From 6790217530be2e35838e0325002e015f72af7021 Mon Sep 17 00:00:00 2001
From: fOuttaMyPaint <154358121+TMHSDigital@users.noreply.github.com>
Date: Sun, 14 Jun 2026 14:14:34 -0400
Subject: [PATCH] fix: scaffold emits type-correct workflow set and derives
 stale literals

mcp-server repos no longer get the cursor-plugin-specific validate.yml and
release.yml. Per standards/ci-cd.md, validate.yml's checks all assume a
plugin.json and publish.yml replaces release.yml, so the emitted set now
matches standards/drift-checker.config.json exactly (drift-check, stale,
publish) plus the optional-for-both pages and label-sync.

Also derive the LICENSE copyright year from the current UTC year instead of
a hardcoded 2026, make plugin.json keywords type-aware (drop the stock "mcp"
keyword unless the repo has an MCP server), add PyYAML to the CI test
environment so the YAML-validating tests stop silently importorskip-ing, and
add a born-green integration test that renders each type and asserts detected
type, empty drift, current markers/pins, README counts, and the exact
workflow set.

Bumps VERSION 1.16.2 -> 1.16.3.

Signed-off-by: fOuttaMyPaint <154358121+TMHSDigital@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/validate.yml         |   9 +-
 VERSION                                |   2 +-
 requirements-test.txt                  |   7 +
 scaffold/create-tool.py                |  17 +-
 scaffold/templates/LICENSE.j2          |   6 +-
 scaffold/templates/plugin.json.j2      |   4 +-
 scaffold/templates/release.mcp.yml.j2  |  72 --------
 scaffold/templates/validate.mcp.yml.j2 |  28 ---
 tests/test_scaffold_born_green.py      | 243 +++++++++++++++++++++++++
 9 files changed, 275 insertions(+), 113 deletions(-)
 delete mode 100644 scaffold/templates/release.mcp.yml.j2
 delete mode 100644 scaffold/templates/validate.mcp.yml.j2
 create mode 100644 tests/test_scaffold_born_green.py

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 0c83388..e87eb64 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -204,9 +204,12 @@ jobs:
           grep -q '<!-- standards-version:' /tmp/scaffold-test/ci-test-plugin/AGENTS.md \
             || { echo "::error::AGENTS.md missing standards-version marker"; exit 1; }
 
-          # LICENSE has correct CC-BY-NC-ND-4.0 copyright (TM Hospitality Strategies, not TMHSDigital)
-          grep -q 'Copyright (c) 2026 TM Hospitality Strategies' /tmp/scaffold-test/ci-test-plugin/LICENSE \
-            || { echo "::error::LICENSE missing canonical 'TM Hospitality Strategies' copyright line"; exit 1; }
+          # LICENSE has correct CC-BY-NC-ND-4.0 copyright (TM Hospitality Strategies, not TMHSDigital).
+          # The year is DERIVED from the current UTC year at generation time, so assert against
+          # that rather than a hardcoded literal (which would itself go stale every January 1).
+          YEAR=$(date -u +%Y)
+          grep -q "Copyright (c) ${YEAR} TM Hospitality Strategies" /tmp/scaffold-test/ci-test-plugin/LICENSE \
+            || { echo "::error::LICENSE missing canonical 'Copyright (c) ${YEAR} TM Hospitality Strategies' line"; exit 1; }
           grep -q 'SPDX-License-Identifier: CC-BY-NC-ND-4.0' /tmp/scaffold-test/ci-test-plugin/LICENSE \
             || { echo "::error::LICENSE missing SPDX-License-Identifier"; exit 1; }
 
diff --git a/VERSION b/VERSION
index 4a02d2c..c807441 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.16.2
+1.16.3
diff --git a/requirements-test.txt b/requirements-test.txt
index 5293116..a40b0ed 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -1 +1,8 @@
 pytest>=8.0,<9.0
+# PyYAML is required by the YAML-validating tests (test_release_doc_sync.py,
+# test_composite_action_shape.py). Without it those tests pytest.importorskip
+# and silently skip in CI, hiding real coverage.
+PyYAML>=6.0,<7.0
+# Jinja2 is required by the born-green scaffold integration test, which renders
+# a repo of each type and runs the drift checker against the output.
+Jinja2>=3.1,<4.0
diff --git a/scaffold/create-tool.py b/scaffold/create-tool.py
index a339d5a..24254b4 100644
--- a/scaffold/create-tool.py
+++ b/scaffold/create-tool.py
@@ -7,6 +7,7 @@
 """
 
