and requires explicit authorization when it is material. +The producer owns one serial iOS-then-Android recipe run; do not add a duplicate broad suite immediately beforehand. Never create an attestation from logs or raw test output, never post a status manually, and post the actual attestation only through the documented CLI when the active workflow or user authorizes posting. Before posting, verify the pull request remote head equals the signed SHA. Every PR with mobile E2E evidence must also publish both final-run screenshots through `scripts/local-validation/post-screenshots.sh --post`, bound to the same head and attestation. `/pr` authorizes this publication; no separate confirmation is needed. Missing screenshot publication is an outstanding delivery blocker. Policy-exempt PRs without mobile runs should report screenshots as not applicable. `agentscm/local-validation` represents a signed AgentSCM `worker_asserted` record with the coverage and limitations documented in `docs/local-e2e.md`; it does not mean GitHub ran the mobile suites. Do not claim the context is enforced by branch protection unless the live ruleset has been verified; the documented rollout says it is not yet required. diff --git a/docs/local-e2e.md b/docs/local-e2e.md index dcfd34c8..9c43dc7c 100644 --- a/docs/local-e2e.md +++ b/docs/local-e2e.md @@ -100,7 +100,19 @@ Create an owner-private, single-line GitHub token file with permission to read t ## Post screenshot evidence -Screenshot posting is separate because AgentSCM `local-validation post` carries only the signed envelope and record. The helper uploads to ImgBB using the same 30-day expiry as the removed hosted-E2E action and creates or updates one PR comment bound to the PR head and attestation digest. It does nothing without the explicit `--post` flag. +Screenshot posting is a separate required delivery step for every PR with mobile E2E evidence because AgentSCM `local-validation post` carries only the signed envelope and record. `/pr` authorizes publishing both final-run screenshots without another confirmation. A missing credential, artifact, or failed upload remains an explicit delivery blocker; policy-exempt PRs without mobile runs report screenshots as not applicable. The helper uploads to ImgBB using the same 30-day expiry as the removed hosted-E2E action and creates or updates one PR comment bound to the PR head and attestation digest. It does nothing without the explicit `--post` flag. + +Store the local ImgBB API key outside the checkout at `~/.config/rnqc/imgbb-api-key`, as one non-empty line. Create an owner-private file and enter the key in your editor so it does not enter shell history: + +```bash +mkdir -p "$HOME/.config/rnqc" +chmod 700 "$HOME/.config/rnqc" +touch "$HOME/.config/rnqc/imgbb-api-key" +chmod 600 "$HOME/.config/rnqc/imgbb-api-key" +nano "$HOME/.config/rnqc/imgbb-api-key" +``` + +This is the repository's documented local credential location, not an automatically discovered default: pass `--imgbb-api-key-file "$HOME/.config/rnqc/imgbb-api-key"` explicitly. Never commit the file or paste its contents into PRs, logs, or chat. A GitHub Actions secret is not automatically available to the local publisher. Before uploading, repeat the fetch and trust-input comparison above; stop on any mismatch. The helper reads checkout-relative trust inputs, so this check is required even when reusing an existing attestation. Use the two run directories printed by the E2E runner: @@ -114,7 +126,7 @@ Before uploading, repeat the fetch and trust-input comparison above; stop on any --ios-artifacts example/build/e2e/ios/ \ --android-artifacts example/build/e2e/android/ \ --github-token-file /absolute/private/path/github-token \ - --imgbb-api-key-file /absolute/private/path/imgbb-api-key + --imgbb-api-key-file "$HOME/.config/rnqc/imgbb-api-key" ``` The helper also accepts `GH_TOKEN` and `IMGBB_API_KEY` instead of files. It never prints either secret or the ImgBB deletion URLs. It refuses stale heads, non-`main` targets, invalid or unsuccessful attestations, missing trusted attestation comments, incomplete artifacts, result/head mismatches and hashes absent from signed stdout.