Merge pull request 'fix(governance): add Eos submodule freshness workflow and path-compatible checks (#57)' (#60) from fix/57-governance-freshness-wiring into main

Reviewed-on: https://gitea.cybermonkey.sh/cybermonkey/eos/pulls/60

Author: CodeMonkeyCybersecurity

.gitea/workflows/submodule-freshness.yml

@@ -0,0 +1,31 @@
+name: Submodule Freshness Check
+
+on:
+  workflow_dispatch:
+    inputs:
+      auto_update:
+        description: "Automatically bump stale prompts submodule in workflow workspace"
+        required: false
+        default: "false"
+  schedule:
+    - cron: "17 */6 * * *"
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  submodule-freshness:
+    runs-on: [self-hosted, general]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          submodules: recursive
+
+      - name: Verify prompts freshness
+        env:
+          AUTO_UPDATE: ${{ inputs.auto_update || 'false' }}
+        run: |
+          set -euo pipefail
+          chmod +x scripts/prompts-submodule-freshness.sh
+          ./scripts/prompts-submodule-freshness.sh

Makefile

@@ -2,7 +2,8 @@
 # Last Updated: 2025-10-23
 
 .PHONY: all build test lint lint-fix clean install help \
-	ci-preflight ci-lint ci-unit ci-integration ci-e2e-smoke ci-fuzz ci-coverage-delta
+	ci-preflight ci-lint ci-unit ci-integration ci-e2e-smoke ci-fuzz ci-coverage-delta \
+	governance-check submodule-freshness
 
 # Build configuration
 BINARY_NAME := eos
@@ -224,6 +225,14 @@ ci-coverage-delta: ## Run CI coverage delta check (PR context)
 	@echo "[INFO] Running CI coverage delta..."
 	@scripts/ci/coverage-delta.sh coverage.out
 
+governance-check: ## Run governance wiring checks from prompts submodule
+	@echo "[INFO] Running governance checks..."
+	@scripts/check-governance.sh
+
+submodule-freshness: ## Verify prompts submodule is current with upstream main
+	@echo "[INFO] Checking prompts submodule freshness..."
+	@scripts/prompts-submodule-freshness.sh
+
 ##@ Deployment
 
 DEPLOY_SERVERS ?= vhost2

scripts/check-governance.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Run prompts governance checks regardless of submodule path convention.
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if [[ -x "${repo_root}/third_party/prompts/scripts/check-governance.sh" ]]; then
+  CONSUMING_REPO_ROOT="${repo_root}" "${repo_root}/third_party/prompts/scripts/check-governance.sh"
+  exit $?
+fi
+
+if [[ ! -x "${repo_root}/prompts/scripts/check-governance.sh" ]]; then
+  echo "ERROR: prompts governance checker not found in third_party/prompts/ or prompts/"
+  exit 2
+fi
+
+mkdir -p "${repo_root}/third_party"
+created_link=false
+if [[ ! -e "${repo_root}/third_party/prompts" ]]; then
+  ln -s ../prompts "${repo_root}/third_party/prompts"
+  created_link=true
+fi
+
+cleanup() {
+  if [[ "${created_link}" == "true" ]]; then
+    rm -f "${repo_root}/third_party/prompts"
+  fi
+}
+trap cleanup EXIT
+
+CONSUMING_REPO_ROOT="${repo_root}" "${repo_root}/prompts/scripts/check-governance.sh"

scripts/prompts-submodule-freshness.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+auto_update="${AUTO_UPDATE:-false}"
+
+prompts_path=""
+if [[ -d "${repo_root}/prompts/.git" || -f "${repo_root}/prompts/.git" ]]; then
+  prompts_path="prompts"
+elif [[ -d "${repo_root}/third_party/prompts/.git" || -f "${repo_root}/third_party/prompts/.git" ]]; then
+  prompts_path="third_party/prompts"
+fi
+
+if [[ -z "${prompts_path}" ]]; then
+  echo "FAIL: prompts submodule not found at prompts/ or third_party/prompts/"
+  exit 1
+fi
+
+local_sha="$(git -C "${repo_root}/${prompts_path}" rev-parse HEAD)"
+if ! git -C "${repo_root}/${prompts_path}" fetch origin main --quiet; then
+  echo "FAIL: unable to fetch ${prompts_path} origin/main"
+  exit 1
+fi
+remote_sha="$(git -C "${repo_root}/${prompts_path}" rev-parse origin/main)"
+
+echo "prompts_path=${prompts_path}"
+echo "local_sha=${local_sha}"
+echo "remote_sha=${remote_sha}"
+
+if [[ "${local_sha}" == "${remote_sha}" ]]; then
+  echo "PASS: prompts submodule is up to date"
+  exit 0
+fi
+
+echo "WARN: prompts submodule is stale"
+if [[ "${auto_update}" == "true" ]]; then
+  if git -C "${repo_root}" submodule status -- "${prompts_path}" >/dev/null 2>&1; then
+    git -C "${repo_root}" submodule update --remote -- "${prompts_path}"
+    updated_sha="$(git -C "${repo_root}/${prompts_path}" rev-parse HEAD)"
+    echo "UPDATED_SUBMODULE: ${local_sha:0:7} -> ${updated_sha:0:7}"
+    exit 0
+  fi
+
+  git -C "${repo_root}/${prompts_path}" checkout --detach "${remote_sha}" >/dev/null 2>&1
+  updated_sha="$(git -C "${repo_root}/${prompts_path}" rev-parse HEAD)"
+  echo "UPDATED_WORKTREE_ONLY: ${local_sha:0:7} -> ${updated_sha:0:7}"
+  exit 0
+fi
+
+echo "Run: git submodule update --remote -- ${prompts_path}"
+exit 1