From c4a5c6c151859477d844a0a27acd2bc4d9f30dc3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 01:15:35 +0000 Subject: [PATCH] chore(sync): rebuild wff-code/wff-chat from .claude@46d5a95 --- plugins/wff-chat/skills/ci-fix/SKILL.md | 2 +- .../agents/ossf-compliance-auditor.md | 4 +++ plugins/wff-code/skills/ci-fix/SKILL.md | 2 +- plugins/wff-code/skills/panel/data/README.md | 9 +++--- .../skills/pr-review/workflows/pr-fix.md | 28 ++++++++++--------- .../skills/pr-review/workflows/pr-review.md | 14 ++++++---- 6 files changed, 35 insertions(+), 24 deletions(-) diff --git a/plugins/wff-chat/skills/ci-fix/SKILL.md b/plugins/wff-chat/skills/ci-fix/SKILL.md index 908bfea..9b3bbe8 100644 --- a/plugins/wff-chat/skills/ci-fix/SKILL.md +++ b/plugins/wff-chat/skills/ci-fix/SKILL.md @@ -188,7 +188,7 @@ Python files changed). ### SBOM license failures may be pre-existing policy debt (was: Obs 255, dependency-review-action) -`dependency-review.yml` and the `actions/dependency-review-action` gate it ran were removed fleet-wide (2026-09): the action now requires paid GitHub Advanced Security (Code Security) and no longer functions on the free tier. This diff-scoped PR-time license/vulnerability gate is gone; the fleet's remaining license-compliance control is the post-merge, full-lockfile SBOM gate (`sbom.yml`, Trivy-based). +`dependency-review.yml` and the `actions/dependency-review-action` gate it ran were removed fleet-wide (2026-09): the action now requires paid GitHub Advanced Security (Code Security) and no longer functions on the free tier. This diff-scoped PR-time license/vulnerability gate is gone; the fleet's remaining license-compliance control is `sbom.yml` (Trivy-based). It runs on pull requests that touch `pyproject.toml` or `uv.lock` and on pushes, not only post-merge, but its caller sets `fail-on-forbidden-licenses: false`, so license enforcement is advisory, not a blocking merge gate. The same "introduced by this PR" vs. "surfaced by this PR" distinction still applies to that gate: it evaluates the full lock file on every run, so a routine Renovate version bump can surface a license-policy gap that already existed in the base branch, not one the bump introduced. diff --git a/plugins/wff-code/agents/ossf-compliance-auditor.md b/plugins/wff-code/agents/ossf-compliance-auditor.md index 03c894a..196e0cd 100644 --- a/plugins/wff-code/agents/ossf-compliance-auditor.md +++ b/plugins/wff-code/agents/ossf-compliance-auditor.md @@ -367,6 +367,10 @@ Read all YAML files under `.github/workflows/` using Glob, then Read each one. F > runs anywhere is not a finding. If a repo is found still running either > action, flag the workflow itself for removal (see repo-compliance CI-036/ > CI-081, retired) rather than auditing its `continue-on-error` setting. +> #ASSUME: the paid-GHAS billing status applies fleet-wide regardless of a +> given repo's visibility. #VERIFY: check that repo's actual GHAS entitlement +> in GitHub Settings > Code security before treating a live dependency-review +> or CodeQL step there as a non-finding. 2. The same step has `continue-on-error: true` > **`gitleaks/gitleaks-action` is intentionally excluded from this allowlist.** diff --git a/plugins/wff-code/skills/ci-fix/SKILL.md b/plugins/wff-code/skills/ci-fix/SKILL.md index 908bfea..9b3bbe8 100644 --- a/plugins/wff-code/skills/ci-fix/SKILL.md +++ b/plugins/wff-code/skills/ci-fix/SKILL.md @@ -188,7 +188,7 @@ Python files changed). ### SBOM license failures may be pre-existing policy debt (was: Obs 255, dependency-review-action) -`dependency-review.yml` and the `actions/dependency-review-action` gate it ran were removed fleet-wide (2026-09): the action now requires paid GitHub Advanced Security (Code Security) and no longer functions on the free tier. This diff-scoped PR-time license/vulnerability gate is gone; the fleet's remaining license-compliance control is the post-merge, full-lockfile SBOM gate (`sbom.yml`, Trivy-based). +`dependency-review.yml` and the `actions/dependency-review-action` gate it ran were removed fleet-wide (2026-09): the action now requires paid GitHub Advanced Security (Code Security) and no longer functions on the free tier. This diff-scoped