 import argparse
+import datetime
 import os
 import re
 import sys
@@ -206,6 +207,7 @@ def main():
         "meta_minor": meta_minor,
         "meta_patch": meta_patch,
         "meta_version": f"{meta_major}.{meta_minor}.{meta_patch}",
+        "year": datetime.datetime.now(datetime.timezone.utc).year,
     }
 
     print(f"\nScaffolding '{args.name}' ({slug}) into {output_dir}\n")
@@ -214,15 +216,22 @@ def main():
     if args.type == "cursor-plugin":
         write_file(output_dir, ".cursor-plugin/plugin.json", render_template(env, "plugin.json.j2", ctx))
 
-    # GitHub workflows — branched by type
+    # GitHub workflows - emitted set is type-specific and must match the
+    # per-type required_workflows in standards/drift-checker.config.json plus
+    # the two optional-for-both workflows (pages, label-sync). Do NOT emit
+    # cursor-plugin-specific workflows for mcp-server repos: validate.yml's
+    # checks all assume a plugin.json and publish.yml replaces release.yml
+    # (see standards/ci-cd.md "MCP-server Variations").
     if args.type == "mcp-server":
-        write_file(output_dir, ".github/workflows/validate.yml", render_template(env, "validate.mcp.yml.j2", ctx))
-        write_file(output_dir, ".github/workflows/release.yml", render_template(env, "release.mcp.yml.j2", ctx))
-        write_file(output_dir, ".github/workflows/pages.yml", render_template(env, "pages.mcp.yml.j2", ctx))
+        # Required for mcp-server: drift-check, stale, publish.
         write_file(output_dir, ".github/workflows/publish.yml", render_template(env, "publish.yml.j2", ctx))
+        # Optional-for-both: pages (mcp variant), label-sync.
+        write_file(output_dir, ".github/workflows/pages.yml", render_template(env, "pages.mcp.yml.j2", ctx))
     else:
+        # Required for cursor-plugin: validate, release, stale, drift-check.
         write_file(output_dir, ".github/workflows/validate.yml", render_template(env, "validate.yml.j2", ctx))
         write_file(output_dir, ".github/workflows/release.yml", render_template(env, "release.yml.j2", ctx))
+        # Optional-for-both: pages, label-sync.
         write_file(output_dir, ".github/workflows/pages.yml", render_template(env, "pages.yml.j2", ctx))
     write_file(output_dir, ".github/workflows/stale.yml", render_template(env, "stale.yml.j2", ctx))
     write_file(output_dir, ".github/workflows/drift-check.yml", render_template(env, "drift-check.yml.j2", ctx))
diff --git a/scaffold/templates/LICENSE.j2 b/scaffold/templates/LICENSE.j2
index 74f1217..fb05c48 100644
--- a/scaffold/templates/LICENSE.j2
+++ b/scaffold/templates/LICENSE.j2
@@ -1,7 +1,7 @@
 {% if license_key == 'mit' %}
 MIT License
 
-Copyright (c) 2026 {{ author_name }}
+Copyright (c) {{ year }} {{ author_name }}
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -25,7 +25,7 @@ Apache License
 Version 2.0, January 2004
 http://www.apache.org/licenses/
 
-Copyright (c) 2026 {{ author_name }}
+Copyright (c) {{ year }} {{ author_name }}
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -41,7 +41,7 @@ limitations under the License.
 {% else %}
 Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International
 
-Copyright (c) 2026 TM Hospitality Strategies
+Copyright (c) {{ year }} TM Hospitality Strategies
 
