fix(release): rebadge scripts bundle as ado-script

Agent-Logs-Url: https://github.com/githubnext/ado-aw/sessions/eb18237a-9266-4098-bb63-db9816eb03fd

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

Author: Copilot

.github/workflows/release.yml

@@ -67,29 +67,13 @@ jobs:
         run: |
           npm ci
           npm run build
-        # `npm run build` runs codegen + ncc + copies dist/gate/index.js
-        # to ../gate.js (i.e. scripts/gate.js), which is then included in
-        # scripts.zip by the next step.
+        # `npm run build` runs codegen + ncc and outputs dist/gate/index.js.
 
-      - name: Package scripts bundle
+      - name: Package ado-script bundle
         run: |
           set -euo pipefail
           cd scripts
-          # Only ship the bundled artefacts that pipelines actually
-          # download and execute (currently: gate.js). The TS source,
-          # tests, and tooling under ado-script/ are excluded — they
-          # live in the repo for development and CI, not in the release.
-          zip -r ../scripts.zip . \
-            -x "ado-script/node_modules/*" \
-            -x "ado-script/dist/*" \
-            -x "ado-script/schema/*" \
-            -x "ado-script/src/*" \
-            -x "ado-script/test/*" \
-            -x "ado-script/package*.json" \
-            -x "ado-script/tsconfig.json" \
-            -x "ado-script/vitest.config*.ts" \
-            -x "ado-script/README.md" \
-            -x "ado-script/.gitignore"
+          zip -r ../ado-script.zip ado-script/dist
 
       - name: Upload release assets
         env:
@@ -98,7 +82,7 @@ jobs:
           TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
           gh release upload "$TAG" \
             target/release/ado-aw-linux-x64 \
-            scripts.zip \
+            ado-script.zip \
             --clobber
 
   build-windows:
@@ -188,13 +172,13 @@ jobs:
           TAG="${{ needs.release-please.outputs.tag_name || github.event.inputs.tag_name }}"
           gh release download "$TAG" \
             --pattern "ado-aw-*" \
-            --pattern "scripts.zip" \
+            --pattern "ado-script.zip" \
             --repo "${{ github.repository }}"
           test -f ado-aw-linux-x64 || { echo "Missing ado-aw-linux-x64"; exit 1; }
           test -f ado-aw-windows-x64.exe || { echo "Missing ado-aw-windows-x64.exe"; exit 1; }
           test -f ado-aw-darwin-arm64 || { echo "Missing ado-aw-darwin-arm64"; exit 1; }
-          test -f scripts.zip || { echo "Missing scripts.zip"; exit 1; }
-          sha256sum ado-aw-linux-x64 ado-aw-windows-x64.exe ado-aw-darwin-arm64 scripts.zip > checksums.txt
+          test -f ado-script.zip || { echo "Missing ado-script.zip"; exit 1; }
+          sha256sum ado-aw-linux-x64 ado-aw-windows-x64.exe ado-aw-darwin-arm64 ado-script.zip > checksums.txt
 
       - name: Upload checksums
         env:

