ci(dogfood): add actionlint, repo-wide SHA-pin audit, properties.json schema#10
Open
cryptoxdog wants to merge 2 commits into
Open
ci(dogfood): add actionlint, repo-wide SHA-pin audit, properties.json schema#10cryptoxdog wants to merge 2 commits into
cryptoxdog wants to merge 2 commits into
Conversation
… schema Quantum-L9/.github only ran 2 checks (SonarCloud + validate-starters.sh, the latter still pending in PR #8) because workflow-templates/*.yml never executes in this repo -- those 9 (soon 12) files are GitHub's starter-workflow gallery, only ever run when copied into OTHER repos. This adds three real self-CI gates that dogfood the repo's own template/pack surface: - actionlint on workflow-templates/ + l9-ci-pack/workflows/ (glob is nullglob-safe, so it lints the 9 legacy templates today and picks up l9-ci-pack/ automatically once PR #8 merges). Pinned to actionlint v1.7.12 by the download script's commit SHA. - ops/audit-sha-pins.sh: repo-wide SHA-pin audit generalizing validate-starters.sh's l9-ci-pack-only @main check to every uses: line in workflow-templates/, l9-ci-pack/workflows/, and .github/workflows/. Allows only full 40-char SHAs or the documented frozen Quantum-L9/l9-ci-core tags (@v1 legacy, @v2/@v2.0.0 current). Verified against real content with both positive (33/39 refs clean) and negative (injected @main + @v4, both caught) tests; an initial regex bug that missed the common "- uses:" list-item syntax was found and fixed during testing. - ops/validate-properties-json.py + ops/schemas/workflow-template-properties.schema.json: structural JSON-Schema validation for every workflow-templates/*.properties.json. categories is intentionally left without an enum -- verified the SchemaStore community schema for this exact file type encodes only github/linguist's 865 language names and omits GitHub's 11 official fixed category buckets (Automation, continuous-integration, etc.), so a strict enum check would immediately false-flag values this repo's own templates already use. Verified against all 9 existing files (12 once PR #8 merges) plus a negative test (missing required field + wrong type, both caught). Documented all three in CONTRIBUTING.md under a new "This Repo's Own CI" section, alongside the existing SonarCloud + validate-starters.sh gates. User-approved: add more CI checks to this repo (actionlint, SHA-pin audit, properties.json schema were the three selected of six options presented). Co-authored-by: Cursor <cursoragent@cursor.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
- actionlint.yml: download the actionlint install script to a file and verify its sha256 before executing (was curl|bash with no verification — BLOCKER githubactions:S8482). - properties-json-schema.yml: pin jsonschema==4.26.0 and add --only-binary :all: to the pip install (MAJOR githubactions:S8541/S8544); wrapped in a run: | block since the bare "--only-binary :all:" plain scalar tripped actionlint's YAML parser (colon-space ambiguity). - ops/audit-sha-pins.sh: assign $1 to a local var in is_sha() before use, and use [[ instead of [ for the two remaining conditionals (MAJOR shelldre:S7679/S7688 x2). Re-verified with shellcheck (clean) and the existing positive/negative test suite (unchanged: 20/39 refs clean depending on pre/post PR #8 merge, injected violations still caught). Co-authored-by: Cursor <cursoragent@cursor.com>
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three new self-CI checks for this repo, dogfooding its own template/pack surface:
actionlint(.github/workflows/actionlint.yml) — lintsworkflow-templates/*.yml+l9-ci-pack/workflows/*.yml.nullglob-safe, so it works today (9 legacy templates) and auto-picks-upl9-ci-pack/once feat(l9-ci-pack): full v2 instantiation pack + legacy-mark @v1 starters + tag-v1.sh fix #8 merges.ops/audit-sha-pins.sh+.github/workflows/sha-pin-audit.yml) — generalizesvalidate-starters.sh's l9-ci-pack-only@maincheck to everyuses:line inworkflow-templates/,l9-ci-pack/workflows/, and.github/workflows/. Only full 40-char SHAs or the documented frozenQuantum-L9/l9-ci-coretags (@v1/@v2/@v2.0.0) pass.properties.jsonschema validation (ops/validate-properties-json.py+ops/schemas/workflow-template-properties.schema.json+.github/workflows/properties-json-schema.yml) — structural JSON-Schema check for everyworkflow-templates/*.properties.json.Why
User asked why this repo only shows 2 checks when there "should be 7 or 9 available." Root cause:
workflow-templates/*.ymlnever runs as CI in this repo — those files are GitHub's starter-workflow gallery, only executed once copied into other repos. This PR adds real, repo-native CI instead.Note on
properties.jsoncategoriesDeliberately not enum-validated. The SchemaStore community schema for this exact file type (
github-workflow-template-properties.json) encodes only github/linguist's 865 language names and omits GitHub's 11 official fixed category buckets (Automation,continuous-integration,deployment, etc. — per actions/starter-workflows's README). A strict enum would immediately false-flag values this repo's own templates already use (CI,CD,Security,Governance,Supply Chain). Validation here is structural (required fields, types) only. Full rationale in the schema file's$commentand inCONTRIBUTING.md.Verification
actionlint— clean on all 9 current templates; self-linted the 3 new workflow files too.l9-ci-packmerges); positive baseline + negative test (injected@main+@v4, both caught, then a regex bug missing- uses:list-item syntax was found and fixed) done locally before push.properties.jsonschema — 9/9 (12/12 once feat(l9-ci-pack): full v2 instantiation pack + legacy-mark @v1 starters + tag-v1.sh fix #8 merges) valid; negative test (missing required field + wrong type) caught correctly.ops/validate-starters.sh— still 0 regressions.Checklist
CONTRIBUTING.mdunder new "This Repo's Own CI" sectionMade with Cursor