feat(calm-suite): add CALM Guard and CALM Studio projects

.github/CODEOWNERS

@@ -10,6 +10,8 @@
 
 /shared/ @aidanm3341 @lbulanti-ms @willosborne @grahampacker-ms @jpgough-ms @rocketstack-matt @Thels @LeighFinegold @markscott-ms
 
+/calm-suite/ @opsflowanoop @gjs-opsflo @eddie-knight @rocketstack-matt @markscott-ms @jpgough-ms
+
 # Ownership for dependency-related files at the root level
 /package.json @finos/architecture-as-code-maintainers
 /package-lock.json @finos/architecture-as-code-maintainers

.github/workflows/automated-release-calm-studio.yml

@@ -0,0 +1,58 @@
+name: CALM Studio - Automated Release
+
+concurrency:
+    group: calm-studio-release
+    cancel-in-progress: false
+
+permissions:
+    contents: write
+    issues: write
+    pull-requests: write
+
+on:
+    push:
+        branches:
+            - main
+        paths:
+            - 'calm-suite/calm-studio/**'
+    workflow_dispatch:
+
+defaults:
+    run:
+        working-directory: calm-suite/calm-studio
+
+jobs:
+    release:
+        name: Multi-Package Semantic Release
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Setup pnpm
+              uses: pnpm/action-setup@v4
+              with:
+                  version: 9
+
+            - name: Setup Node.js
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version: 22
+                  cache: pnpm
+                  cache-dependency-path: calm-suite/calm-studio/pnpm-lock.yaml
+                  registry-url: 'https://registry.npmjs.org'
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Build
+              run: pnpm -r run build
+
+            - name: Release
+              run: pnpm dlx multi-semantic-release
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/build-calm-guard.yml

@@ -0,0 +1,107 @@
+name: Build CALM Guard
+
+permissions:
+    contents: read
+
+on:
+    pull_request:
+        branches:
+            - 'main'
+            - 'release*'
+        paths:
+            - 'calm-suite/calm-guard/**'
+            - '.github/workflows/build-calm-guard.yml'
+    push:
+        branches:
+            - 'main'
+            - 'release*'
+        paths:
+            - 'calm-suite/calm-guard/**'
+            - '.github/workflows/build-calm-guard.yml'
+
+defaults:
+    run:
+        working-directory: calm-suite/calm-guard
+
+jobs:
+    lint:
+        name: Lint & Typecheck
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@v4
+              with:
+                  package_json_file: calm-suite/calm-guard/package.json
+
+            - name: Setup Node.js
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version: 22
+                  cache: pnpm
+                  cache-dependency-path: calm-suite/calm-guard/pnpm-lock.yaml
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Lint
+              run: pnpm lint
+
+            - name: Typecheck
+              run: pnpm typecheck
+
+    test:
+        name: Test
+        runs-on: ubuntu-latest
+        needs: lint
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@v4
+              with:
+                  package_json_file: calm-suite/calm-guard/package.json
+
+            - name: Setup Node.js
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version: 22
+                  cache: pnpm
+                  cache-dependency-path: calm-suite/calm-guard/pnpm-lock.yaml
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Run tests
+              run: pnpm test:run
+
+    build:
+        name: Build
+        runs-on: ubuntu-latest
+        needs: test
+        env:
+            NEXT_SKIP_VALIDATE: "1"
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@v4
+              with:
+                  package_json_file: calm-suite/calm-guard/package.json
+
+            - name: Setup Node.js
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version: 22
+                  cache: pnpm
+                  cache-dependency-path: calm-suite/calm-guard/pnpm-lock.yaml
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Build
+              run: pnpm build

