Skip to content

feat: Ship RepoMan v0.1.0 as a self-contained plugin - #52

Merged
rubambiza merged 11 commits into
rossoctl:mainfrom
rubambiza:feat/repoman-v010-release
Oct 27, 2026
Merged

feat: Ship RepoMan v0.1.0 as a self-contained plugin#52
rubambiza merged 11 commits into
rossoctl:mainfrom
rubambiza:feat/repoman-v010-release

Conversation

@rubambiza

@rubambiza rubambiza commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

Ships RepoMan v0.1.0 as one self-contained repoman plugin: the entrypoint, every
program skill (scanner + fixer pairs, pr-review flagship), and the engine — all in a
single install, so a user installs once and can enable more programs on the fly.

Changes

  • Vendor tool (scripts/vendor-engine.sh + tests/test-vendor-engine.sh):
    explicit-manifest copy of the 23 engine scripts from a rossoctl/automation checkout
    into skills/repoman/scripts/, plus a _vendor.json provenance stamp recording the
    source commit SHA. Fails loud on a missing source; idempotent.
  • Bundle the repoman plugin: widen the marketplace repoman entry to carry all
    program skills; reconcile the marketplace version 1.0.0 -> 0.1.0.
  • Vendor the engine: the 23 scripts + _vendor.json, stamped at automation HEAD.
  • Rewire skills/repoman/SKILL.md: resolve the engine from the bundled
    ${CLAUDE_PLUGIN_ROOT}/skills/repoman/scripts/ (via REPOMAN_RUN_BIN) instead of an
    "automation checkout" — no separate checkout needed.
  • README: recommend installing repoman (the bundle), correct the stale
    "install does not pull in others" claim, and note engine fixes fan out via a single
    repoman plugin update.
  • Declare bash 3.2+ for all skills: the dep-bump / link-health /
    automation-health skills declared bash 4+ but use no bash-4 features (verified), so
    they now run on stock macOS bash when used standalone.

Design

  • The engine is bundled flat so the orchestrator's _bin resolution and each scanner's
    sibling-sourcing work unchanged (zero engine code change).
  • Standalone program plugins are kept for one-off use (e.g. a throwaway PR review),
    vendored from the same source so one update reaches both standalone and bundle users.

Not in this PR

Verification

test-vendor-engine.sh green (6/6); the bundled engine self-sources
(program-lib.sh + modules, repoman-run.sh --help); marketplace.json valid with all 9
skills; no "automation checkout" references remain; bash-3.2 safety confirmed by
construct scan + bash -n. Reviewed on a fresh context — no correctness defects.

Assisted-By: Claude Code

Companion PR: rossoctl/automation#120

@rubambiza
feat: Add engine vendor script with provenance stamp
8ff69ec 
Explicit-manifest copy of the 23 automation engine scripts into the
repoman plugin scripts dir, plus a _vendor.json stamp recording the
source HEAD sha, date, and file list. Fails loud on a missing source.
Reuses the Phase 6 pinned-SHA provenance idea.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
feat: Bundle program skills into repoman plugin; v0.1.0
ad0e4d1 
Widen the repoman marketplace entry to carry all program skills
(scanner+fixer pairs, pr-review flagship) and reconcile the marketplace
version 1.0.0 -> 0.1.0.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
docs: Point SKILL.md at the bundled engine
6ea65e0 
Replace all 'automation checkout' instructions with the bundled
${CLAUDE_PLUGIN_ROOT}/skills/repoman/scripts engine dir + REPOMAN_RUN_BIN.
Swept the whole file: three stale engine-location refs updated.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
feat: Vendor the v0.1.0 engine into the repoman plugin
3f517a6 
Run vendor-engine.sh to bundle the 23 automation engine scripts +
_vendor.json provenance stamp into skills/repoman/scripts. Verified the
flat dir self-sources (program-lib + modules) and repoman-run.sh runs.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
docs: Update README for the self-contained repoman bundle
568cc81 
Recommend installing repoman (bundles all program skills + engine),
correct the stale 'install does not pull in others' claim, fix the
blanket bash-4+ prerequisite, and note engine fixes fan out via a
repoman plugin update.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
docs: Declare bash 3.2+ for all skills (stock macOS)
dc02606 
The dep-bump/link-health/automation-health skills declared bash 4+ but
use no bash-4 features (no declare -A, mapfile/readarray, or case-conv;
all scripts parse clean). Flip them to 3.2+ so every program/skill runs
standalone on the macOS system bash, and blanket the README to match.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
chore: Re-stamp vendored engine at automation HEAD
27760a5 
Re-run vendor-engine.sh so _vendor.json.source_sha names the current
automation HEAD. The 23 engine scripts are unchanged (byte-identical);
only the provenance stamp advances.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza rubambiza mentioned this pull request Oct 23, 2026
Merged
@rubambiza rubambiza added the ready-for-ai-review Request automated AI code review from clawgenti label Oct 23, 2026
@rubambiza
docs: Add CHANGELOG for v0.1.0
f5ebe55 
First tagged release: self-contained repoman plugin bundling the
entrypoint + 6 programs + vendored engine. Credits contributors;
Keep a Changelog / SemVer format.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
clawgenti
clawgenti reviewed Oct 23, 2026
View reviewed changes

@clawgenti clawgenti left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ships RepoMan v0.1.0 as one self-contained repoman plugin: 23 engine scripts vendored into skills/repoman/scripts/ (verified byte-exact against automation@01e25ebb, matching the _vendor.json stamp), the marketplace repoman entry widened to 9 skills with version reconciled to 0.1.0, and skill paths rewired to ${CLAUDE_PLUGIN_ROOT}. Non-blocking findings below.

