Release notes

1nika: release-notes2​3# A NON-thinking local model, deliberately: a thinking model can spend the4# whole `max_tokens` budget in its think block and return before the JSON5# (engine#428). Schema showcases pick a model that answers directly.6model: ollama/llama3.2:3b7​8inputs:9  announce:10    type: bool11    default: false12    description: "Actually send the team ping (needs TEAM_WEBHOOK_URL)"13​14const:15  since_tag: "v0.80.0"16  changelog_src: "examples/fixtures/CHANGELOG.md" # point this at YOUR CHANGELOG.md17  changelog_out: "out/CHANGELOG.md"                        # the working copy this run edits18​19⛨secrets:20  ⛨team_webhook:21    ⛨source: env22    ⛨key: TEAM_WEBHOOK_URL23    ⛨egress:                       # sanction the one send · the secret IS the URL24      - ⛨to: "nika:notify"25        ⛨host_from_self: true26⛨permits:27  ⛨exec: ["git"]                   # the ONE program this workflow may run28  ⛨tools: ["nika:edit", "nika:notify", "nika:prompt", "nika:read", "nika:write"]29  ⛨net:30    # `host_from_self:` above sanctions the FLOW (the secret may be the URL) —31    # it does not grant the capability. The host stays unknown at check, so it32    # is judged at RUN against this bound: name the announce host here or the33    # send is refused mid-run, after the tokens are already spent.34    ⛨http: ["hooks.slack.com"]35  ⛨fs:36    # The workflow never edits your changelog in place — it copies it and37    # edits the copy, so you move the result when the diff looks right.38    #39    # The working copy appears in BOTH lists, and that is not redundancy:40    # `nika:edit` reads the file before it writes it, so a write-only grant41    # is refused with NIKA-SEC-004 · outside permits.fs.read. Every in-place42    # builtin owes both halves.43    ⛨read: ["examples/fixtures/CHANGELOG.md", "out/CHANGELOG.md"]44    ⛨write: ["out/CHANGELOG.md"]45​46tasks:47  # The human gate (NEP-0002 · v2.2). `git log` output is UNTRUSTED content —48  # a hostile branch writes its own commit subjects — and this workflow pairs49  # it with a private `fs.read` and a webhook: the lethal trifecta, unless a50  # human dominates the path. The gate comes FIRST and BOTH roots hang off it51  # (`history` carries the untrusted content, `existing` carries the private52  # read); a gate on a sibling branch dominates nothing. And each root53  # CONSUMES the answer affirmatively (NEP-0020 — a bare `after:` admits the54  # refusal: it settles success with value false), the downstream null-guards55  # passing the « no » along the value edges. Non-interactive runs answer it56  # in one pass with `--answer approve=true`.57  approve:58    ◆invoke:59      tool: "nika:prompt"60      args:61        mode: "confirm"62        message: "read the git history since ${{ const.since_tag }}, rewrite the changelog copy, and ping the team if announce is on?"63​64  history:65    after: { approve: success }66    with:67      go: ${{ tasks.approve.output }}68    when: ${{ with.go == true }}       # « no » at the gate → no history read at all69    ▷exec:70      command: ["git", "log", "${{ const.since_tag }}..HEAD", "--oneline", "--no-merges"]71    on_error:72      # No such tag here (or not a repo at all) → a sample log takes over and73      # the rest of the chain is exercised exactly as it would be on the day.74      recover: |75        a1b2c3d feat(api): pagination cursors on every list endpoint76        d4e5f6a fix(auth): refresh tokens no longer rotate on read77        7g8h9i0 refactor(store): drop the legacy write path78​79  notes:80    with:81      history: ${{ tasks.history.output }}82    when: ${{ with.history != null && size(with.history) > 0 }}  # a refused gate skips history (null) · an empty log has nothing to draft either83    ◇infer:84      max_tokens: 100085      prompt: |86        Write release notes from these commits ·87        ${{ with.history }}88        Tone · plain, direct, no marketing fluff.89      schema:90        type: object91        additionalProperties: false92        required: [headline, body]93        properties:94          headline: { type: string }95          breaking: { type: array, items: { type: string } }96          body: { type: string }97​98  # Copy-then-edit · `nika:edit` is strictly in place and throws when `find:`99  # matches nothing (NIKA-BUILTIN-EDIT-001), so its target must exist and must100  # carry the anchor. Read yours, write the working copy, edit THAT.101  existing:102    after: { approve: success }103    with:104      go: ${{ tasks.approve.output }}105    when: ${{ with.go == true }}       # the same « no » closes the private-read branch106    ◆invoke:107      tool: "nika:read"108      args: { path: "${{ const.changelog_src }}" }109​110  copy:111    with:112      existing: ${{ tasks.existing.output }}113    when: ${{ with.existing != null && size(with.existing) > 0 }}  # a refused gate skips the read (null) · an empty file has nothing to copy114    ◆invoke:115      tool: "nika:write"116      args:117        path: "${{ const.changelog_out }}"118        content: "${{ with.existing }}"119        create_dirs: true120        overwrite: true121​122  changelog:123    with:124      notes_headline: ${{ tasks.notes.output.headline }}125      notes_body: ${{ tasks.notes.output.body }}126    after:127      copy: success              # state, no data · the anchor is on disk before we edit128    ◆invoke:129      tool: "nika:edit"130      args:131        path: "${{ const.changelog_out }}"132        find: "# Changelog"      # a LITERAL string · not a regex133        count: 1                 # the top anchor only · never every occurrence134        replace: |135          # Changelog136​137          ## ${{ const.since_tag }}..HEAD · ${{ with.notes_headline }}138​139          ${{ with.notes_body }}140​141  announce:142    with:143      notes_headline: ${{ tasks.notes.output.headline }}144    when: ${{ inputs.announce == true }}   # OFF by default · a rehearsal must not ping the team145    after:146      changelog: success147    ◆invoke:148      tool: "nika:notify"149      args:150        channel: webhook151        target: "${{ secrets.team_webhook }}"152        message: "Release notes ready · ${{ with.notes_headline }}"153        severity: info154​155outputs:156  headline: ${{ tasks.notes.output.headline }}157  body: ${{ tasks.notes.output.body }}158​