V0.9.0/dotnet segregated assets - #37
Merged
Merged
Conversation
Add AI/LLM Evaluation Automation Prohibition as Priority 1 rule in AGENTS.md, clarify commit skill routing for git-visual-commits, and update README to emphasize deterministic local validation. Eval prompts and fixtures are versioned review specifications whose presence never authorizes automated model execution.
Reorganize git-visual-commits and git-keep-a-changelog skill routing logic. Add 'Invocation Routing Lock' section to clarify when each skill is selected. Update skill descriptions to emphasize authoritative command routing (git bot commit, git commit, git our commit) and prevent yolo/auto from activating unrelated skills. Add comprehensive evals for both skills reflecting the updated routing contracts.
Remove benchmark automation infrastructure (run-skill-benchmark.ps1, skill-benchmark/, test-run-skill-benchmark.ps1) that relied on authenticated model execution. Update validate-skill-templates.ps1 to emphasize deterministic local checks: metadata-only mode for quick frontmatter validation, per-skill validator runs during iteration, full validation gate before completion. Aligns with the new AI/LLM Evaluation Automation Prohibition.
Adds a new skill for migrating ASP.NET Core web applications to serve static assets from a separate hardened static-content host (Codebelt Static Content Provider) while keeping conventional wwwroot authoring. This achieves architectural separation of concerns: developers keep editing in the familiar wwwroot location, but deployed static content is decoupled from business logic, enabling independent deployment, scaling, and cache control. The skill includes a deterministic runner that inspects static-asset topology, classifies app-owned vs shared CDN assets, detects risky scenarios (Blazor, RCL, generated assets), proves the publish invariant, and orchestrates local development with a hardened origin container and production image. Includes comprehensive reference docs, eval cases across diverse scenarios (MVC, Blazor, RCL, frontend-build, Cuemon-equipped apps), and validation scripts.
Greptile SummaryThe PR introduces the
Confidence Score: 4/5The PR is not yet safe to merge because local verification can still accept an unrelated opaque Compose topology for the selected web project. The new selector prevents several explicit cross-project matches, but its sole-unattributed-candidate fallback supplies a root-level Compose file to any nested selected project, allowing that unrelated topology to satisfy local verification. Files Needing Attention: skills/dotnet-segregated-assets/scripts/segregate-assets.cs Important Files Changed
Prompt To Fix All With AI### Issue 1
skills/dotnet-segregated-assets/scripts/segregate-assets.cs:1159-1161
**Opaque Compose topology is misattributed**
When a multi-web-project repository has one root-level asset-origin Compose file that names no recognized project directory, this fallback assigns it to whichever nested project is selected, allowing the unrelated topology to satisfy `verify --check-local` while the selected project has no corresponding asset-origin service.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (13): Last reviewed commit: "📝 update changelog for 0.9.0 release" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Reorder classification logic so RiskyGeneratedAssets takes precedence over AlreadySegregated detection, preventing false negatives on risky static assets in partially segregated projects. Make local verification stricter by requiring both launch profile and Compose service presence. Add CDN-equivalent option to allow projects without wwwroot to consume shared/CDN asset roots. Add TestAlreadySegregatedRiskIsRisky assertion to catch regression.
Add three new eval test cases covering verification edge cases: checking that local verification requires both launch profile and Compose service (not just publish invariant cleanliness), that risky-asset classification blocks execution even when segregation is already complete, and that projects without wwwroot can produce CDN-only work when shared asset roots are available. Add corresponding test fixtures and harness assertions.
Add feature bullet documenting the skill's fail-closed verification and planning behavior: local verification requires both matching HTTP launch profile and origin Compose service, generated-asset risks override existing-segregation detection, and no-wwwroot projects can still produce CDN-only work when shared equivalents exist.
Add Docker-documented <something>.Dockerfile naming convention with PascalCase prefix to the skill specification. The convention (e.g., Assets.Dockerfile) allows developers to explicitly select non-default Dockerfiles using the --file option, improving clarity when managing derived container images. Update evals to verify the convention is followed.
Add DerivedDockerfileName constant and update the runner to use Assets.Dockerfile by convention. Update test assertions to verify the generated plan mentions Assets.Dockerfile. Add validation contract to ensure SKILL.md and production-image.md document the <something>.Dockerfile naming pattern, PascalCase form, Assets.Dockerfile example, --file option, and negative patterns (Dockerfile.assets, lowercase assets.Dockerfile).
Update the dotnet-segregated-assets skill entry in the README.md available skills table to reflect the new Assets.Dockerfile naming convention using Docker's <something>.Dockerfile form with PascalCase. Add bullet point documenting that the derived production asset image uses Docker naming conventions and is explicitly selected with --file.
Clarify skill instructions, improve reference documentation, and align eval fixtures to new naming conventions. The skill's intent and scope remain unchanged; these updates enhance clarity for users and maintainers.