Findings

  • suggestion scripts/vendor-engine.sh:31 — the check-then-copy loop can leave a half-vendored dest holding a stale provenance stamp.
  • suggestion skills/repoman/scripts/dep-bump-fixer.sh:56 + dep-bump-scanner.sh:51 — stale bash 4+ headers contradict this PR's bash 3.2+ declarations.

Reviewed by clawgenti using the github-pr-review skill

Comment thread scripts/vendor-engine.sh Resolved
Comment thread skills/repoman/scripts/dep-bump-fixer.sh Outdated
REPORTS_DIR (optional) Where to write reports (default: ~/reports/dep-bump)

PREREQUISITES:
bash 4+, gh (authenticated), jq

@clawgenti clawgenti Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: This vendored copy still declares bash 4+, contradicting this PR's bash 3.2+ declarations (the standalone skills/dep-bump-fixer/SKILL.md now says 3.2+, and no bash-4 constructs are used). Since the bundle must stay byte-exact with the automation source, the fix belongs upstream in rossoctl/automation followed by a re-vendor — the same stale header also survives in the standalone skills' scripts, which the #51 resync will carry.

@rubambiza rubambiza Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed upstream then re-vendored, per your note — the bash 4+ header is corrected to bash 3.2+ in rossoctl/automation (0311752) and re-vendored in e5434ba, so the bundle stays byte-exact with its source.

Comment thread skills/repoman/scripts/dep-bump-scanner.sh Outdated
REPORTS_DIR (optional) Where to write reports (default: ~/reports/dep-bump)

PREREQUISITES:
bash 4+, gh (authenticated), jq

@clawgenti clawgenti Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: Same as dep-bump-fixer.sh: this vendored copy still declares bash 4+ while this PR declares bash 3.2+ everywhere else (no bash-4 constructs used — verified). Fix the header upstream in rossoctl/automation and re-vendor so the bundle stays byte-exact with its source.

@rubambiza rubambiza Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same fix as dep-bump-fixer.sh — header corrected upstream (0311752) and re-vendored in e5434ba.

@rubambiza
fix: Address clawgenti review on rossoctl#52
e5434ba 
- vendor-engine.sh: pre-validate the whole manifest before copying so a
  missing source can't leave a half-vendored dir (+ regression test).
- Re-vendor from automation 0311752: picks up the corrected dep-bump
  bash 3.2+ headers, keeping the bundle byte-exact with its source.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
clawgenti
clawgenti reviewed Oct 23, 2026
View reviewed changes

@clawgenti clawgenti left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-review of the two commits since 27760a5: both previous findings are resolved — vendor-engine.sh now pre-validates the whole manifest before copying anything (with a regression test asserting the dest stays empty on failure), and the vendored dep-bump scripts now declare bash 3.2+. All 23 vendored engine scripts verified byte-exact against the _vendor.json stamp (automation@0311752), and test-vendor-engine.sh passes 7/7.

All checks pass. Ready for human review.

Reviewed by clawgenti using the github-pr-review skill

@rubambiza rubambiza added ready-for-human-review AI review passed, ready for human reviewer and removed ready-for-ai-review Request automated AI code review from clawgenti labels Oct 23, 2026
@rubambiza
docs: Remove spec-path references from vendor script/test
d94103c 
Cite the stable epic (rossoctl/automation#72) instead of
docs/specs/...§5-6 — spec paths and section numbers go stale on rename.

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
@rubambiza
docs: Add Jim Cadden to v0.1.0 contributors
d0ee788 
Credit architecture input + pending contributions (jimcadden#1).

Assisted-By: Claude Code (Anthropic AI) <noreply@anthropic.com>

Signed-off-by: Gloire Rubambiza <gloire@ibm.com>
jimcadden
jimcadden approved these changes Oct 23, 2026
View reviewed changes

@jimcadden jimcadden left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rubambiza rubambiza self-assigned this Oct 27, 2026
@rubambiza
rubambiza merged commit f81b08d into rossoctl:main Oct 27, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jimcadden jimcadden jimcadden approved these changes
+1 more reviewer
@clawgenti clawgenti clawgenti left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@rubambiza rubambiza

Labels

ready-for-human-review AI review passed, ready for human reviewer

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@rubambiza @jimcadden @clawgenti