fix(security): close Lane B findings from adversarial review c6c486 #331
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Pin third-party Actions to full commit SHAs (SEC-004). Floating @vN tags are mutable. | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.0 | |
| - name: ShellCheck | |
| # -S warning: fail on warnings + errors (genuine bugs); advisory info-level checks vary by | |
| # shellcheck version across runners, so don't gate CI on them. | |
| run: shellcheck -S warning scripts/*.sh scripts/lib/*.sh | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: "22" | |
| # No package-lock.json to key on, so cache ~/.npm by the pinned skills CLI version. | |
| # Bump the key when SKILLS_CLI in scripts/install-skills.sh changes. | |
| - name: Cache npx skills CLI | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.2.3 | |
| with: | |
| path: ~/.npm | |
| key: npx-skills-1.5.12 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install skill-creator | |
| run: | | |
| npx skills@1.5.12 add https://github.com/anthropics/skills --skill skill-creator -y -p | |
| # npx skills rewrites skills-lock.json without the committed ref pin; | |
| # restore the tracked (pinned) lock so registry-lint validates the | |
| # committed state, not the installer's transient unpinned rewrite. | |
| git checkout -- skills-lock.json | |
| - name: Install Python test deps | |
| run: | | |
| python3 -m venv .venv | |
| .venv/bin/pip install -r requirements.txt | |
| - name: Docs-site sync gate (committed generated copy must not drift) | |
| # docs-site/src/content/docs/ is a committed generated copy of | |
| # docs/guide/. --check regenerates in-memory and fails (listing the | |
| # drifted files) if the committed copy is stale, so a forgotten | |
| # `sync_guide_starlight.py` run can't slip a stale copy past CI. | |
| run: | | |
| .venv/bin/python scripts/sync_guide_starlight.py --check | |
| - name: Install ImageMagick (banner resize) | |
| # scripts/banner/sniff_and_normalize_banner.sh normalizes banners to 2:1; | |
| # macOS uses sips, Linux/CI needs ImageMagick. ubuntu-latest no longer | |
| # ships it, so install it explicitly (the sniff test exercises resize). | |
| run: sudo apt-get update && sudo apt-get install -y imagemagick | |
| - name: Run all validators and tests | |
| run: ./scripts/validate-all.sh | |
| - name: Mutation gate (assert tests catch representative bugs) | |
| run: ./scripts/mutation-check.sh |