 This work is licensed under the Creative Commons
 Attribution-NonCommercial-NoDerivatives 4.0 International License.
diff --git a/scaffold/templates/plugin.json.j2 b/scaffold/templates/plugin.json.j2
index 0aca9c0..dee4c1f 100644
--- a/scaffold/templates/plugin.json.j2
+++ b/scaffold/templates/plugin.json.j2
@@ -10,8 +10,8 @@
   "license": "{{ license_spdx }}",
   "keywords": [
     "cursor-plugin",
-    "developer-tools",
-    "mcp"
+    "developer-tools"{% if has_mcp %},
+    "mcp"{% endif +%}
   ],
   "skills": [
 {% for skill in skills %}
diff --git a/scaffold/templates/release.mcp.yml.j2 b/scaffold/templates/release.mcp.yml.j2
deleted file mode 100644
index 1e5f122..0000000
--- a/scaffold/templates/release.mcp.yml.j2
+++ /dev/null
@@ -1,72 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch: {}
-
-permissions:
-  contents: write
-
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-jobs:
-  tag-and-release:
-    name: Tag and release
-    runs-on: ubuntu-latest
-{% raw %}
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
-    steps:
-
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Read version from package.json
-        id: ver
-        run: |
-          version=$(python3 -c "import json; print(json.load(open('package.json'))['version'])")
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "Version from package.json: $version"
-
-      - name: Check if tag already exists
-        id: check
-        run: |
-          version="${{ steps.ver.outputs.version }}"
-          if git rev-parse "v$version" >/dev/null 2>&1; then
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "Tag v$version already exists, skipping release"
-          else
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-            echo "Tag v$version does not exist, proceeding"
-          fi
-
-      - name: Create and push tags
-        if: steps.check.outputs.skip == 'false'
-        run: |
-          version="${{ steps.ver.outputs.version }}"
-          IFS='.' read -r major minor _patch <<< "$version"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          git tag "v$version"
-          git tag -f "v$major"
-          git tag -f "v$major.$minor"
-
-          git push origin "v$version"
-          git push origin "v$major" --force
-          git push origin "v$major.$minor" --force
-
-      - name: Create GitHub Release
-        if: steps.check.outputs.skip == 'false'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh release create "v${{ steps.ver.outputs.version }}" \
-            --title "v${{ steps.ver.outputs.version }}" \
-            --generate-notes
-{% endraw %}
diff --git a/scaffold/templates/validate.mcp.yml.j2 b/scaffold/templates/validate.mcp.yml.j2
deleted file mode 100644
index f0804ec..0000000
--- a/scaffold/templates/validate.mcp.yml.j2
+++ /dev/null
@@ -1,28 +0,0 @@
-name: Validate
-
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  required-files:
-    name: Check required files
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Verify required files exist
-        run: |
-          missing=0
-          for f in README.md CHANGELOG.md AGENTS.md CLAUDE.md mcp-tools.json site.json LICENSE; do
-            if [ ! -f "$f" ]; then
-              echo "Missing: $f"
-              missing=1
-            fi
-          done
-          if [ $missing -eq 1 ]; then exit 1; fi
-          echo "All required files present"
diff --git a/tests/test_scaffold_born_green.py b/tests/test_scaffold_born_green.py
new file mode 100644
index 0000000..b95fcc2
--- /dev/null
+++ b/tests/test_scaffold_born_green.py
@@ -0,0 +1,243 @@
+"""Born-green integration test for the scaffold generator.
+
+Renders a repo of each supported type with ``scaffold/create-tool.py`` and
+asserts the Phase-2-B properties against the generated tree:
+
+* ``_detect_repo_type`` returns the intended type (not ``unknown``);
+* the meta drift checker reports zero error/warn findings (born green);
+* every standards-version marker equals the meta ``STANDARDS_VERSION``;
+* workflow action pins equal the train derived from the meta ``VERSION``;