Align implementation, testing, and validation tooling with refined skill guidance. These updates maintain deterministic behavior while improving clarity and error handling in the segregation workflow.
Reflect improvements to skill guidance and naming conventions. The updated skill listing clarifies the architectural intent and highlights the deterministic verification approach.
Enhance skill instructions with clearer workflows, improve reference documentation with detailed examples and rationale, and add comprehensive FORMS parameter collection. These updates provide users and maintainers with complete guidance on skill usage and configuration.
Expand segregate-assets.cs with comprehensive asset classification logic, improve validation coverage, and enhance test harnesses. These deterministic runner improvements strengthen the skill's ability to detect edge cases, validate publish invariants, and provide clear diagnostics during segregation workflows.
Add comprehensive eval test case definitions and expand the cuemon-app fixture with complete application structure, including Razor views, configuration, static assets, and shared-asset references. These fixtures enable deterministic validation of segregation workflows across realistic ASP.NET Core scenarios.
Reflect expanded dotnet-segregated-assets skill capabilities with improved guidance, enhanced runner tooling, and comprehensive eval fixtures. The skill listing now accurately represents the deterministic validation, edge-case detection, and realistic fixture support.
Adds 'interface/registration' terminology to the 'Reports, never rewrites' bullet point to better explain what evidence the runner exposes about cache-busting behavior.
Adds detailed guidance to SKILL.md and references about Cuemon's enhanced cache-busting behavior, including how the CacheBustingTagHelper consumes DI-provided ICacheBusting services and preserves existing registrations. Updates evals.json expectations and assertions to verify cache-busting detection and preservation logic.
Enhances segregate-assets.cs to detect legacy attribute syntax, asp-append-version, and Cuemon cache-busting registrations (ICacheBusting, AddAssemblyCacheBusting, AddDynamicCacheBusting). Updates test-segregated-assets.ps1 and validate-skill.ps1 to verify detection and enforce validation contracts that the runner preserves existing cache-busting registrations and does not add new ones merely for segregation.
When migrating static asset segregation, existing Cuemon.AspNetCore.Razor.TagHelpers package references now resolve their version from NuGet.org at plan time instead of using stale template or fixture values. The plan discovers the highest stable version via the NuGet V3 service index, excludes prerelease versions, preserves Central Package Management ownership, and fails closed if resolution fails. This ensures migrations use current compatible packages rather than hardcoded obsolete versions.
Document the correct Cuemon custom-element selectors (app-img, cdn-img) and clarify that selectors should be derived from TagHelper HtmlTargetElement attributes rather than inferred from class names.
Update detection regex to recognize app-img/cdn-img selectors, add test case for class-name-inferred aliases to ensure they are not reported as public selectors, and update validation contracts and assertions.
Improve skill documentation and expand test fixtures to support local development workflow. Add Docker Compose profiles for segregated asset development with LocalDevelopment.Dockerfile and Assets.Dockerfile. Enhance references and forms to clarify asset segregation topology and Visual Studio orchestration.
Restructure asset segregation logic to support Docker Compose-based local development. Add LocalDevelopment.Dockerfile image building in MSBuild properties. Improve publish artifact consistency between local and production CI workflows. Refactor project probing and Dockerfile discovery for segregated development topology.
Enhance validation tooling to support new Docker Compose local development profile. Add validation for LocalDevelopment.Dockerfile and segregated image build configuration. Improve publish artifact verification to ensure consistent output between dev and production workflows.
Enhance dotnet-segregated-assets skill description with details about Docker Compose profiles, segregated image building, and Visual Studio orchestration. Clarify the skill's support for integrated local development workflow with LocalDevelopment.Dockerfile and Assets.Dockerfile.
Refactor the launch profile naming strategy from a hardcoded constant to dynamic derivation based on the project profile. Add new risk detectors for asset source versioning (ensuring wwwroot is git-tracked or reproducible) and asset image CI validation (ensuring CI builds and validates Assets.Dockerfile). Enhance ComposeValidator to check for Visual Studio project-association label requirement. Update skill documentation, references, tests, and fixtures to reflect the new validation requirements and workflow guidance.
Refine skill description clarity, update FORMS.md parameter definitions, and expand reference documentation for local development and production deployment workflows.
Add comprehensive eval specifications and test fixture for a src-layout web application. Enhance validation script with extended consistency and topology checks supporting the artifact-first contract model.
Include Dockerfile variations for assets, docker-compose infrastructure, .dockerignore, launchSettings profiles, and publish-target MSBuild configuration for the segregated content-delivery topology.
Expand segregate-assets.cs runner with improved help text documenting the artifact-first contract, enhanced topology validation logic, and refined classification of existing segregation state and Cuemon package detection patterns.
Refresh available-skills table entry for dotnet-segregated-assets to reflect updated skill scope, asset templates, and validation infrastructure.
Extend SKILL.md and production-image.md to clarify that artifact-first Dockerfiles require CI jobs that publish to artifacts/publish/. The skill now explains two cases: appending ci-artifact-jobs.yml to an existing workflow, or creating a complete workflow from ci-pipeline.yml when the repository has none. Add GitHub Actions opinionation note to prevent multi-vendor abstraction.
