feat(ci): alchemy CI and deploy shape from the starter, effect 4.1.0 (SYS-900)

.changeset/effect-4-0-5-peer-floor.md

@@ -4,7 +4,7 @@
 "@systemfsoftware/storybook-gherkin": patch
 ---
 
-The Effect dependency now resolves to 4.0.5, and so does every `@effect/*` package installed with it.
+The Effect dependency resolved to 4.0.5, and so did every `@effect/*` package installed with it.
 
 - Effect 4.0.5 requires `effect@^4.0.5` as a peer, so a tree mixing 4.0.5 with an earlier 4.0.x fails at import, not at install. Install the versions your tree's `@effect/*` packages name.
 - `FileSystem.File.Info` reports `dev`, `ino`, `rdev`, `nlink` and `blocks` as `bigint` where it reported `number`. Convert at your own boundary with `BigInt` or `Number`.

.changeset/effect-4-1-0-resolved.md

@@ -0,0 +1,10 @@
+---
+"@systemfsoftware/effect-atom": patch
+"@systemfsoftware/effect-atom-react": patch
+"@systemfsoftware/storybook-gherkin": patch
+"@systemfsoftware/oxlint-config-frontend": patch
+---
+
+These packages are now verified against effect 4.1.0. The published peer range on `effect` stays `^4`, so no install requirement changes.
+
+A pull atom in `@systemfsoftware/effect-atom` now keeps the longest batch it has delivered: when two concurrent pulls finish out of order, the atom no longer drops back to the shorter batch.

.changeset/tsgo-0-63-brands.md

@@ -1,7 +1,7 @@
 ---
-"@systemfsoftware/effect-atom-react": patch
-"@systemfsoftware/effect-atom": patch
-"@systemfsoftware/storybook-gherkin": minor
+"@systemfsoftware/effect-atom-react": major
+"@systemfsoftware/effect-atom": major
+"@systemfsoftware/storybook-gherkin": major
 ---
 
 - `DuplicateCapture` carries its capture name in `capture` and `OutlineDuplicateRowName` carries its row name in `rowName`, where both carried it in `name`. A `name` payload field shadows the error's own `name`, so logs showed the field value instead of the error type. Read `capture` or `rowName`.

.github/rulesets/gates.json

@@ -25,16 +25,7 @@
       "parameters": {
         "strict_required_status_checks_policy": true,
         "required_status_checks": [
-          { "context": "check (format)" },
-          { "context": "check (lint)" },
-          { "context": "check (typecheck)" },
-          { "context": "check (test)" },
-          { "context": "check (dist)" },
-          { "context": "check (sfs-sources)" },
-          { "context": "journeys" },
-          { "context": "lint PR commits" },
-          { "context": "changeset · shared tooling / a publishable-package change needs an intent" },
-          { "context": "rules" }
+          { "context": "check" }
         ]
       }
     }

.github/workflows/check.yml

@@ -0,0 +1,57 @@
+name: Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  check:
+    name: check
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      CI: "true"
+      OXLINT_FORMAT: github
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: cachix/install-nix-action@v31
+      - name: Lift the ubuntu-24.04 AppArmor block on user namespaces
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Create the sandbox's output directory
+        run: mkdir -p .cache
+      - name: Install through the sandbox, offline from the Nix pnpm store
+        run: nix develop --command pnpm bootstrap
+      - name: Turbo cache
+        uses: actions/cache@v6
+        with:
+          path: .turbo/cache
+          key: turbo-${{ runner.os }}-check-${{ github.sha }}
+          restore-keys: |
+            turbo-${{ runner.os }}-check-
+            turbo-${{ runner.os }}-
+      - name: Check
+        run: nix develop --command pnpm exec turbo run format:check lint typecheck test --affected
+      - name: Lint PR commits
+        if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: nix develop --command sandbox -- pnpm exec commitlint --from "$BASE_SHA" --to "$HEAD_SHA" --verbose
+      - name: Require a change intent for every publishable-package change
+        if: github.event_name == 'pull_request' && !(github.head_ref == 'changeset-release/main' && github.event.pull_request.head.repo.full_name == github.repository)
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: nix develop --command changeset-management check "$BASE_SHA"

.github/workflows/deploy.yml

@@ -0,0 +1,81 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, synchronize, closed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: deploy-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+env:
+  ALCHEMY_STAGE: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || (github.ref == 'refs/heads/main' && 'prod' || github.ref_name) }}
+
+jobs:
+  deploy:
+    name: deploy
+    if: ${{ github.event.action != 'closed' && !github.event.repository.is_template && vars.ALCHEMY_DEPLOY == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: cachix/install-nix-action@v31
+      - name: Lift the ubuntu-24.04 AppArmor block on user namespaces
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Create the sandbox's output directory
+        run: mkdir -p .cache
+      - name: Install through the sandbox, offline from the Nix pnpm store
+        run: nix develop --command pnpm bootstrap
+      - name: Check provider environment
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: nix develop --command pnpm run check-env
+      - name: Deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          SITE_DOMAIN: ${{ github.ref == 'refs/heads/main' && vars.SITE_DOMAIN || '' }}
+          ALCHEMY_GITHUB_TOKEN: ${{ github.token }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: nix develop --command pnpm run deploy
+
+  cleanup:
+    name: cleanup
+    if: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' && !github.event.repository.is_template && vars.ALCHEMY_DEPLOY == 'true' && github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: cachix/install-nix-action@v31
+      - name: Lift the ubuntu-24.04 AppArmor block on user namespaces
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Create the sandbox's output directory
+        run: mkdir -p .cache
+      - name: Install through the sandbox, offline from the Nix pnpm store
+        run: nix develop --command pnpm bootstrap
+      - name: Safety check
+        run: |
+          if [ "$ALCHEMY_STAGE" = "prod" ]; then
+            echo "refusing to destroy the prod stage" >&2
+            exit 1
+          fi
+      - name: Destroy preview
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          ALCHEMY_GITHUB_TOKEN: ${{ github.token }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: nix develop --command pnpm run destroy