mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-10 15:09:00 +02:00
8c75496391
The repo owned a redaction engine and had zero CI-side secret scanning. quality-gate.yml now pipes every PR diff's ADDED lines through our own bin/gstack-redact (gate-secret-scan.mjs, taken from the fork — it dogfoods the engine): HIGH findings fail the check, MEDIUM prints an advisory count only (no human in CI to confirm), planted-bug fixtures excluded by pathspec. Live-verified both directions: PEM key fails, clean diff and MEDIUM shapes pass; ShellCheck (errors) covers the setup/build shell boundary and passes today; bun audit gates critical advisories. Trigger is pull_request, never pull_request_target. dependency-review.yml adopts the hardened never-merged prior-art branch (fail-on-severity high, workflow paths watched, tight perms) — verify the dependency graph parses bun.lock with a canary bump before trusting the gate. dependabot: weekly, grouped per ecosystem, capped PR counts; and evals.yml image build/push now skips dependabot actors, whose read-only GITHUB_TOKEN made every lockfile bump a permanently red check. OSV scans weekly with a reasoned ignore file. All new workflow actions SHA-pinned. Scorecard deliberately not taken (no consumer for the score). The PR template front-loads the evidence bar (live proof, liveness screenshot, no-ETHOS/voice-changes checklist); the unenforced DCO line is dropped. bin/gstack-verify-gate ships OPT-IN (never registered by ./setup — a Stop hook running the project's verify command after every turn is the user's call), with the fork's tests adapted to pin exactly that. Ported from time-attack/gstack (GStack 2) + our own prior-art branch. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
78 lines
2.6 KiB
YAML
78 lines
2.6 KiB
YAML
# Quality gate (fork port wave 2, adapted from time-attack/gstack GStack 2).
|
|
#
|
|
# Three generic hygiene checks the repo previously had nowhere in CI:
|
|
# 1. Credential scan of the PR diff's ADDED lines through our own
|
|
# bin/gstack-redact (HIGH fails the check; MEDIUM is an advisory count —
|
|
# there is no human in CI to confirm, so it never fails here).
|
|
# 2. bun audit at critical severity.
|
|
# 3. ShellCheck (errors only) on the setup/build shell boundary.
|
|
#
|
|
# Trigger is `pull_request`, NEVER `pull_request_target`: fork PRs must not
|
|
# get secret-bearing contexts. Diff excludes cover the planted-bug fixtures
|
|
# and eval baselines that intentionally contain credential-shaped strings.
|
|
name: Quality gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: quality-gate-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubicloud-standard-8
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
with:
|
|
bun-version: latest
|
|
|
|
- name: Install frozen dependencies
|
|
run: bun install --frozen-lockfile --ignore-scripts
|
|
|
|
- name: Scan changed text for credentials (added lines, own redact engine)
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
|
|
BASE_SHA=$(git rev-parse HEAD^)
|
|
fi
|
|
git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
|
|
. \
|
|
':(exclude)test/fixtures/**' \
|
|
':(exclude)browse/test/fixtures/**' \
|
|
':(exclude)docs/evals/**' \
|
|
':(exclude)test/helpers/security-bench*' \
|
|
| node .github/scripts/gate-secret-scan.mjs
|
|
|
|
- name: Gate critical dependency advisories
|
|
run: bun audit --audit-level=critical
|
|
|
|
- name: Install ShellCheck
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y shellcheck
|
|
shellcheck --version
|
|
|
|
- name: ShellCheck setup and build boundaries
|
|
run: >-
|
|
shellcheck --severity=error
|
|
setup
|
|
scripts/build.sh
|
|
scripts/build-app.sh
|
|
scripts/write-version-files.sh
|
|
browse/scripts/build-node-server.sh
|