ci: run full checks for authored plugin Markdown

.github/workflows/node-ci.yml

@@ -38,6 +38,7 @@ jobs:
         run: |
           set -euo pipefail
           ci_mode=full
+          check_markdown=false
           if [[ "$EVENT_NAME" == "pull_request" &&
                 "$BASE_CHANGED" != "true" ]]; then
             changed_files="$(mktemp)"
@@ -46,18 +47,26 @@ jobs:
 
             changed=false
             markdown_only=true
+            plugin_changed=false
             while IFS= read -r -d '' path; do
               changed=true
-              if [[ "$path" != *.md ||
-                    "$path" == sdk/typescript/_bundled_plugin/* ]]; then
+              if [[ "$path" != *.md ]]; then
                 markdown_only=false
               fi
+              if [[ "$path" == plugins/codex-security/* ||
+                    "$path" == sdk/typescript/_bundled_plugin/* ]]; then
+                plugin_changed=true
+              fi
             done < "$changed_files"
             if [[ "$changed" == "true" && "$markdown_only" == "true" ]]; then
-              ci_mode=markdown
+              check_markdown=true
+              if [[ "$plugin_changed" == "false" ]]; then
+                ci_mode=markdown
+              fi
             fi
           fi
           printf 'ci-mode=%s\n' "$ci_mode" >> "$GITHUB_OUTPUT"
+          printf 'check-markdown=%s\n' "$check_markdown" >> "$GITHUB_OUTPUT"
 
       - name: Require a Conventional Commit pull request title
         if: github.event_name == 'pull_request'
@@ -79,27 +88,27 @@ jobs:
           python .github/scripts/check_plugin_source_compatibility.py
 
       - name: Set up pnpm
-        if: steps.scope.outputs.ci-mode == 'markdown'
+        if: steps.scope.outputs.check-markdown == 'true'
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           package_json_file: sdk/typescript/package.json
           cache: true
           cache_dependency_path: sdk/typescript/pnpm-lock.yaml
 
       - name: Set up Node.js
-        if: steps.scope.outputs.ci-mode == 'markdown'
+        if: steps.scope.outputs.check-markdown == 'true'
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22.13.0"
           cache: npm
           cache-dependency-path: sdk/typescript/pnpm-lock.yaml
 
       - name: Install dependencies
-        if: steps.scope.outputs.ci-mode == 'markdown'
+        if: steps.scope.outputs.check-markdown == 'true'
         run: pnpm --dir sdk/typescript install --frozen-lockfile
 
       - name: Check Markdown formatting
-        if: steps.scope.outputs.ci-mode == 'markdown'
+        if: steps.scope.outputs.check-markdown == 'true'
         shell: bash
         run: |
           files=()

sdk/typescript/tests-ts/release-automation.test.ts

@@ -3947,17 +3947,11 @@ describe("GitHub release workflow safeguards", () => {
     }
     expect(workflow.jobs["markdown-checks"]).toBeUndefined();
     const validationSteps = workflow.jobs["validate-title"]?.steps ?? [];
-    for (const stepName of [
-      "Set up pnpm",
-      "Set up Node.js",
-      "Install dependencies",
-      "Check Markdown formatting",
-      "Check plugin source compatibility",
-    ]) {
-      expect(validationSteps.find(({ name }) => name === stepName)?.if).toBe(
-        "steps.scope.outputs.ci-mode == 'markdown'",
-      );
-    }
+    expect(
+      validationSteps.find(
+        ({ name }) => name === "Check plugin source compatibility",
+      )?.if,
+    ).toBe("steps.scope.outputs.ci-mode == 'markdown'");
     const markdownCommand =
       validationSteps.find(({ name }) => name === "Check Markdown formatting")
         ?.run ?? "";
@@ -4043,31 +4037,61 @@ describe("GitHub release workflow safeguards", () => {
       false,
       ["README.md", "docs/guide.md"],
       "markdown",
+      true,
     ],
     [
       "generated-plugin Markdown-only PR",
       "pull_request",
       false,
       ["sdk/typescript/_bundled_plugin/skills/example/SKILL.md"],
       "full",
+      true,
+    ],
+    [
+      "authored-plugin skill Markdown-only PR",
+      "pull_request",
+      false,
+      ["plugins/codex-security/skills/example/SKILL.md"],
+      "full",
+      true,
+    ],
+    [
+      "authored-plugin reference Markdown-only PR",
+      "pull_request",
+      false,
+      ["plugins/codex-security/skills/example/references/contract.md"],
+      "full",
+      true,
+    ],
+    ["base retarget", "pull_request", true, ["README.md"], "full", false],
+    [
+      "mixed PR",
+      "pull_request",
+      false,
+      ["README.md", "src/index.ts"],
+      "full",
+      false,
     ],
-    ["base retarget", "pull_request", true, ["README.md"], "full"],
-    ["mixed PR", "pull_request", false, ["README.md", "src/index.ts"], "full"],
     [
       "source-to-Markdown rename",
       "pull_request",
       false,
       ["src/index.ts", "docs/index.md"],
       "full",
+      false,
     ],
-    ["empty merge diff", "pull_request", false, [], "full"],
-    ["push", "push", false, ["README.md"], "full"],
+    ["empty merge diff", "pull_request", false, [], "full", false],
+    ["push", "push", false, ["README.md"], "full", false],
   ] as const)(
-    "selects the conservative CI mode for %s",
-    (_name, eventName, baseChanged, changedPaths, ciMode) => {
+    "selects CI and formatting checks for %s",
+    (_name, eventName, baseChanged, changedPaths, ciMode, checkMarkdown) => {
       const workspace = mkdtempSync(join(tmpdir(), "release-ci-scope-"));
       const output = join(workspace, "output");
       const script = workflowStepShell(nodeCiWorkflow, "Decide CI mode");
+      const workflow = Bun.YAML.parse(nodeCiWorkflow) as {
+        jobs: Record<string, { steps: Array<{ name?: string; if?: string }> }>;
+      };
+      const validationSteps = workflow.jobs["validate-title"]!.steps;
       const gitMock = `git() {
       [[ "$*" == "diff --no-renames --name-only -z HEAD^1 HEAD" ]] || return 64
       while IFS= read -r path; do
@@ -4085,7 +4109,31 @@ describe("GitHub release workflow safeguards", () => {
           },
         });
         expect(result.status).toBe(0);
-        expect(readFileSync(output, "utf8")).toBe(`ci-mode=${ciMode}\n`);
+        const outputs: Record<string, string> = Object.fromEntries(
+          readFileSync(output, "utf8")
+            .trim()
+            .split("\n")
+            .map((line) => line.split("=")),
+        );
+        expect(outputs["ci-mode"]).toBe(ciMode);
+        const values = Object.fromEntries(
+          Object.entries(outputs).map(([key, value]) => [
+            `steps.scope.outputs.${key}`,
+            value,
+          ]),
+        );
+        for (const stepName of [
+          "Set up pnpm",
+          "Set up Node.js",
+          "Install dependencies",
+          "Check Markdown formatting",
+        ]) {
+          const condition =
+            validationSteps.find(({ name }) => name === stepName)?.if ?? "";
+          expect(evaluateWorkflowCondition(condition, values), stepName).toBe(
+            checkMarkdown,
+          );
+        }
       } finally {
         rmSync(workspace, { recursive: true, force: true });
       }