feat(risk): default protective trade-halt gates on with tunable thres… #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint & Format | |
| # Biome format + lint. INFORMATIONAL for now (continue-on-error), and diff-aware | |
| # on PRs (only files the PR changed). The repo has NOT been reformatted yet — | |
| # doing that days before launch would bury the launch diff. To turn this into a | |
| # blocking gate POST-LAUNCH: | |
| # 1. run `bun run format` (one-time baseline reformat) in its own commit, | |
| # 2. fix/triage any `bun run lint` findings, | |
| # 3. drop the `continue-on-error: true` line below. | |
| # Config + thresholds live in biome.json (noExplicitAny / noNonNullAssertion are | |
| # off there to avoid drowning a large TS codebase in style noise). | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - v* | |
| jobs: | |
| biome: | |
| name: Biome (format + lint) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| # Full history so the diff-aware `--since` base ref is reachable. | |
| fetch-depth: 0 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Install dependencies (frozen lockfile) | |
| run: bun ci | |
| - name: Fetch PR base ref | |
| if: github.event_name == 'pull_request' | |
| run: git fetch origin "${{ github.base_ref }}" --depth=1 | |
| - name: Biome check (informational) | |
| # continue-on-error keeps this non-blocking until the one-time format | |
| # baseline lands post-launch (see header). Remove it to enforce. | |
| continue-on-error: true | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| bunx @biomejs/biome ci --changed --since="origin/${{ github.base_ref }}" . | |
| else | |
| bunx @biomejs/biome ci . | |
| fi | |
| slop: | |
| name: AI-slop ratchet (slop-scan) | |
| # Deterministic detector of AI-generated "slop" patterns (error-obscuring / | |
| # empty catches, log-and-continue, pass-through wrappers, duplicated mocks). | |
| # RATCHET gate on PRs: fails only if the PR ADDS or WORSENS slop vs the base | |
| # — the existing 692-finding baseline never blocks. Existing findings are | |
| # mostly intentional fail-safe patterns (e.g. risk-gate fails CLOSED), so the | |
| # point is to not let NEW slop accrue, not to bulk-fix the baseline. If a | |
| # large refactor trips a false "worsened", add `continue-on-error: true`. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Install dependencies (frozen lockfile) | |
| run: bun ci | |
| - name: Materialize base ref | |
| run: | | |
| git fetch origin "${{ github.base_ref }}" --depth=1 | |
| git worktree add ../gordon-base "origin/${{ github.base_ref }}" | |
| - name: slop-scan delta (ratchet) | |
| # Explicit --ignore on both sides so base + head are scoped identically | |
| # regardless of whether the base ref predates slop-scan.config.json. | |
| run: > | |
| bunx slop-scan delta --base ../gordon-base --head . | |
| --ignore 'claude-code-source-code/**' | |
| --ignore 'agents/**' | |
| --ignore 'margin-cli/**' | |
| --ignore 'dist/**' | |
| --ignore '.public-dist/**' | |
| --ignore 'docs/generated/**' | |
| --ignore '**/*.min.js' | |
| --ignore '.site-index.js' | |
| --fail-on added,worsened |