ruv 90df1d6e8a feat(ci): #2089 ADR-127 Phase 1 — github-safe injection smoke + uses: pin smoke + supply-chain allowed-deps actions block ...

Creates two new CI smoke scripts and wires them into v3-ci.yml.

smoke-github-safe-injection.mjs
  Generalizes the smoke-pre-bash-hook.mjs pattern (#2017) to the GitHub
  helper surface.  Drives adversarial PR/issue bodies (backticks, $(),
  semicolons, empty) through github-safe.js via a fake-gh shim and
  asserts the body lands verbatim in a temp file with --body-file, not
  inline as --body.  The >256KB cap case is documented as a red→green
  transition for Phase 2 (no cap yet enforced).  Runs against both
  .claude/helpers/github-safe.js (dogfood) and the init-template copy.

smoke-github-actions-pins.mjs
  Static scan of .claude/agents/github/*.md, .claude/skills/github-*/
  SKILL.md, and v3/@claude-flow/cli/.claude/commands/github/*.md.  Every
  uses: ref must be SHA-pinned (40-hex) OR present in the new
  .github/supply-chain/allowed-deps.json "actions" block.  Exits 0 now
  that allowed-deps.json covers the full set of refs in-use.  Phase 3
  upgrades @v3→@v4 across all files; this smoke is the regression gate
  that prevents them drifting back.

.github/supply-chain/allowed-deps.json
  Adds "actions" key with allowed[], minimumVersion, and an explanatory
  comment per ADR-127 §Phase 1.  Lists all GitHub Actions currently
  referenced in scope: checkout, setup-node, pnpm/action-setup, cache,
  upload-artifact, ruvnet/swarm-action, aws-actions/configure-aws-credentials.

.github/workflows/v3-ci.yml
  Adds path-filter entries under both push and pull_request triggers
  covering the 6 ADR-127-specified paths:
    .claude/agents/github/**
    .claude/skills/github-*/**
    v3/@claude-flow/cli/.claude/commands/github/**
    .claude/helpers/github-safe.js
    v3/@claude-flow/cli/.claude/helpers/github-safe.js
    scripts/smoke-github-*.mjs
    .github/supply-chain/allowed-deps.json
  Adds two independent smoke jobs: github-safe-injection-smoke and
  github-actions-pins-smoke, following the ruvllm-wasm-auto-init-smoke
  pattern.

Co-Authored-By: RuFlo <ruv@ruv.net>

2026-05-21 14:03:29 -04:00

4.1 KiB

Raw Permalink Blame History

View Raw