Check the OIC listing with OIC's profile check; use shared workflows

.github/workflows/ci.yml

@@ -7,17 +7,14 @@ permissions:
   contents: read
 jobs:
   check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm typecheck
-      - run: pnpm test
-      - run: pnpm gallery:check
-      - run: pnpm build
-      - run: pnpm build:lib
+    uses: Grindstone-Systems/.github/.github/workflows/check.yml@main
+    with:
+      run: |
+        pnpm typecheck
+        pnpm test
+        pnpm gallery:check
+        pnpm build
+        pnpm build:lib
+  oic-profile:
+    # The listing, checked with OIC's own importer and Charter preflight.
+    uses: Grindstone-Systems/.github/.github/workflows/oic-profile.yml@main

.github/workflows/deploy-pages.yml

@@ -13,32 +13,10 @@ concurrency:
   group: pages
   cancel-in-progress: true
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm test && pnpm gallery:check
-      # Served from https://<org>.github.io/<repo>/ unless a custom domain is set.
+  pages:
+    uses: Grindstone-Systems/.github/.github/workflows/pages.yml@main
+    with:
+      test: pnpm test && pnpm gallery:check
       # build:pages = the app build + the <vt-symbol> scripts under lib/
       # (…/lib/vt-symbol.js, vt-symbol.iife.js, visual-toolkit.js, demo.html, frame.html).
-      - run: pnpm build:pages
-        env:
-          BASE: ${{ vars.PAGES_BASE || format('/{0}/', github.event.repository.name) }}
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: dist
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - id: deployment
-        uses: actions/deploy-pages@v4
+      build: pnpm build:pages

docs/OIC_LISTING.md

@@ -15,8 +15,11 @@ Visual Toolkit is listed at https://openindustrialcollective.org/projects/visual
 ```bash
 pnpm oic:media           # regenerate all six screenshots (starts Vite, drives your Chrome)
 pnpm oic:media hero      # or only shots whose name matches
+pnpm oic:check           # check the profile with OIC's importer and Charter preflight
 ```
 
+`oic:check` runs OIC's own profile check, the importer and Charter preflight a reviewer runs, from a cached clone of the public website repo (or the checkout in `OIC_WEBSITE`). `pnpm oic:check --ref HEAD` checks exactly what OIC would import, and its digest matches the reviewer's `fetch`. CI runs the same check through the `open-industrial-collective/website/profile-check` Action. A clean check is not an approval.
+
 Edit `.oic/project.yaml` and `.oic/overview.md` as needed. Keep claims accurate:
 - Label composed scenes as composed.
 - Only claim the Ignition workflows that docs/IGNITION.md marks as verified (8.3.9). Keep the rest marked unverified.

package.json

@@ -43,7 +43,8 @@
     "gallery:check": "tsx scripts/check-gallery.ts",
     "render:examples": "tsx scripts/render-examples.ts",
     "check": "pnpm typecheck && pnpm test && pnpm gallery:check && pnpm build && pnpm build:lib",
-    "oic:media": "tsx scripts/oic-media.ts"
+    "oic:media": "tsx scripts/oic-media.ts",
+    "oic:check": "tsx scripts/oic-check.ts"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.129.0",

scripts/oic-check.ts

@@ -0,0 +1,42 @@
+/**
+ * Check the OIC listing with OIC's own importer and Charter preflight, the
+ * same code review runs (`profile:check` in open-industrial-collective/website).
+ *
+ *   pnpm oic:check              # the working tree; flags files not committed yet
+ *   pnpm oic:check --ref HEAD   # exactly what OIC would import from that commit
+ *
+ * Uses the website checkout in OIC_WEBSITE if set, otherwise a cached shallow
+ * clone of the public website repo under node_modules/.cache. CI runs the same
+ * check through the profile-check Action.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const repo = fileURLToPath(new URL("..", import.meta.url));
+const run = (cmd: string, args: string[], cwd: string) => execFileSync(cmd, args, { cwd, stdio: ["ignore", "ignore", "inherit"] });
+
+let website = process.env.OIC_WEBSITE;
+if (!website) {
+  website = fileURLToPath(new URL("../node_modules/.cache/oic-website", import.meta.url));
+  if (!existsSync(`${website}/.git`)) run("git", ["clone", "-q", "--depth", "1", "https://github.com/open-industrial-collective/website.git", website], repo);
+  else {
+    run("git", ["fetch", "-q", "--depth", "1", "origin", "main"], website);
+    run("git", ["reset", "-q", "--hard", "FETCH_HEAD"], website);
+  }
+  // Install the importer's dependencies only when its lockfile changes.
+  const lock = createHash("sha256").update(readFileSync(`${website}/package-lock.json`)).digest("hex");
+  const stamp = `${website}/node_modules/.lock-hash`;
+  if (!existsSync(stamp) || readFileSync(stamp, "utf8") !== lock) {
+    run("npm", ["ci", "--no-audit", "--no-fund", "--ignore-scripts"], website);
+    writeFileSync(stamp, lock);
+  }
+}
+
+if (!existsSync(`${website}/scripts/check-profile.ts`)) {
+  console.error(`✗ ${website} has no profile check (scripts/check-profile.ts). Update that checkout, or point OIC_WEBSITE at one that has it.`);
+  process.exit(1);
+}
+const r = spawnSync("npm", ["run", "-s", "profile:check", "--", repo, ...process.argv.slice(2)], { cwd: website, stdio: "inherit" });
+process.exit(r.status ?? 1);