Skip to content

feat(scripts): registry query layer (#748) - #749

Closed
diberry wants to merge 20 commits into
devfrom
squad/748-registry-query-layer
Closed

diberry wants to merge 20 commits into
devfrom
squad/748-registry-query-layer

Conversation

@diberry

@diberry diberry commented Apr 2, 2026

Copy link
Copy Markdown
Contributor

Closes #748

Implements the registry query layer PRD (docs/proposals/registry-query-layer.md).
Shared foundation that both #670 (layout manifest) and #733 (impact analysis) consume.

What's in this PR

  • *\scripts/registry-query.mjs* — 5 exported functions:

    • \loadRegistry()\ — load and parse repo-registry.json

    • esolveFile()\ — single file → module/owner/package/tier resolution (longest-prefix match)
    • \�nalyzeFiles()\ — batch analysis producing AnalysisResult with aggregates
    • \computeRiskTier()\ — risk tier computation (LOW/MEDIUM/HIGH/CRITICAL)
    • \getInvolvedOwners()\ — deduplicated, ranked owner list
  • *\ est/registry-query.test.ts* — 33 test cases covering all acceptance criteria

  • Changeset for patch release

Dependencies

Depends on: PR #737 (repo registry data — includes
egistry-utils.mjs\ and
epo-registry.json\ as prereqs)
Feeds into: #670, #733

Working as EECOM (Core Dev)

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

Copilot AI review requested due to automatic review settings April 2, 2026 17:04

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Implements a shared “registry query layer” over .squad/repo-registry.json to support consistent file→module/owner/package resolution, batch analysis, risk scoring, and owner aggregation for downstream tooling (layout manifest + impact analysis).

Changes:

  • Added scripts/registry-query.mjs with functions for registry loading, file resolution, batch analysis, risk tier computation, and owner aggregation.
  • Added test/registry-query.test.ts with a comprehensive Vitest suite covering resolution, aggregation, and risk tier behavior.
  • Added/updated registry data + metadata (.squad/repo-registry.json) and project bookkeeping (decision/history entries + changeset).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.

Show a summary per file
File Description
scripts/registry-query.mjs Core query + analysis API over repo registry (resolve/analyze/risk/owners).
test/registry-query.test.ts Validates file resolution, aggregates, risk tier thresholds, and owner ranking.
scripts/registry-utils.mjs Low-level registry utilities (includes some encoding issues in comments).
.squad/repo-registry.json Committed registry dataset + metadata used by tests and scripts.
.squad/decisions/inbox/eecom-registry-query-impl.md Records implementation decision (date currently in the future).
.squad/agents/eecom/history.md Captures implementation learnings (date currently in the future).
.changeset/registry-query-layer.md Declares a patch release for @bradygaster/squad-cli.

Comment thread scripts/registry-query.mjs Outdated
Comment on lines +4 to +6
* Builds on top of registry-utils.mjs (PR #737) to provide batch file analysis,
* risk tier computation, and owner aggregation. Shared foundation consumed by
* #670 (layout manifest) and #733 (PR impact analysis).

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The header comment says this module “builds on top of registry-utils.mjs”, but registry-query.mjs re-implements module resolution internally and never imports registry-utils. Update the docstring to reflect the actual dependency model (pure functions over passed-in registry) to avoid misleading future consumers.

Suggested change
* Builds on top of registry-utils.mjs (PR #737) to provide batch file analysis,
* risk tier computation, and owner aggregation. Shared foundation consumed by
* #670 (layout manifest) and #733 (PR impact analysis).
* Provides pure functions over a passed-in registry object to perform batch
* file analysis, risk tier computation, and owner aggregation. Includes a
* small convenience helper to load the registry JSON from disk. Shared
* foundation consumed by #670 (layout manifest) and #733 (PR impact analysis).

Copilot uses AI. Check for mistakes.
Comment thread scripts/registry-query.mjs Outdated
Comment on lines +1 to +9
/**
* registry-query.mjs — Query & analysis layer for .squad/repo-registry.json.
*
* Builds on top of registry-utils.mjs (PR #737) to provide batch file analysis,
* risk tier computation, and owner aggregation. Shared foundation consumed by
* #670 (layout manifest) and #733 (PR impact analysis).
*
* @module scripts/registry-query
*/

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description references a PRD at docs/proposals/registry-query-layer.md, but that file isn’t present in the repo (no matches). Either add the PRD document at that path or update references to the correct location so reviewers/consumers can validate acceptance criteria.