+* the README aggregate counts match the generated content, so the repo's
+  own ``validate-counts`` job would pass on day one;
+* the emitted workflow set EXACTLY equals the per-type required set from
+  ``standards/drift-checker.config.json`` plus the two optional-for-both
+  workflows (``label-sync.yml``, ``pages.yml``) - no more, no less.
+
+The last assertion is the regression guard for the
+"mcp-server-got-plugin-workflows" bug class: it fails CI the moment the
+renderer emits a workflow that does not belong to a type, instead of the
+drift surfacing three reconciles later.
+
+Run directly or with pytest::
+
+    pytest tests/test_scaffold_born_green.py -v
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+if str(REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(REPO_ROOT))
+
+from scripts.drift_check.checks import (  # noqa: E402
+    BrokenRefsCheck,
+    RequiredRefsCheck,
+    RequiredWorkflowsCheck,
+    StaleCountsCheck,
+    VersionSignalCheck,
+)
+from scripts.drift_check.checks.required_refs import load_required_refs  # noqa: E402
+from scripts.drift_check.config import load_config  # noqa: E402
+from scripts.drift_check.semver import parse_version  # noqa: E402
+from scripts.drift_check.snapshot import (  # noqa: E402
+    _detect_repo_type,
+    build_local_snapshot,
+    list_meta_standards,
+)
+
+CREATE_TOOL = REPO_ROOT / "scaffold" / "create-tool.py"
+CONFIG_PATH = REPO_ROOT / "standards" / "drift-checker.config.json"
+REQUIRED_REFS_PATH = REPO_ROOT / "standards" / "required-refs.json"
+
+OPTIONAL_FOR_BOTH = frozenset({"label-sync.yml", "pages.yml"})
+
+# Render parameters per type. mcp-server is rendered with zero skills/rules so
+# the no-plugin-manifest detection shape (no skills/, no rules/, CLAUDE.md
+# present) holds; rendering it with skills would create skills/ and make
+# _detect_repo_type return "unknown".
+_CASES = {
+    "cursor-plugin": ["--skills", "2", "--rules", "1"],
+    "mcp-server": [],
+}
+
+
+def _standards_version() -> str:
+    return (REPO_ROOT / "STANDARDS_VERSION").read_text(encoding="utf-8").strip()
+
+
+def _meta_version_parts() -> tuple[int, int, int]:
+    raw = (REPO_ROOT / "VERSION").read_text(encoding="utf-8").strip()
+    m = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)", raw)
+    assert m, f"VERSION is not X.Y.Z: {raw!r}"
+    return int(m.group(1)), int(m.group(2)), int(m.group(3))
+
+
+def _required_workflows(repo_type: str) -> frozenset[str]:
+    cfg = json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+    return frozenset(cfg["types"][repo_type]["required_workflows"])
+
+
+def _render(repo_type: str, dest: Path) -> Path:
+    slug = f"born-green-{repo_type}"
+    cmd = [
+        sys.executable,
+        str(CREATE_TOOL),
+        "--name",
+        f"Born Green {repo_type}",
+        "--description",
+        "born green probe",
+        "--type",
+        repo_type,
+        "--slug",
+        slug,
+        "--output",
+        str(dest),
+        *_CASES[repo_type],
+    ]
+    proc = subprocess.run(cmd, capture_output=True, text=True)
+    assert proc.returncode == 0, f"scaffold failed:\n{proc.stdout}\n{proc.stderr}"
+    repo = dest / slug
+    assert repo.is_dir(), f"expected generated repo at {repo}"
+    return repo
+
+
+@pytest.fixture(scope="module")
+def rendered(tmp_path_factory) -> dict[str, Path]:
+    out: dict[str, Path] = {}
+    for repo_type in _CASES:
+        dest = tmp_path_factory.mktemp(repo_type)
+        out[repo_type] = _render(repo_type, dest)
+    return out
+
+
+def _run_drift_checks(repo: Path, slug: str):
+    meta_version = parse_version(_standards_version())
+    cfg = load_config(CONFIG_PATH)
+    required_refs = load_required_refs(REQUIRED_REFS_PATH)
+    meta_standards = list_meta_standards(REPO_ROOT)
+    snap = build_local_snapshot(
+        repo_path=repo,
+        meta_version=meta_version,
+        meta_commit="born-green-test",
+        config=cfg,
+        slug=slug,
+        meta_standards=meta_standards,
+        meta_required_refs=dict(required_refs),
