feat: adopt actionlint, zizmor, and osv-scanner from ci-workflows - #22
Merged
Conversation
Newly consume the Phase 2 ci-workflows building blocks (none ran here before): - actionlint composite action (SHA-pinned 62235bb) — lints this repo's own workflows; blocking. - zizmor reusable workflow (c59411f, paths: .) — Actions security lint; advisory. - osv-scanner reusable workflow (c59411f) — dependency vuln scan over package-lock.json; advisory (fail-on-vuln defaults false). Its caller job grants actions/contents/security-events as the wrapped Google workflows require at parse time. All three feed the local ci-status gateway. Also add a 7-day Dependabot cooldown to both ecosystem entries (clears zizmor's dependabot-cooldown findings; security updates bypass cooldown). Verified locally: actionlint clean; check-jsonschema validates the workflows and the cooldown'd dependabot.yml; zizmor offline reports no medium/high findings (one low adhoc-packages note remains for the fixtures lanes' deliberate inline installs). osv-scanner reports two medium dev-dependency advisories (js-yaml, markdown-it) — advisory, tracked for a separate lockfile bump. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Jun 23, 2026
…es (#23) The advisory osv-scanner lane (PR #22) surfaced two medium dev-dependency vulnerabilities, both transitive under markdownlint-cli2@0.22.1, which pins them to exact versions: - js-yaml 4.1.1 -> 4.2.0 (GHSA-h67p-54hq-rp68) - markdown-it 14.1.1 -> 14.2.0 (GHSA-6v5v-wf23-fmfq) Because the parent pins exact versions, force the patched floors with a scoped npm override (the standard mechanism for a transitive security bump without waiting on the upstream release). Both are minor, semver-compatible bumps. Verified: npm audit and osv-scanner both report 0 vulnerabilities; the markdown module fixtures test still passes, so markdownlint-cli2 behavior is unchanged. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
4 tasks
kyle-sexton
added a commit
that referenced
this pull request
Jul 15, 2026
…ception, bot composition, reply protocol) (#122) ## Summary Five reasoning-only convention updates to `engineering/naming.md` and `conventions/review/`: - **naming.md** — promotes the org-wide branch-naming grammar (Conventional Commits type prefix + cloud-agent/bot prefix, kebab-case slug) into its own section, restated abstractly rather than cited from any single downstream repo. - **naming.md** — excepts `github-iac`'s label-governance seam (`GovernedRepositorySpec.PreviousNames` aliasing, `Labels.cs` taxonomy applied via `Github.IssueLabels`) from the "Rename across all coupled edges" rule, since both propagate through a separate reviewed Pulumi deployment on their own cadence rather than atomically with the originating rename. - **conventions/review/reply-protocol.md** (new) — codifies the threaded, same-surface `Fixed in <sha>` reply as the standard way to close a review finding once addressed, plus conditional (bot-thread-only) resolution. - **conventions/review/ai-review-bot-composition.md** (new) — documents the expected AI-review-bot composition per repository governance class (archived / no-CI-surface / governed / high-traffic primary), derived from `github-iac`'s `GovernedRepositorySpec` registry rather than from visibility or ownership. - **conventions/review/code-quality.md** — converts the PR-title prose bullet to a reference-only pointer at the `pr-title` workflow (`ci-workflows/.github/workflows/semantic-pr.yml`) and `enforceability-tiers.md`, removing the duplicated deterministic-rule prose. ## Decisions closed - #24 `naming-branch-convention-org-wide` - #64 `naming-doc-conflict-content-fix` - #22 `replies-codify-inline-reply-protocol` - #51 `tooling-gov-review-bot-composition-standard` - #67 `tooling-gov-standards-catalog-duplicate-prose` Decisions Log: https://claude.ai/code/artifact/232ecdce-8316-4880-8c0a-dc3c7dcf3a63 Evidence/rationale: https://claude.ai/code/artifact/3160ae0e-c02f-4619-8de3-60d73faa1100 ## Test plan - [x] `markdownlint-cli2` — 0 errors on all changed/new files - [x] `lychee --offline` — 0 broken links/anchors - [x] `typos` — clean - [x] Local `lefthook` pre-commit hooks (typos, gitleaks, editorconfig, markdownlint) — all passed at commit time 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Newly consume the Phase 2
ci-workflowsbuilding blocks.standardsran none of these before, so this is additive (no inline copies to retire).New lanes (all feed
ci-status)actionlintcomposite action (…/actions/actionlint@62235bb) — lints this repo's own workflows. Blocking (workflows already pass).zizmorreusable workflow (…/workflows/zizmor.yml@c59411f,paths: .) — Actions security lint. Advisory (annotates without blocking).osv-scannerreusable workflow (…/workflows/osv-scanner.yml@c59411f) — dependency vuln scan overpackage-lock.json. Advisory (fail-on-vulndefaults false). Its caller job grantsactions: read/contents: read/security-events: write, which Google's wrapped reusable workflows require at parse time.Dependabot cooldown
Added a 7-day
cooldownto both ecosystem entries (github-actions, npm) — clears zizmor'sdependabot-cooldownfindings. Cooldown applies only to version updates; security updates bypass it.Known advisory findings (surfaced, not blocking)
js-yaml4.1.1→4.2.0 (GHSA-h67p-54hq-rp68) andmarkdown-it14.1.1→14.2.0 (GHSA-6v5v-wf23-fmfq). Both lockfile-fixable; tracked for a separatenpmbump (kept out of this CI-adoption PR).adhoc-packagesnote on the fixtures lanes' deliberate inline tool installs (intentional — those lanes install pinned tools to assert specific rule codes).Verification
Local pre-checks pass: actionlint clean;
check-jsonschemavalidates the workflows and the cooldown'ddependabot.yml; zizmor offline reports no medium/high findings. The cross-repo reusable-workflow resolution and the livepackage-lock.jsonscan run on this PR's CI.🤖 Generated with Claude Code