docs: record the operator flags the new gates introduced #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - v* | |
| jobs: | |
| safety-harness: | |
| name: Safety Harness | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Cache bun install | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| bun-${{ runner.os }}- | |
| - name: Install dependencies | |
| run: bun ci | |
| - name: Typecheck | |
| run: bun tsc --noEmit -p tsconfig.json | |
| - name: Focused safety and execution tests | |
| run: > | |
| bun test | |
| src/infra/domain/evals/harness/process | |
| src/infra/trading/execution/preflight.test.ts | |
| src/infra/safety/transportGuardCoverage.test.ts | |
| src/app/setup/harness-checks.test.ts | |
| src/runtime/permissions | |
| src/gateway/store/command-queue-store.test.ts | |
| npm-wrapper: | |
| name: npm Wrapper (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| - windows-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Prepare npm wrapper | |
| run: npm run prepare:npm-wrapper | |
| - name: Check npm wrapper | |
| run: npm run check:npm-wrapper | |
| - name: Smoke test npm wrapper | |
| run: npm run smoke:npm-wrapper | |
| public-dist: | |
| name: Public Dist Bundle | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Prepare public dist bundle | |
| run: node scripts/build/prepare-public-dist.cjs --out-dir .public-dist | |
| - name: Verify public dist bundle | |
| run: | | |
| test -f .public-dist/README.md | |
| test -f .public-dist/install.sh | |
| test -f .public-dist/install.ps1 | |
| test -f .public-dist/Formula/gordon.rb | |
| test -f .public-dist/bucket/gordon.json | |
| audit: | |
| name: Dependency Audit | |
| runs-on: ubuntu-latest | |
| # Surface critical-severity advisories in Gordon's dependency tree | |
| # on every PR + main push. Pairs with the install-time gate | |
| # (bunfig.toml minimumReleaseAge) and the IOC scanner (doctor | |
| # checkSupplyChainIocs) for defense in depth. | |
| # | |
| # Current behavior: informational. `bun audit --audit-level=X` is a | |
| # display filter — Bun returns exit 0 regardless of findings. Output | |
| # is visible in the run log so reviewers can spot new advisories; | |
| # tighten to a hard gate via `bun audit --json | jq` once Gordon's | |
| # noise floor (mostly long-tail crypto transitives — protobufjs, | |
| # elliptic) is either patched upstream or explicitly accepted via an | |
| # ignore list. | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - name: Cache bun install | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| bun-${{ runner.os }}- | |
| - name: Install dependencies (frozen lockfile) | |
| # `bun ci` is the idiomatic alias for `bun install --frozen-lockfile` | |
| # introduced in Bun 1.2. Same semantics; reads better. | |
| run: bun ci | |
| - name: bun audit (critical-severity surface) | |
| # --ignore flags silence the long-tail transitive criticals | |
| # that we can't fix without upstream releases. Documented so | |
| # NEW criticals surface against a clean baseline. Review | |
| # quarterly; remove an --ignore the moment an upstream fix | |
| # lands so latent risk doesn't accumulate. | |
| # | |
| # Accepted criticals (audit baseline as of 2026-05): | |
| # GHSA-xq3m-2v4x-88gg — protobufjs RCE (via solana-agent-kit | |
| # / drift-labs / langchain transitives) | |
| # GHSA-vjh7-7g9h-fjfh — elliptic ECDSA key extraction (via | |
| # ethers / coinbase-sdk / metaplex / polkadot transitives) | |
| # GHSA-2w6w-674q-4c4q — handlebars AST type confusion (via | |
| # a transitive of a transitive — handlebars not used | |
| # directly) | |
| # GHSA-fjxv-7rqg-78g4 — form-data unsafe random boundary | |
| # (via transitive HTTP-client deps) | |
| # GHSA-w7jw-789q-3m8p — shell-quote newline-escape gap (via a | |
| # transitive of a dev/build tool; shell-quote not used | |
| # directly on any runtime path) | |
| run: | | |
| bun audit --audit-level=critical \ | |
| --ignore GHSA-xq3m-2v4x-88gg \ | |
| --ignore GHSA-vjh7-7g9h-fjfh \ | |
| --ignore GHSA-2w6w-674q-4c4q \ | |
| --ignore GHSA-fjxv-7rqg-78g4 \ | |
| --ignore GHSA-w7jw-789q-3m8p | |
| - name: bun audit (high-severity surface, informational) | |
| # Second pass at the lower `high` threshold. Informational only — | |
| # the noise floor is wider here (more long-tail transitive crypto | |
| # libraries). Surfaces high-severity advisories that haven't been | |
| # explicitly accepted so they don't sit invisible until they | |
| # become criticals. Exit code ignored. | |
| continue-on-error: true | |
| run: | | |
| bun audit --audit-level=high \ | |
| --ignore GHSA-xq3m-2v4x-88gg \ | |
| --ignore GHSA-vjh7-7g9h-fjfh \ | |
| --ignore GHSA-2w6w-674q-4c4q \ | |
| --ignore GHSA-fjxv-7rqg-78g4 | |
| - name: Security scanner self-test | |
| # Ensure the bunfig-wired scanner still catches its own rule set. | |
| # Runs in <1s and catches regressions in the IOC list. | |
| run: node scripts/security/gordon-security-scanner.cjs --self-test |