PR-time license/vulnerability gate is gone; the fleet's remaining license-compliance control is `sbom.yml` (Trivy-based). It runs on pull requests that touch `pyproject.toml` or `uv.lock` and on pushes, not only post-merge, but its caller sets `fail-on-forbidden-licenses: false`, so license enforcement is advisory, not a blocking merge gate. The same "introduced by this PR" vs. "surfaced by this PR" distinction still applies to that gate: it evaluates the full lock file on every run, so a routine Renovate version bump can surface a license-policy gap that already existed in the base branch, not one the bump introduced. diff --git a/plugins/wff-code/skills/panel/data/README.md b/plugins/wff-code/skills/panel/data/README.md index e40c637..715ec45 100644 --- a/plugins/wff-code/skills/panel/data/README.md +++ b/plugins/wff-code/skills/panel/data/README.md @@ -43,8 +43,9 @@ level-1 panel. Re-rate them when real benchmark numbers land. ## Known gap: refresh does not detect price drift `consensus_cli.py refresh` diffs model IDs only. It cannot see a live price -change on a model that is still alive, and `input_cost` is what assigns a model -to a cost tier band and what feeds the cost cap. The 2026-08-25 refresh found -10 rows whose prices had drifted, one by 7.3x (`openai/o4-mini`, 0.15 -> 1.10). -Re-check prices against `https://openrouter.ai/api/v1/models` during any +change on a model that is still alive. `input_cost` alone assigns a model to a +cost tier band (`models_in_cost_tier`), but the cost cap (`estimate_model_cost`) +reads both `input_cost` and `output_cost`. The 2026-08-25 refresh found 10 rows +whose prices had drifted, one by 7.3x (`openai/o4-mini`, 0.15 -> 1.10). +Re-check both fields against `https://openrouter.ai/api/v1/models` during any refresh, not just liveness. diff --git a/plugins/wff-code/skills/pr-review/workflows/pr-fix.md b/plugins/wff-code/skills/pr-review/workflows/pr-fix.md index 09d4394..8bffb9a 100644 --- a/plugins/wff-code/skills/pr-review/workflows/pr-fix.md +++ b/plugins/wff-code/skills/pr-review/workflows/pr-fix.md @@ -1273,7 +1273,7 @@ platform: resolve against the platform's live docs and the CI-pinned tool versio | CI check | Static validation | | --- | --- | | ClusterFuzzLite | For each fuzz target declared in workflow: verify file exists at the declared path, has the correct extension (`.py` for Python), and compiles with `python3 -m py_compile {target}` | -| SARIF-producing scanners (Trivy, Snyk, Scorecard, SBOM) | If workflow references a SARIF file path, verify the generating step would produce it (check step ordering and output paths). SARIF now feeds `actions/upload-artifact`, not `github/codeql-action/upload-sarif`/Security tab ingestion, since GitHub Advanced Security is no longer free; verify the artifact-upload step exists where a scanner's SARIF was its only output. | +| SARIF-producing scanners (Trivy, Snyk, Scorecard, SBOM) | If workflow references a SARIF file path, verify the generating step would produce it (check step ordering and output paths). Only `codeql.yml` and `dependency-review.yml` (deleted 2026-09) stopped producing SARIF; `sbom.yml`'s Grype and OSV-Scanner jobs still call `github/codeql-action/upload-sarif` to ingest into the Security tab (categories `grype-runtime-deps`, `osv-sbom-runtime-deps`), matching `.github/workflows/README.md:120-129`. Verify the `upload-sarif` step exists for those, and treat `actions/upload-artifact` as a backup copy of the raw SBOM/SARIF file, not a replacement for Security-tab ingestion. | | SonarCloud | Verify `sonar-project.properties` has non-placeholder values for `sonar.organization` and `sonar.projectKey` | | Codecov | If `codecov.yml` exists, verify it parses as valid YAML and references existing flag names | @@ -1620,25 +1620,27 @@ still serves dangling commits, so use `compare`, not existence. Validate the fix `if:`). When the failure appeared right after an edit, confirm causation by reverting the suspected change on the current base before committing to a fix direction. -**SARIF / code-scanning orphan checks (legacy, pre-2026-09):** GitHub's CodeQL code scanning -and SARIF ingestion into the Security tab now require paid GitHub Advanced