ci: adopt the shared PR checks workflow; add missing audit scripts - #24
Merged
Conversation
nanoterm had no PR checks at all — build.yml and update-badges.yml only — so nothing ran on a pull request despite a full test suite being present. Sixth repo onto the shared workflow. Three things had to change first. test:audit and test:security were missing. nanoterm was the only repo in the org without them, so test:all meant something different here than everywhere else. Both now match the org definitions and are wired into scripts/test.sh alongside the existing checks. knip then failed on the new test:security script — semgrep is a system binary, not a dependency, and nanoterm had no knip config at all so it ran with defaults. Added knip.json allowlisting semgrep, the same way sentinel and prompt-scrubber already do. Coverage is 61.5% against an org floor of 80 — the largest gap in the org. The floor is pinned at 61 with fail-on-drop doing the work, so coverage cannot regress while the gap closes. Tracked in #23. nanoterm stays out of the org quality ruleset until it clears 80. Verified locally: lint, format, types, knip, build, audit and coverage all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WoygKgfq3ahXinVVHqjA8
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
build.yml ran `pnpm run test:all` on a bare ubuntu runner. Adding test:security to scripts/test.sh in the previous commit broke it — `sh: 1: semgrep: not found` — because semgrep is a system binary that is not installed there. The shared workflow runs semgrep in the semgrep/semgrep container for exactly this reason. Rather than special-case test.sh, drop the workflow. It duplicated the shared checks and did less: no coverage floor, no build verification, no CodeQL, and a security scan that could never have run. Same reasoning as removing prompt-scrubber's ci.yml. The build badge is unaffected — update-badges.yml runs its own build step and does not read this workflow's status. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WoygKgfq3ahXinVVHqjA8
nanoterm was the only repo computing its build badge from `pnpm run test:all`; nanotune, get-md and sentinel all use `pnpm build`. That drift had two consequences. The badge labelled "build" actually reported the entire test suite, so a lint or coverage problem showed up as a build failure. And now that test:all includes test:security, this step would have run semgrep on a bare runner and flipped the badge to failing — the same `semgrep: not found` that took out build.yml. Aligns with the rest of the org: the build badge reports whether the build succeeds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WoygKgfq3ahXinVVHqjA8
This was referenced Aug 30, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixth repo onto the shared
pr-checksworkflow inNano-Collective/.github.nanotermhad no PR checks at all — onlybuild.ymlandupdate-badges.yml— so despite having a full test suite, nothing ran on a pull request.Three things had to clear first
1. Missing audit scripts
nanotermwas the only repo in the org withouttest:auditandtest:security, sotest:allmeant something different here than everywhere else. Both now match the org definitions and are wired intoscripts/test.sh.2. knip rejected the new script
Adding
test:securitybroke knip:semgrepis a system binary, not a dependency, andnanotermhad no knip config at all so it ran with defaults. Addedknip.jsonallowlisting it — the same approach sentinel and prompt-scrubber already use.3. Coverage is below the org floor
61.5% against a standard of 80 — the largest gap in the org. The floor is pinned just under current coverage:
fail-on-drop does the real work from today: the baseline is read from the committed coverage badge on
main, so coverage cannot regress while the gap closes.Tracked in #23.
nanotermstays out of the org quality ruleset until the input can be deleted.Verified locally
test:linttest:formattest:typestest:knipbuildtest:audittest:ava:coverageNote
This repo has zero open PRs and zero open issues, so nothing is queued behind any of it.