docs/ado-script.md

@@ -63,9 +63,8 @@ scripts/ado-script/                # TS workspace
 ```
 
 The release workflow (`.github/workflows/release.yml`) runs `npm ci &&
-npm run build` and copies `dist/gate/index.js` to `scripts/gate.js`,
-which is then included in the `scripts.zip` release asset that pipelines
-download at runtime.
+npm run build`, then packages `scripts/ado-script/dist/` as the
+`ado-script.zip` release asset that pipelines download at runtime.
 
 ## Schema codegen — preventing drift
 
@@ -111,10 +110,11 @@ steps when any `filters:` block is active:
 
 1. **`NodeTool@0`** — installs Node 20.x LTS (preinstalled on
    Microsoft-hosted images; pinned for reproducibility on others).
-2. **`curl` download** — fetches `scripts.zip` from the
+2. **`curl` download** — fetches `ado-script.zip` from the
    `githubnext/ado-aw` release matching the compiler's version and
-   extracts `gate.js` to `/tmp/ado-aw-scripts/gate.js`.
-3. **`bash: node '/tmp/ado-aw-scripts/gate.js'`** — runs the gate with
+   extracts `ado-script/dist/gate/index.js` to
+   `/tmp/ado-aw-scripts/ado-script/dist/gate/index.js`.
+3. **`bash: node '/tmp/ado-aw-scripts/ado-script/dist/gate/index.js'`** — runs the gate with
    `GATE_SPEC` (base64 JSON) plus required pipeline env vars.
 
 The IR-to-bash codegen lives in `compile_gate_step_external`

docs/filter-ir.md

@@ -235,7 +235,7 @@ require heuristic analysis and could produce false positives.
 
 Produces a complete ADO pipeline step (`- bash: |`) with a **data-driven
 architecture**: bash is a thin ADO-macro shim, all filter logic lives in
-the bundled Node.js gate evaluator (`scripts/gate.js`) that reads a JSON
+the bundled Node.js gate evaluator (`scripts/ado-script/dist/gate/index.js`) that reads a JSON
 gate spec.
 
 #### Generated Step Structure
@@ -257,7 +257,7 @@ gate spec.
     export ADO_SYSTEM_ACCESS_TOKEN="$SYSTEM_ACCESSTOKEN"
 
     # 4. Run the bundled Node evaluator (downloaded by the Setup job)
-    node '/tmp/ado-aw-scripts/gate.js'
+    node '/tmp/ado-aw-scripts/ado-script/dist/gate/index.js'
   name: prGate
   displayName: "Evaluate PR filters"
   env:
@@ -304,8 +304,8 @@ acquisition logic.
 #### Bundled Gate Evaluator (`scripts/ado-script/src/gate/`)
 
 The evaluator is a TypeScript program ncc-bundled to a single
-self-contained `scripts/gate.js` (~1.1 MB) that ships as part of the
-`scripts.zip` release asset. See [`ado-script.md`](ado-script.md) for the
+self-contained `scripts/ado-script/dist/gate/index.js` (~1.1 MB) that ships as part of the
+`ado-script.zip` release asset. See [`ado-script.md`](ado-script.md) for the
 full design and codegen pipeline. It handles:
 
 1. **Bypass logic** — reads `ADO_BUILD_REASON` and exits early for non-matching
@@ -358,11 +358,11 @@ When Tier 2/3 filters are configured, the `TriggerFiltersExtension`
 
 1. **Node install step** — emits a `NodeTool@0` step pinned to Node 20.x
    LTS so `gate.js` has a runtime
-2. **Download step** — fetches `scripts.zip` from the ado-aw release
+2. **Download step** — fetches `ado-script.zip` from the ado-aw release
    artifacts, verifies its SHA256 checksum via `checksums.txt`, then
-   extracts `gate.js` to `/tmp/ado-aw-scripts/gate.js`
+   extracts `gate.js` to `/tmp/ado-aw-scripts/ado-script/dist/gate/index.js`
 3. **Gate step** — calls `compile_gate_step_external()` to generate a step
-   that runs `node /tmp/ado-aw-scripts/gate.js` (no inline heredoc)
+   that runs `node /tmp/ado-aw-scripts/ado-script/dist/gate/index.js` (no inline heredoc)
 4. **Validation** — runs `validate_pr_filters()` / `validate_pipeline_filters()`
    during compilation via the `validate()` trait method
 
@@ -409,18 +409,18 @@ The `expression` escape hatch is also ANDed if present.