Security (Code -Security); `codeql.yml` and `github/codeql-action/upload-sarif` steps were removed fleet-wide, -so "Code scanning results / *" checks should no longer appear on new PRs at all. If one is -still visible, it is a leftover from before the billing change, not a live analysis: treat it -as permanently orphaned (not merely path-filtered) and, if it recurs, have the repo owner +**SARIF / code-scanning orphan checks, CodeQL only (legacy, pre-2026-09):** `codeql.yml` and +`dependency-review.yml` were deleted fleet-wide (2026-09; `actions/dependency-review-action` now +requires paid GitHub Advanced Security). A "CodeQL" or "Code scanning results / CodeQL" check +visible on a new PR is therefore a leftover from before the deletion, not a live analysis: treat +it as permanently orphaned (not merely path-filtered) and, if it recurs, have the repo owner disable "Code scanning: Default setup" in repo Settings > Code security so GitHub stops -registering the check context. The pre-2026-09 mechanics below (queued indefinitely because the -upstream analysis job was path-filtered or skipped on config-only/docs-only PRs) still apply to -any other SARIF-producing workflow, such as a Trivy or Snyk scan that guards a path filter. +registering the check context. This does NOT apply to other SARIF-producing workflows: `sbom.yml` +still runs `github/codeql-action/upload-sarif` for its Grype and OSV-Scanner jobs (categories +`grype-runtime-deps`, `osv-sbom-runtime-deps`), so those checks are live, not orphaned. The +pre-2026-09 mechanics below (queued indefinitely because the upstream analysis job was +path-filtered or skipped on config-only/docs-only PRs) still apply to those and to any other +SARIF-producing workflow, such as a Trivy or Snyk scan that guards a path filter. ```bash gh pr view "$PR_NUMBER" --repo "$OWNER/$REPO" --json mergeable,mergeStateStatus \ --jq '{mergeable:.mergeable, state:.mergeStateStatus}' ``` -If `mergeable: MERGEABLE` (button is active), these orphaned SARIF checks are non-blocking -advisory checks, not CI failures. Classify them as "advisory pending (path-filtered upstream -job)" and do NOT trigger a re-fix cycle. The PR is safe to merge. +If `mergeable: MERGEABLE` (button is active), a queued (not orphaned-CodeQL) SARIF check is a +non-blocking advisory check, not a CI failure. Classify it as "advisory pending (path-filtered +upstream job)" and do NOT trigger a re-fix cycle. The PR is safe to merge. Classify the outcome: diff --git a/plugins/wff-code/skills/pr-review/workflows/pr-review.md b/plugins/wff-code/skills/pr-review/workflows/pr-review.md index 279e663..c236f55 100644 --- a/plugins/wff-code/skills/pr-review/workflows/pr-review.md +++ b/plugins/wff-code/skills/pr-review/workflows/pr-review.md @@ -218,11 +218,15 @@ gh run view {RUN_ID} --repo "$OWNER/$REPO" --log \ - Log matches an infra signature, or the conclusion is `CANCELLED` (collateral cancel): emit `[Critical - likely transient, rerun]` with the matched evidence line. The - remediation is a re-run, not a code change. A docs-only or config-only diff that - fails a code-analysis check (Bandit, SonarCloud, security-analysis) is a strong tell - for this class, since such a diff cannot cause that failure. (CodeQL was retired - fleet-wide 2026-09; it should no longer appear as a check at all, see ci-fix - guidance on legacy SARIF/code-scanning checks.) + remediation is a re-run, not a code change. A docs-only diff that fails a + code-analysis check (Bandit, SonarCloud, security-analysis) is a strong tell for + this class, since such a diff cannot cause that failure. A config-only diff is + NOT automatically in this class: it can change the analysis tool's own settings, + workflow inputs, dependencies, or scan paths, any of which can cause a real + failure; only treat a config-only diff as a tell when the changed file is + unrelated to the failing analysis tool's configuration or inputs. (CodeQL was + retired fleet-wide 2026-09; it should no longer appear as a check at all, see + ci-fix guidance on legacy SARIF/code-scanning checks.) - No infra signature and the log points at the diff: emit `[Critical - PR-introduced]`; the fix is in the PR's diff.