Create a complete GitHub Actions workflow template for repositories that do not yet have CI infrastructure. This template mirrors the structure and jobs in ci-artifact-jobs.yml but stands alone as a ready-to-use workflow that can be copied directly to .github/workflows/. It publishes artifacts and builds both application and asset Dockerfiles in a single pass.
Add TestArtifactFirstValidatorRequiresCiArtifactProducer test case to segregate-assets.cs to verify the validator detects when a repository lacks a CI workflow that publishes artifacts. Refactor CiPublishesArtifact for clarity. Update validate-skill.ps1 to require ci-pipeline.yml alongside ci-artifact-jobs.yml, and add checks to enforce GitHub Actions opinionation by rejecting multi-vendor CI references (azure-pipelines, gitlab-ci, etc).
Add bullet to README.md skill summary explaining that artifact-first images require proactive CI setup. The skill now closes the gap by extending existing GitHub Actions workflows or creating one from a template when the repository has none, ensuring the production image always has a producer rather than leaving it as local-only infrastructure.
Add ComposeFileSelector class to correlate asset-origin Compose files to the selected project directory. A repository-wide first-match scan previously could use a sibling project's healthy topology to satisfy verification for the selected project. The selector now first looks for a Compose file that mentions the selected project, falls back to an unambiguous repository-wide file if available, and reports when the only matches belong to other projects. Integrate the selector into verify and add two test cases: TestComposeFileSelectorCorrelatesToSelectedProject and TestComposeFileSelectorAcceptsUnambiguousLayouts. Complete the truncated artifact-first verification documentation in local-development.md, and update validate-skill.ps1 to require ComposeFileSelector contracts.
Restrict ComposeFileSelector candidates to the repository root or the selected project's own directory, preventing asset-origin Compose files in unrelated subtrees (docs/, samples/, etc.) from being adopted. Add IsSanctionedLocation, SameDirectory, and Preferred helpers to enforce and disambiguate these location rules. Add four regression test cases: off-root topology not adopted by root project, nested project not adopting off-root topology, own-directory file selection with canonical name preference, and opaque candidate fallback. Update local-development.md verification documentation to clarify the location-based selection strategy and its safety guarantees.
Comment on lines
+1159
to
+1161
| var unattributed = candidates.Where(candidate => !NamesAnotherProject(candidate.Text)).ToList(); | ||
| if (selectedDirectory.Length > 0 && unattributed.Count == 1) | ||
| return new Selection(unattributed[0].Path, false); |
There was a problem hiding this comment.
When a multi-web-project repository has one root-level asset-origin Compose file that names no recognized project directory, this fallback assigns it to whichever nested project is selected, allowing the unrelated topology to satisfy verify --check-local while the selected project has no corresponding asset-origin service.
Prompt To Fix With AI
This is a comment left during a code review.
Path: skills/dotnet-segregated-assets/scripts/segregate-assets.cs
Line: 1159-1161
Comment:
**Opaque Compose topology is misattributed**
When a multi-web-project repository has one root-level asset-origin Compose file that names no recognized project directory, this fallback assigns it to whichever nested project is selected, allowing the unrelated topology to satisfy `verify --check-local` while the selected project has no corresponding asset-origin service.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces strict documentation and enforcement for local, deterministic skill validation and AI/LLM evaluation automation prohibitions. It updates both
README.mdandAGENTS.mdto clarify that all evaluation and validation workflows must never invoke authenticated AI/LLM APIs or CLIs, and that skill evaluation is strictly a local process. Additionally, it refines commit workflow routing rules for skills, and clarifies when and how key skills are invoked. The documentation for core skills is updated to reflect these routing and validation rules.AI/LLM Evaluation Automation Prohibition and Local Validation
AGENTS.mdstrictly prohibiting repository scripts, CI jobs, and skill runners from invoking authenticated AI/LLM APIs or CLIs (e.g., Copilot, Claude, Codex, Gemini) for evals, grading, optimization, or review generation. All validation must be local and deterministic, with no opt-in bypass.README.mdto reinforce thatevals/evals.jsonfiles are versioned review specifications for local validation only, not instructions for launching model sessions; clarified that the new prohibition is mandatory for all evaluation workflows../scripts/validate-skill-templates.ps1 -MetadataOnlyfor fast feedback, and clarified that only local, deterministic checks are allowed during iteration and before completion.Commit Workflow Routing and Skill Invocation
git bot commit,git commit,git our commit, orPlease do a git bot commit yolo) must invokegit-visual-commitsand never route to changelog or release-note skills unless explicitly requested. Clarified handling ofyolo/automodifiers.README.mdto reflect the new commit routing, identity handling, and the strict separation between commit, changelog, and release-note skills.Other Updates
dotnet-segregated-assetsskill in the skill install list.