Separate template automation checks from managed applications

Author: longquanzheng

.github/workflows/ci.yml

@@ -78,7 +78,9 @@ jobs:
         working-directory: web
         run: npx playwright install --with-deps chromium
       - name: Check template
-        run: make check
+        run: |
+          make check-template-repository
+          make check
 
   release:
     needs: check

.superverse/template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "buildProfile": "go-react-v1",
-  "templateVersion": "1.9.0",
+  "templateVersion": "1.9.1",
   "minimumSandboxImageContractRevision": 3,
   "openapiSpec": "openapi/openapi.yaml",
   "applicationManifest": "dex-app.yaml",

AGENTS.md

@@ -106,6 +106,10 @@ minor or major version boundary unless the user explicitly requests it.
 and Dex CLI release updates. Keep their stable-release checks, fixed automation
 branch, template-version bump, contract updates, and explicit CI dispatch
 aligned. The updater creates or refreshes a pull request; it never merges one.
+`make check-template-repository` checks these template-owned workflows and is
+required by Template CI. Superverse exports applications without `.github/`;
+`make check-contracts` and `make check-static` still validate their complete
+application contracts, but must not require or recreate template release CI.
 
 Every pull request advances `templateVersion` in
 `.superverse/template.json`. After Template CI passes on `main`, CI publishes

Makefile

@@ -1,6 +1,6 @@
 SHELL := /usr/bin/env bash
 
-.PHONY: bootstrap generate check-fdg-v2 check-contracts superverse-release-artifacts test-integration test-e2e build dev check-static check
+.PHONY: bootstrap generate check-fdg-v2 check-contracts check-template-repository superverse-release-artifacts test-integration test-e2e build dev check-static check
 bootstrap:
 	go mod download
 	go -C tools/openapi mod download
@@ -14,6 +14,8 @@ superverse-release-artifacts:
 	python3 ./scripts/generate-release-artifacts.py --output-directory "$(SUPERVERSE_RELEASE_ARTIFACT_DIR)"
 check-contracts:
 	go run ./tools/checkcontract
+check-template-repository:
+	go run ./tools/checkcontract --repository-automation
 test-integration: generate check-contracts
 	./scripts/with-dex.sh go test -count=1 -tags=integration ./...
 test-e2e: generate check-contracts

README.md

@@ -116,6 +116,11 @@ Adding this official loader keeps Go `1.25.0` and Dex SDK `v0.13.1` unchanged.
 
 ## Verification
 
+Template CI additionally runs `make check-template-repository` to validate its
+release and dependency-update workflows. Managed Superverse applications are
+exported without `.github/`; their `make check-contracts` and `make check-static`
+retain all application checks without requiring template publishing automation.
+
 ```bash
 make check-contracts
 make check-static
@@ -204,6 +209,10 @@ reviewed pull requests.
 
 ## Template 1.9 changes
 
+Version 1.9.1 separates template-repository automation checks from exported
+application checks. Flow behavior, SDK pins, configuration loading and UI are
+unchanged. The template CI still requires both checks.
+
 ### Dex Flow Changes
 
 None. `process.BasicProcessFlow`, its Steps, primitive keys, start and recovery

tools/checkcontract/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"flag"
 	"fmt"
 	"go/ast"
 	"go/parser"
@@ -35,7 +36,7 @@ func checkTemplateContract() {
 	if err := json.Unmarshal(manifestBytes, &contract); err != nil {
 		failf("decode manifest: %v", err)
 	}
-	if contract.SchemaVersion != 1 || contract.BuildProfile != "go-react-v1" || contract.TemplateVersion != "1.9.0" || contract.MinimumSandboxImageContractRevision != 3 {
+	if contract.SchemaVersion != 1 || contract.BuildProfile != "go-react-v1" || contract.TemplateVersion != "1.9.1" || contract.MinimumSandboxImageContractRevision != 3 {
 		failf("unexpected template identity: %+v", contract)
 	}
 	if baseline := strings.TrimSpace(readFile(filepath.Join(root, "DEX_SERVER_BASELINE"))); baseline != "server/v0.14.1" {
@@ -164,6 +165,11 @@ func checkTemplateContract() {
 			failf("Dex dependency updater does not mention %q", required)
 		}
 	}
+}
+
+// Template publishing automation belongs to the template repository, not exported apps.
+func checkTemplateRepositoryAutomation() {
+	root := "."
 	updateWorkflow := readFile(filepath.Join(root, ".github", "workflows", "update-dex-dependencies.yml"))
 	for _, required := range []string{
 		"schedule:",
@@ -287,9 +293,17 @@ func readFile(path string) string {
 
 // Static repository validation is separate from API integration tests.
 func main() {
+	repositoryAutomation := flag.Bool("repository-automation", false, "also validate template-owned release/update workflows")
+	flag.Parse()
+	if flag.NArg() != 0 {
+		failf("unexpected positional arguments")
+	}
 	checkTemplateContract()
 	checkGoNamesDescribeConcreteResponsibilities()
 	checkTestPolicy()
+	if *repositoryAutomation {
+		checkTemplateRepositoryAutomation()
+	}
 	fmt.Println("Template contract, Go names, and integration-only test policy are valid.")
 }