Copilot uses AI. Check for mistakes.
Comment thread scripts/registry-query.mjs Outdated
if (f.package) packagesSet.add(f.package);

// Owners
if (f.primaryOwner) ownersSet.add(f.primaryOwner);

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

analyzeFiles() only adds primaryOwner to ownersTouched; secondary owners are omitted from the summary even when they’re involved via moduleDetails. If ownersTouched is intended to represent all involved owners, include secondaryOwner in the aggregation (and consider whether template/critical non-module owners should be represented too).

Suggested change
if (f.primaryOwner) ownersSet.add(f.primaryOwner);
if (f.primaryOwner) ownersSet.add(f.primaryOwner);
if (f.secondaryOwner) ownersSet.add(f.secondaryOwner);

Copilot uses AI. Check for mistakes.
Comment thread scripts/registry-query.mjs Outdated
Comment on lines +222 to +224
// Boundary crossing: modules spanning >1 package
const boundariesCrossed =
packagesTouched.length > 1 ? modulesTouched.length - 1 : 0;

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

boundariesCrossed is described as a cross-package concept, but the current calculation (modulesTouched.length - 1 when >1 package) will overcount whenever multiple modules exist within the same package (e.g., 10 modules across 2 packages yields 9). Consider computing this as packagesTouched.length - 1, or explicitly count modules whose package differs from the first package, depending on the intended definition.

Suggested change
// Boundary crossing: modules spanning >1 package
const boundariesCrossed =
packagesTouched.length > 1 ? modulesTouched.length - 1 : 0;
// Boundary crossing: cross-package span (number of additional packages beyond the first)
const boundariesCrossed =
packagesTouched.length > 1 ? packagesTouched.length - 1 : 0;

Copilot uses AI. Check for mistakes.
Comment thread scripts/registry-utils.mjs Outdated
const registry = loadRegistry();
let normalized = filePath.replace(/\\/g, '/').replace(/^\.\//, '');

// Determine package from file path prefix (e.g. packages/squad-sdk/ → squad-sdk)

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment contains mojibake (“Γ寔), which suggests an encoding issue. Replace it with the intended symbol/text (e.g., “→”) to keep the file ASCII/UTF-8 clean and readable.

Suggested change
// Determine package from file path prefix (e.g. packages/squad-sdk/ → squad-sdk)
// Determine package from file path prefix (e.g. packages/squad-sdk/ → squad-sdk)

Copilot uses AI. Check for mistakes.
Comment thread .squad/repo-registry.json Outdated
@@ -0,0 +1,524 @@
{
"generated": "2026-04-02T12:14:27.294Z",
"generator": "scripts/generate-repo-registry.mjs",

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The registry metadata claims it was generated by scripts/generate-repo-registry.mjs, but that script isn’t present in the repository. Either add the generator at that path or update the metadata to the actual generator script so the registry can be regenerated reliably.

Suggested change
"generator": "scripts/generate-repo-registry.mjs",
"generator": ".squad/scripts/generate-repo-registry.mjs",

Copilot uses AI. Check for mistakes.
Comment thread .squad/repo-registry.json Outdated
"unknown": {
"level": 5,
"impact": 0,
"description": "Unmapped path ΓÇö update routing.md"

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This string includes mojibake (“ΓÇö”), which suggests an encoding issue in the generator output. Replace it with the intended em dash (—) (and ensure the generator writes UTF-8) so the committed JSON is clean and searchable.

Suggested change
"description": "Unmapped path ΓÇö update routing.md"
"description": "Unmapped path — update routing.md"

Copilot uses AI. Check for mistakes.
Comment thread .changeset/registry-query-layer.md Outdated
Comment on lines +1 to +5
---
"@bradygaster/squad-cli": patch
---

feat: registry query layer — shared foundation for layout manifest and impact analysis (#748)

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This changeset targets @bradygaster/squad-cli, but the PR changes are in repo-root scripts and .squad data, and there are no references/usages of registry-query under packages/. If this isn’t a published package change, consider removing the changeset or targeting the correct package/release mechanism.

Suggested change
---
"@bradygaster/squad-cli": patch
---
feat: registry query layer — shared foundation for layout manifest and impact analysis (#748)

Copilot uses AI. Check for mistakes.
diberry and others added 19 commits April 2, 2026 10:42
Add a GitHub Action workflow that runs on every pull_request event and
posts/updates a checklist comment showing contributors exactly what needs
fixing before their PR is review-ready.