+    )
+    checks = (
+        VersionSignalCheck(),
+        BrokenRefsCheck(),
+        RequiredRefsCheck(),
+        RequiredWorkflowsCheck(),
+        StaleCountsCheck(),
+    )
+    findings = []
+    for check in checks:
+        findings.extend(check.run(snap))
+    return snap, findings
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_detected_type_matches(rendered, repo_type):
+    repo = rendered[repo_type]
+    assert _detect_repo_type(repo) == repo_type, (
+        f"{repo_type} scaffold detected as {_detect_repo_type(repo)!r}"
+    )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_born_green_no_drift(rendered, repo_type):
+    repo = rendered[repo_type]
+    snap, findings = _run_drift_checks(repo, f"born-green-{repo_type}")
+    assert snap.repo_type == repo_type
+    actionable = [f for f in findings if f.severity in ("error", "warn")]
+    assert actionable == [], (
+        "freshly scaffolded repo is not born green: "
+        + "; ".join(f"{f.check}/{f.severity}: {f.message}" for f in actionable)
+    )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_standards_markers_current(rendered, repo_type):
+    repo = rendered[repo_type]
+    expected = _standards_version()
+    marker_files = [repo / "AGENTS.md", repo / "CLAUDE.md"]
+    for skill_md in (repo / "skills").glob("*/SKILL.md"):
+        marker_files.append(skill_md)
+    for rule_mdc in (repo / "rules").glob("*.mdc"):
+        marker_files.append(rule_mdc)
+    for f in marker_files:
+        text = f.read_text(encoding="utf-8")
+        assert f"standards-version: {expected}" in text, (
+            f"{f.relative_to(repo)} missing current standards-version {expected}"
+        )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_action_pins_derived(rendered, repo_type):
+    repo = rendered[repo_type]
+    major, minor, patch = _meta_version_parts()
+    drift = (repo / ".github" / "workflows" / "drift-check.yml").read_text(encoding="utf-8")
+    assert f"drift-check@v{major}.{minor}" in drift, (
+        f"drift-check.yml not pinned to derived @v{major}.{minor}"
+    )
+    if repo_type == "cursor-plugin":
+        release = (repo / ".github" / "workflows" / "release.yml").read_text(encoding="utf-8")
+        assert f"release-doc-sync@v{major}" in release, (
+            f"release.yml does not consume derived release-doc-sync@v{major}"
+        )
+        assert f"meta-repo-ref: v{major}.{minor}.{patch}" in release, (
+            "release.yml meta-repo-ref not pinned to derived full meta tag"
+        )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_readme_counts_consistent(rendered, repo_type):
+    repo = rendered[repo_type]
+    skills_dir = repo / "skills"
+    rules_dir = repo / "rules"
+    skill_count = (
+        len([d for d in skills_dir.iterdir() if (d / "SKILL.md").is_file()])
+        if skills_dir.is_dir()
+        else 0
+    )
+    rule_count = (
+        len([f for f in rules_dir.iterdir() if f.suffix == ".mdc"])
+        if rules_dir.is_dir()
+        else 0
+    )
+    readme = (repo / "README.md").read_text(encoding="utf-8")
+    if repo_type == "cursor-plugin":
+        assert f"{skill_count} skills" in readme, (
+            f"README missing '{skill_count} skills' (validate-counts would fail)"
+        )
+        assert f"{rule_count} rules" in readme, (
+            f"README missing '{rule_count} rules' (validate-counts would fail)"
+        )
+
+
+@pytest.mark.parametrize("repo_type", list(_CASES))
+def test_emitted_workflow_set_exact(rendered, repo_type):
+    repo = rendered[repo_type]
+    present = frozenset(
+        p.name
+        for p in (repo / ".github" / "workflows").iterdir()
+        if p.suffix in (".yml", ".yaml")
+    )
+    expected = _required_workflows(repo_type) | OPTIONAL_FOR_BOTH
+    assert present == expected, (
+        f"{repo_type} emitted workflows {sorted(present)} != expected "
+        f"{sorted(expected)} (required ∪ optional-for-both)"
+    )
+
+
+if __name__ == "__main__":
+    raise SystemExit(pytest.main([__file__, "-v"]))