 ### Scripts Distribution
 
 The `gate.js` bundle is built from the TypeScript workspace at
-`scripts/ado-script/` (see [`ado-script.md`](ado-script.md)) and copied to
-`scripts/gate.js` by the release workflow's build step. It ships inside
-the `scripts.zip` release asset, alongside any future bundled helpers
+`scripts/ado-script/` (see [`ado-script.md`](ado-script.md)) and emitted to
+`scripts/ado-script/dist/gate/index.js` by the release workflow's build step. It ships inside
+the `ado-script.zip` release asset, alongside any future bundled helpers
 (e.g. `poll.js`, `stats.js`). The download URL is deterministic based on
 the ado-aw version:
-`https://github.com/githubnext/ado-aw/releases/download/v{VERSION}/scripts.zip`
+`https://github.com/githubnext/ado-aw/releases/download/v{VERSION}/ado-script.zip`
 
 A `checksums.txt` file is also published at the same URL base and used to
-verify the SHA256 integrity of `scripts.zip` before extraction.
+verify the SHA256 integrity of `ado-script.zip` before extraction.
 
-The Setup-job download step pulls the zip, extracts `gate.js`, and
-discards the rest. New per-use-site bundles follow the same pattern
+The Setup-job download step pulls the zip, extracts `ado-script/dist/gate/index.js`,
+and discards the rest. New per-use-site bundles follow the same pattern
 (per-bundle ncc entry + per-bundle download step).
 
 ## Adding New Filter Types
@@ -439,4 +439,3 @@ step-by-step guide. In summary:
    `lower_pipeline_filters`)
 6. Add validation rules if the new filter can conflict with existing ones
 7. Write tests: lowering, validation, spec serialization, and evaluator
-

scripts/ado-script/README.md

@@ -1,6 +1,6 @@
 # @ado-aw/scripts
 
-Bundled TypeScript scripts shipped in `scripts.zip` alongside the ado-aw release.
+Bundled TypeScript scripts shipped in `ado-script.zip` alongside the ado-aw release.
 
 ## Bundles
 
@@ -20,7 +20,7 @@ This invokes `cargo run -- export-gate-schema` to write the JSON Schema, then ru
 
 - `src/shared/` — modules shared across all bundles (auth, ado-client, vso-logger, env-facts, policy state machine)
 - `src/gate/` — gate evaluator entry point and per-concern modules
-- `dist/` — ncc bundle output (gitignored); `npm run build` copies the gate bundle to `../gate.js` for inclusion in `scripts.zip`
+- `dist/` — ncc bundle output (gitignored); `npm run build` writes `dist/gate/index.js`, which ships in `ado-script.zip`
 
 ## See also
 

scripts/ado-script/package.json

@@ -7,9 +7,9 @@
     "node": ">=20.0.0"
   },
   "scripts": {
-    "build": "npm run codegen && npm run build:gate && cp dist/gate/index.js ../gate.js",
+    "build": "npm run codegen && npm run build:gate",
     "build:gate": "ncc build src/gate/index.ts -o dist/gate -m -t",
-    "build:check": "ls -lh ../gate.js && wc -c ../gate.js",
+    "build:check": "ls -lh dist/gate/index.js && wc -c dist/gate/index.js",
     "codegen": "mkdir -p schema && cargo run --quiet --manifest-path ../../Cargo.toml -- export-gate-schema --output schema/gate-spec.schema.json && npx json2ts schema/gate-spec.schema.json -o src/shared/types.gen.ts --bannerComment \"// AUTO-GENERATED from Rust IR via cargo run -- export-gate-schema. Do not edit; run npm run codegen.\"",
     "test": "vitest run",
     "test:smoke": "npm run build && vitest run -c vitest.config.smoke.ts",

scripts/ado-script/src/gate/predicates.ts

@@ -149,7 +149,7 @@ export function evaluatePredicate(p: PredicateSpec, facts: Map<string, unknown>)
       const unknownType = (p as { type?: unknown }).type;
       logWarning(
         `Unknown predicate type '${String(unknownType)}'; failing closed. ` +
-          "Update scripts/gate.js (or the bundled scripts.zip) to a " +