.github/workflows/build-calm-studio-desktop.yml

@@ -0,0 +1,148 @@
+name: Build CALM Studio Desktop
+
+permissions:
+    contents: write
+
+on:
+    push:
+        tags:
+            - 'calm-studio-v*'
+    workflow_dispatch:
+        inputs:
+            draft:
+                description: 'Create as draft release'
+                type: boolean
+                default: true
+
+defaults:
+    run:
+        working-directory: calm-suite/calm-studio
+
+jobs:
+    build-sidecar:
+        name: Build MCP Sidecar (${{ matrix.target }})
+        runs-on: ${{ matrix.os }}
+        strategy:
+            matrix:
+                include:
+                    - os: macos-latest
+                      target: node20-macos-arm64
+                      triple: aarch64-apple-darwin
+                    - os: macos-13
+                      target: node20-macos-x64
+                      triple: x86_64-apple-darwin
+                    - os: ubuntu-22.04
+                      target: node20-linux-x64
+                      triple: x86_64-unknown-linux-gnu
+                    - os: windows-latest
+                      target: node20-win-x64
+                      triple: x86_64-pc-windows-msvc
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 9
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version: 22
+                  cache: pnpm
+                  cache-dependency-path: calm-suite/calm-studio/pnpm-lock.yaml
+            - run: pnpm install --frozen-lockfile
+            - run: pnpm --filter @calmstudio/calm-core build
+            - name: Build sidecar
+              run: |
+                  cd packages/mcp-server
+                  pnpm build:bundle
+                  pnpm dlx @yao-pkg/pkg dist/bundle.cjs --target ${{ matrix.target }} --output dist/calmstudio-mcp
+            - name: Rename with target triple
+              shell: bash
+              run: |
+                  cd packages/mcp-server/dist
+                  if [ "${{ runner.os }}" = "Windows" ]; then
+                    mv calmstudio-mcp.exe calmstudio-mcp-${{ matrix.triple }}.exe
+                  else
+                    mv calmstudio-mcp calmstudio-mcp-${{ matrix.triple }}
+                  fi
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+              with:
+                  name: sidecar-${{ matrix.triple }}
+                  path: calm-suite/calm-studio/packages/mcp-server/dist/calmstudio-mcp-*
+
+    build-desktop:
+        name: Build Desktop (${{ matrix.triple }})
+        needs: build-sidecar
+        runs-on: ${{ matrix.os }}
+        strategy:
+            matrix:
+                include:
+                    - os: macos-latest
+                      args: --target aarch64-apple-darwin
+                      triple: aarch64-apple-darwin
+                    - os: macos-13
+                      args: --target x86_64-apple-darwin
+                      triple: x86_64-apple-darwin
+                    - os: ubuntu-22.04
+                      args: ''
+                      triple: x86_64-unknown-linux-gnu
+                    - os: windows-latest
+                      args: ''
+                      triple: x86_64-pc-windows-msvc
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            - uses: pnpm/action-setup@v4
+              with:
+                  version: 9
+            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+              with:
+                  node-version: 22
+                  cache: pnpm
+                  cache-dependency-path: calm-suite/calm-studio/pnpm-lock.yaml
+            - run: cd calm-suite/calm-studio && pnpm install --frozen-lockfile
+
+            - name: Install Linux dependencies
+              if: runner.os == 'Linux'
+              run: |
+                  sudo apt-get update
+                  sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+
+            - name: Install Rust
+              uses: dtolnay/rust-toolchain@stable
+              with:
+                  targets: ${{ matrix.triple }}
+
+            - name: Rust cache
+              uses: swatinem/rust-cache@v2
+              with:
+                  workspaces: calm-suite/calm-studio/apps/studio/src-tauri
+
+            - name: Download sidecar binary
+              uses: actions/download-artifact@v4
+              with:
+                  name: sidecar-${{ matrix.triple }}
+                  path: calm-suite/calm-studio/apps/studio/src-tauri/binaries/
+
+            - name: Make sidecar executable
+              if: runner.os != 'Windows'
+              run: chmod +x apps/studio/src-tauri/binaries/calmstudio-mcp-*
+
+            - name: Build desktop app
+              uses: tauri-apps/tauri-action@v0
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+                  APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+                  APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+                  APPLE_ID: ${{ secrets.APPLE_ID }}
+                  APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+                  APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+                  TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+                  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+              with:
+                  projectPath: calm-suite/calm-studio/apps/studio
+                  tauriScript: pnpm tauri
+                  args: ${{ matrix.args }}
+                  tagName: ${{ github.ref_name }}
+                  releaseName: 'CalmStudio ${{ github.ref_name }}'
+                  releaseBody: 'See the assets below for platform-specific downloads.'
+                  releaseDraft: ${{ github.event.inputs.draft || 'false' }}
+                  prerelease: false