Checks: single commit, not draft, branch up to date, Copilot review,
changeset present, no merge conflicts, CI passing.

Includes proposal doc at docs/proposals/pr-readiness-checks.md evaluating
three approaches (Action-only, rulesets-only, hybrid) with rationale for
the Action approach.

Updates CONTRIBUTING.md with a PR Readiness Checklist section so
contributors know what to expect.

Closes #750

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add squad-comment-moderation.yml — a GitHub Action that auto-detects and
hides spam comments on issues and PRs using a multi-signal scoring system.

Signals checked: account age, repo association, recruitment keywords,
crypto/SEO spam patterns, excessive URLs, and comment length.
Only comments matching multiple signals (score >= 5) are hidden.
Legitimate first-time contributors are not affected.

Includes:
- Workflow file (.github/workflows/squad-comment-moderation.yml)
- Design proposal (docs/proposals/comment-spam-protection.md)
- CONTRIBUTING.md update with moderation notice

Closes #751

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Fix reversed compareCommitsWithBasehead base/head order and use behind_by
- Document fork PR read-only GITHUB_TOKEN limitation
- Paginate listComments to find marker comment beyond first 100
- Paginate listFiles with per_page: 100 (GitHub API cap) instead of 300
- Use absolute GitHub URLs instead of relative links in PR comments
- Clarify workflow only minimizes comments, does not block users
- Use absolute URL for moderation notice proposal link
- Remove unused accountAge/accountAgeDays variables (use API-fetched value)
- Add scope note distinguishing PR readiness (#750) from comment moderation (#751)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add timeout-minutes: 5 to the moderate job
- Add bot-type skip condition (github.event.sender.type != 'Bot')
- Fix blob/main -> blob/dev in moderation notice URL
- Add recursion-safety comment (GITHUB_TOKEN can't re-trigger)
- Add changeset for the new workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Extract the pure spam-scoring logic from the inline github-script block in
squad-comment-moderation.yml into scripts/comment-moderation.mjs. The workflow
now imports shouldSkipComment, scoreComment, and buildModerationNotice from the
module and acts as a thin orchestrator (fetch data → score → act).

A checkout step (actions/checkout with sparse-checkout) fetches only the scoring
module so the workflow can import it at runtime.

Closes #751

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
35 vitest tests covering all scoring signals, threshold behavior, and edge
cases for the extracted comment-moderation.mjs module:

- shouldSkipComment: trusted associations, bot senders, legacy payloads
- scoreComment: account age, author association, recruitment keywords,
  crypto/SEO/gambling keywords, URL count, long-comment signal
- Threshold: combined scoring, below-threshold, aggregate all signals
- Edge cases: empty body, defaults, zero-day account, boundary values
- buildModerationNotice: signal rendering, repo link, restoration text

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Revert .squad/agents/*/history.md files to match dev branch.
Remove .squad/decisions/inbox/flight-pr-readiness.md,
docs/proposals/comment-spam-protection.md, and
docs/proposals/pr-readiness-checks.md which were added in this
branch but belong in separate PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move orchestration logic (user lookup, scoring, comment minimize, notice
posting) from inline actions/github-script block into the standalone
scripts/comment-moderation.mjs module.  The workflow now uses a plain
\
un: node scripts/comment-moderation.mjs\ step with env vars.

- Add run() orchestrator with injectable fetch for testability
- Use native fetch (Node 18+) for GitHub REST + GraphQL API calls
- Add 11 orchestration tests (skip, threshold, minimize, notice, errors)
- Workflow YAML now has ZERO JavaScript — only YAML with run: steps

All 46 tests pass.

Closes #753

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Remove squad-pr-readiness.yml (belongs to #750 PR readiness checks)
- Remove PR Readiness Checklist section from CONTRIBUTING.md
- Update scope note to reference only comment moderation (#751)
- Revert eecom history to dev state

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replaces our hand-tuned 300-line scoring script with GitHub's official
AI-powered comment moderator. Less code to maintain, smarter detection,
and GitHub-supported.

Closes #751

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@diberry
diberry force-pushed the squad/748-registry-query-layer branch from 0812ba1 to 437e750 Compare April 2, 2026 22:26
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: registry query layer — shared foundation for layout manifest (#670) and impact analysis (#733)

2 participants