+          "Update scripts/ado-script/dist/gate/index.js (or the bundled ado-script.zip) to a " +
           "release that supports this predicate.",
       );
       return false;

scripts/ado-script/src/shared/types.gen.ts

@@ -76,7 +76,7 @@ export type PredicateSpec =
 
 /**
  * Serializable gate specification — the JSON document consumed by the
- * Node gate evaluator (`scripts/gate.js`) at pipeline runtime.
+ * Node gate evaluator (`scripts/ado-script/dist/gate/index.js`) at pipeline runtime.
  */
 export interface GateSpec {
   checks: CheckSpec[];

src/compile/extensions/trigger_filters.rs

@@ -18,7 +18,7 @@ use crate::compile::filter_ir::{
 use crate::compile::types::{PipelineFilters, PrFilters};
 
 /// The path where the gate evaluator is downloaded at pipeline runtime.
-const GATE_EVAL_PATH: &str = "/tmp/ado-aw-scripts/gate.js";
+const GATE_EVAL_PATH: &str = "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js";
 
 /// Base URL for ado-aw release artifacts.
 const RELEASE_BASE_URL: &str = "https://github.com/githubnext/ado-aw/releases/download";
@@ -115,9 +115,9 @@ impl CompilerExtension for TriggerFiltersExtension {
     set -eo pipefail
     mkdir -p /tmp/ado-aw-scripts
     curl -fsSL "{RELEASE_BASE_URL}/v{version}/checksums.txt" -o /tmp/ado-aw-scripts/checksums.txt
-    curl -fsSL "{RELEASE_BASE_URL}/v{version}/scripts.zip" -o /tmp/ado-aw-scripts/scripts.zip
-    cd /tmp/ado-aw-scripts && grep "scripts.zip" checksums.txt | sha256sum -c -
-    cd /tmp/ado-aw-scripts && unzip -jo scripts.zip gate-eval.py
+    curl -fsSL "{RELEASE_BASE_URL}/v{version}/ado-script.zip" -o /tmp/ado-aw-scripts/ado-script.zip
+    cd /tmp/ado-aw-scripts && grep "ado-script.zip" checksums.txt | sha256sum -c -
+    cd /tmp/ado-aw-scripts && unzip -o ado-script.zip
   displayName: "Download ado-aw scripts (v{version})"
   condition: succeeded()"#,
         ));
@@ -241,24 +241,24 @@ mod tests {
         assert!(steps[0].contains("20.x"), "should install Node 20.x");
         assert!(steps[1].contains("curl"), "second step should download");
         assert!(
-            steps[1].contains("scripts.zip"),
-            "should download scripts.zip"
+            steps[1].contains("ado-script.zip"),
+            "should download ado-script.zip"
         );
         assert!(
             steps[1].contains("checksums.txt"),
             "should download checksums.txt"
         );
         assert!(
             steps[1].contains("sha256sum -c -"),
-            "should verify scripts.zip checksum"
+            "should verify ado-script.zip checksum"
         );
         assert!(
-            steps[1].contains("unzip -jo scripts.zip gate-eval.py"),
-            "should extract only gate-eval.py"
+            steps[1].contains("unzip -o ado-script.zip"),
+            "should extract ado-script.zip"
         );
         assert!(steps[2].contains("prGate"), "third step should be PR gate");
         assert!(
-            steps[2].contains("node '/tmp/ado-aw-scripts/gate.js'"),
+            steps[2].contains("node '/tmp/ado-aw-scripts/ado-script/dist/gate/index.js'"),
             "gate step should reference external script"
         );
     }

src/compile/filter_ir.rs

@@ -814,7 +814,7 @@ use schemars::JsonSchema;
 use serde::Serialize;
 
 /// Serializable gate specification — the JSON document consumed by the
-/// Node gate evaluator (`scripts/gate.js`) at pipeline runtime.
+/// Node gate evaluator (`scripts/ado-script/dist/gate/index.js`) at pipeline runtime.
 #[derive(Debug, Clone, Serialize, JsonSchema)]
 pub struct GateSpec {
     pub context: GateContextSpec,
@@ -1519,7 +1519,7 @@ mod tests {
         let result = compile_gate_step_external(
