2 Commits

Author	SHA1	Message	Date
Auree Aubert	6683645b00	CI: run the HOL AI plugin scanner (#102) ... * CI: run the HOL AI plugin scanner hashgraph-online/awesome-ai-plugins requires every listed plugin's source repo to invoke `ai-plugin-scanner-action` on push/pull_request before the listing PR can merge (getcargohq/cargo-skills#83 → their PR #72). Pinned to a full commit SHA instead of the floating `v1` tag, with a read-only token and no secrets in scope, so a third-party action in our workflow surface can't reach anything it shouldn't. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CI: publish the scanner report when the scan fails The action's built-in summary step is `if: success()`, so a failing scan prints counts and no findings. Render markdown to a file and cat it into the step summary unconditionally. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CI: tee the scanner report to the job log as well Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * CI: clear the plugin scanner's 80-point / no-high gate The scanner job this PR added failed on its first run: 71/100 against a `min_score` of 80, one critical finding and one high. The awesome-ai-plugins contribution gate re-scans this repo with the same two thresholds, so the findings had to be fixed rather than configured around. Now 92/100 (A), zero critical, zero high. - Pin every `uses:` in .github/workflows/ to a full commit SHA, and add .github/dependabot.yml so the pins move weekly instead of never. - Add SECURITY.md: private reporting via the Security tab, and an explicit boundary between this bundle and the cargo-ai CLI / Cargo platform. - Stop inlining `curl … install.sh` in cargo/SKILL.md. The command now lives only in README.md, where a human runs it; the router keeps the guidance (never run it on the user's behalf) and points there. - Use execFileSync, not execSync, for `npm root -g` in the QA script library — no shell to interpret a command string. Windows gets the npm.cmd shim. - Fill in repository/license/keywords in .codex-plugin/plugin.json, a category on the .agents marketplace entry, and add .codexignore. - Set write_step_summary: false on the scanner action and publish the report ourselves, so it lands once whether the gate passes or fails. Two medium findings are left standing and documented in CHANGELOG.md: the `anthropic` provider slug in cargo-gtm's description (correct, and CI-synced with the CLI) and `fetch(` in the run-output downloader (the point of the function). Neither is a gate failure. Co-Authored-By: Auree Aubert <16732193+aureeaubert@users.noreply.github.com> Co-Authored-By: replicas-connector[bot] <replicas-connector[bot]@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: replicas-connector[bot] <replicas-connector[bot]@users.noreply.github.com> Co-authored-by: Auree Aubert <16732193+aureeaubert@users.noreply.github.com>	2026-08-14 19:00:18 -07:00
Auree Aubert	2792b990ed	feat(gtm): executable QA layer — fixture-tested contact-accuracy scripts (#53) ... * feat(gtm): executable QA layer — fixture-tested contact-accuracy scripts Four deterministic TypeScript scripts under cargo-gtm/scripts/ (Node >= 22.18 native type-stripping, zero deps in file mode) replace in-context row checking: - validate-emails.ts free syntax/risk/duplicate cull before paid verifyEmail - select-current-role.ts current role from an experiences array (job changers) - validate-linkedin-names.ts name<->profile match (same-name decoys); P>=0.95/R>=0.85 gate - contact-accuracy-audit.ts final per-row SEND/VERIFY/REVIEW/REMOVE stamp Each reads --input CSV/JSON or a finished run directly (--workflow-uuid via @cargo-ai/api, reusing the CLI's stored login) and self-tests with --fixtures (152 synthetic cases total). New qa-script-fixtures CI job runs every suite on push/PR. Doctrine in references/contact-accuracy.md ("run the script, don't re-derive"); wired into the router (new section 8, spine step 8) and the prospecting / outreach-activation verify steps. cargo-gtm -> 1.2.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(gtm): provider playbooks 6 → 20 + read-first gate (#54) Fourteen new per-provider playbooks grounded in live `connection integration get` schemas: sourcing/company-data (linkedin, proxycurl, apolloio, oceanio, datagma), email/contact (hunter, prospeo, icypeas, findyMail, leadMagic, contactOut, zeroBounce), research (firecrawl, serper). Each carries the action table with credit costs, real config-shape examples, input quirks, cost traps, and its recipe-spine position. Router §11 opens with a hard read-first stop before any paid call to a covered provider; the linter now errors when a playbook on disk is missing from the SKILL.md catalog. Grounding also surfaced and fixed a recipe bug: linkedin-url-lookup.md documented findProfileUrl inputs that don't exist — the live schema is fullName (required) + companyName. Stale cost-table rows (prospeo.verifyEmail, serper pricing) flagged in the CHANGELOG for the next regeneration. cargo-gtm -> 1.3.0. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(gtm): QA-chain review feedback — six wiring bugs in scripts and recipes - contact-accuracy-audit.ts: detect a bare "status" header (raw waterfall verifyEmail rows) as the verification column, lowest priority so specific headers still win; two new fixture cases. - lib/common.ts: accept raw execute-batch output ({"results": [...]} / {"records": [...]}) in JSON inputs — no jq unwrap needed. - validate-emails.ts + contact-accuracy-audit.ts: new --json flag emits rows as a JSON array for jq chaining; duplicates now get recommendation "skip" so they never enter the paid verify batch (savings count includes them). - prospecting.md step 6/6.5: the paid verify batch is built from the culled output (recommendation != "skip"), an explicit merge step joins statuses back onto ALL rows before the audit, and only audit_action == "SEND" rows proceed to write-back. - outreach-activation.md step 4: same cull -> verify survivors -> merge -> audit-all -> SEND-only flow; steps 5-6 now read the audited SEND set (deliverable.json), with the step-5/6 jq paths fixed for array input. - contact-accuracy.md: documents the never-pre-filter-to-valid rule, the execute-batch input support, and --json. All four fixture suites pass; the full recipe chain was exercised end-to-end on simulated batch outputs (disposable + duplicate culled before payment, catch-all single-source -> VERIFY, only SEND rows in the handoff set). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(gtm): case-insensitive status merge; strict identity coverage; dedupe verdict - Recipes: the verification-status merge now joins on the lowercased email — verifyEmail results may re-case the address, and a missed join left emailStatus empty, silently degrading deliverable rows to VERIFY. - contact-accuracy-audit.ts: identityColumnsPresent now requires BOTH name_match and role_confidence columns — one upstream script alone no longer masks partial identity coverage (partial-signals flag stays on). - contact-accuracy-audit.ts: new duplicate-row REMOVE rule reading the is_duplicate column — a later occurrence of an address never reaches the sequencer even when all other signals are green (found while re-testing: the case-insensitive join let the dupe inherit "valid" and SEND). 23 fixture cases pass; chain re-run with re-cased verify results yields exactly one SEND. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(gtm): merge verifyEmail via email_status, not status waterfall.verifyEmail batch rows expose the verdict on email_status per the connector output schema. The recipe merge jq read .status, so merged rows got an empty emailStatus and contact-accuracy-audit stamped VERIFY instead of SEND. Co-authored-by: Auree Aubert <aureeaubert@users.noreply.github.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Auree Aubert <aureeaubert@users.noreply.github.com>	2026-07-10 00:16:01 -07:00