fix(git): harden audit_engine and banned_attribution_lib (PT canonical guard stack) #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Markdown Lint | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "**" ] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| lint: | |
| name: Markdownlint-cli2 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # Ratchet, not a blanket retrofit: as of this workflow's introduction, | |
| # 96 pre-existing .md files (1646 MD013 violations) fail this rule. | |
| # Linting the whole tree on every PR would put an unrelated red status | |
| # check on nearly every future doc-touching PR until someone does a | |
| # separate, dedicated cleanup pass -- exactly the "overly rigid | |
| # formatting demands" this setup is meant to avoid. Scope to files the | |
| # PR/push actually changed; pre-existing files come into compliance | |
| # naturally as they're touched, new files are held to the rule from | |
| # day one. | |
| # | |
| # separator: "," is required on BOTH steps below, not optional | |
| # styling -- tj-actions/changed-files defaults all_changed_files to | |
| # SPACE-separated, while markdownlint-cli2-action defaults its globs | |
| # input to NEWLINE-separated. Left at their defaults, a PR touching | |
| # 2+ .md files produces a single space-joined string that | |
| # markdownlint-cli2-action can't parse as multiple globs -- it | |
| # silently lints 0 files and the job reports success without ever | |
| # having checked anything. Matching the upstream changed.yml example | |
| # from DavidAnson/markdownlint-cli2-action's own repo. | |
| - name: Get changed markdown files | |
| id: changed-md | |
| uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 -- pinned to commit, not a tag: v1-v45.x were the tags retroactively hijacked in CVE-2025-30066 (a threat actor compromised the repo and re-pointed those exact tags to a secrets-exfiltrating commit). Verified against the actual tag list (`git ls-remote --tags`) before pinning, not copied from a third-party source. | |
| with: | |
| files: | | |
| **/*.md | |
| files_ignore: | | |
| CHANGELOG.md | |
| vendor/** | |
| .agent/memory/semantic/LESSONS.md | |
| separator: "," | |
| - name: Run markdownlint-cli2 on changed files | |
| if: steps.changed-md.outputs.any_changed == 'true' | |
| uses: davidanson/markdownlint-cli2-action@v19 | |
| with: | |
| globs: ${{ steps.changed-md.outputs.all_changed_files }} | |
| separator: "," |