             GateContext::PullRequest,
             &[],
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         assert!(result.is_empty());
@@ -1538,7 +1538,7 @@ mod tests {
         let result = compile_gate_step_external(
             GateContext::PullRequest,
             &checks,
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         assert!(result.contains("- bash:"), "should be a bash step");
@@ -1547,7 +1547,7 @@ mod tests {
             "should include base64 spec in env"
         );
         assert!(
-            result.contains("node '/tmp/ado-aw-scripts/gate.js'"),
+            result.contains("node '/tmp/ado-aw-scripts/ado-script/dist/gate/index.js'"),
             "should reference external evaluator script"
         );
         assert!(result.contains("name: prGate"), "should set step name");
@@ -1570,7 +1570,7 @@ mod tests {
         let result = compile_gate_step_external(
             GateContext::PullRequest,
             &checks,
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         assert!(
@@ -1597,7 +1597,7 @@ mod tests {
         let result = compile_gate_step_external(
             GateContext::PipelineCompletion,
             &checks,
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         assert!(
@@ -1627,7 +1627,7 @@ mod tests {
         let result = compile_gate_step_external(
             GateContext::PullRequest,
             &checks,
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         assert!(
@@ -1653,7 +1653,7 @@ mod tests {
         let result = compile_gate_step_external(
             GateContext::PullRequest,
             &checks,
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         // Check export lines only (evaluator script always contains these strings)
@@ -1746,7 +1746,7 @@ mod tests {
         let step = compile_gate_step_external(
             GateContext::PullRequest,
             &checks,
-            "/tmp/ado-aw-scripts/gate.js",
+            "/tmp/ado-aw-scripts/ado-script/dist/gate/index.js",
         )
         .unwrap();
         // Step structure

tests/compiler_tests.rs

@@ -3972,7 +3972,7 @@ fn test_pr_filter_tier1_compiled_output_is_valid_yaml() {
     assert_valid_yaml(&compiled, "pr-filter-tier1-agent.md");
 }
 
-/// Tier 1 PR filters now also use the Python evaluator via extension.
+/// Tier 1 PR filters use the bundled Node evaluator via extension.
 #[test]
 fn test_pr_filter_tier1_has_evaluator_gate() {
     let compiled = compile_fixture("pr-filter-tier1-agent.md");
@@ -3990,11 +3990,11 @@ fn test_pr_filter_tier1_has_evaluator_gate() {
         "Should include base64-encoded spec"
     );
     assert!(
-        compiled.contains("node '/tmp/ado-aw-scripts/gate.js'"),
+        compiled.contains("node '/tmp/ado-aw-scripts/ado-script/dist/gate/index.js'"),
         "Should invoke node gate evaluator"
     );
     assert!(
-        compiled.contains("scripts.zip"),
+        compiled.contains("ado-script.zip"),
         "Should download scripts bundle"
     );
     assert!(
@@ -4020,15 +4020,15 @@ fn test_pr_filter_tier2_has_extension_gate() {
         "Should create Setup job for PR filters"
     );
     assert!(
-        compiled.contains("scripts.zip"),
+        compiled.contains("ado-script.zip"),
         "Tier 2 should download scripts bundle"
     );
     assert!(
         compiled.contains("GATE_SPEC"),
         "Tier 2 should include base64-encoded spec"
     );
     assert!(
-        compiled.contains("node '/tmp/ado-aw-scripts/gate.js'"),
+        compiled.contains("node '/tmp/ado-aw-scripts/ado-script/dist/gate/index.js'"),
         "Tier 2 should invoke node gate evaluator"
     );
     assert!(compiled.contains("name: prGate"), "Should have prGate step");