mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-10 15:09:00 +02:00
8c75496391
The repo owned a redaction engine and had zero CI-side secret scanning. quality-gate.yml now pipes every PR diff's ADDED lines through our own bin/gstack-redact (gate-secret-scan.mjs, taken from the fork — it dogfoods the engine): HIGH findings fail the check, MEDIUM prints an advisory count only (no human in CI to confirm), planted-bug fixtures excluded by pathspec. Live-verified both directions: PEM key fails, clean diff and MEDIUM shapes pass; ShellCheck (errors) covers the setup/build shell boundary and passes today; bun audit gates critical advisories. Trigger is pull_request, never pull_request_target. dependency-review.yml adopts the hardened never-merged prior-art branch (fail-on-severity high, workflow paths watched, tight perms) — verify the dependency graph parses bun.lock with a canary bump before trusting the gate. dependabot: weekly, grouped per ecosystem, capped PR counts; and evals.yml image build/push now skips dependabot actors, whose read-only GITHUB_TOKEN made every lockfile bump a permanently red check. OSV scans weekly with a reasoned ignore file. All new workflow actions SHA-pinned. Scorecard deliberately not taken (no consumer for the score). The PR template front-loads the evidence bar (live proof, liveness screenshot, no-ETHOS/voice-changes checklist); the unenforced DCO line is dropped. bin/gstack-verify-gate ships OPT-IN (never registered by ./setup — a Stop hook running the project's verify command after every turn is the user's call), with the fork's tests adapted to pin exactly that. Ported from time-attack/gstack (GStack 2) + our own prior-art branch. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
45 lines
1.6 KiB
Markdown
45 lines
1.6 KiB
Markdown
<!--
|
|
gstack is AI-coded and proud of it. The bar is EVIDENCE OF REAL USE, not lines
|
|
of code. A PR with no proof behind it gets closed, no matter how clean it looks.
|
|
Fill every section below. See CONTRIBUTING.md → "The evidence bar".
|
|
-->
|
|
|
|
## Why (in your own words)
|
|
|
|
<!-- One paragraph: what breaks for a user today, and what this change does about
|
|
it. Not a restatement of the diff. -->
|
|
|
|
## Live evidence
|
|
|
|
<!-- REQUIRED. Paste the command(s) you ran and their real output — before and
|
|
after. For a bug: the reproduction, failing then fixed. For a skill change: the
|
|
actual transcript / `claude -p` output. For anything visual: before/after
|
|
screenshots. "bun test passes" alone is not enough — show the behavior you
|
|
changed. -->
|
|
|
|
```
|
|
# what you ran + what it produced
|
|
```
|
|
|
|
## Scope
|
|
|
|
- **Changed:**
|
|
- **Verified live by:**
|
|
- **Did NOT test:**
|
|
|
|
## Liveness proof (required)
|
|
|
|
<!-- Attach a screenshot of your own machine with the text `GSTACK PR` typed LIVE
|
|
into a real surface — terminal prompt, a shell command, your browser
|
|
address/search bar, an editor buffer. It must be TYPED INTO A LIVE UI, not drawn,
|
|
overlaid, or edited onto the image. A painted-on `GSTACK PR` is an automatic
|
|
close. This confirms a human opened this PR. -->
|
|
|
|
## Checklist
|
|
|
|
- [ ] Liveness screenshot attached: `GSTACK PR` typed live into a real surface (not edited onto the image)
|
|
- [ ] This is not a generated-file-only diff (I edited the source/template and regenerated)
|
|
- [ ] No ETHOS.md edits, and no changes to voice / founder perspective / YC references
|
|
- [ ] New public command / external service / host adapter has an accepted issue linked (or N/A)
|
|
- [ ] Linked issue or reproduction: #
|