Skip to content

ci: add agent-shield.yml workflow #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 1 commit into from
Apr 8, 2026
Merged

ci: add agent-shield.yml workflow #78

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 103 additions & 0 deletions .github/workflows/agent-shield.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
# AgentShield — Agent configuration security validation
# See: standards/agent-standards.md

Copilot AI Apr 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The header comment points to standards/agent-standards.md, but this repository doesn’t contain that path. Consider changing it to a fully-qualified org-standards URL (or another local reference) so readers don’t assume there’s a missing file in this repo.

Suggested change
# See: standards/agent-standards.md
# See: https://github.com/petry-projects/.github/blob/main/standards/agent-standards.md

Copilot uses AI. Check for mistakes.
#
# Two-layer approach:
# 1. affaan-m/agentshield action — deep security scan (102 rules across
# secrets, permissions, hooks, MCP servers, and agent config)
Comment on lines +5 to +6

Copilot AI Apr 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow comments say it uses the "affaan-m/agentshield action", but the implementation actually runs the AgentShield CLI via npx ecc-agentshield@.... Please align the comment with the actual mechanism (CLI vs action) to avoid confusion when maintaining/updating this workflow.

Suggested change
# 1. affaan-m/agentshield action — deep security scan (102 rules across
# secrets, permissions, hooks, MCP servers, and agent config)
# 1. AgentShield CLI via ecc-agentshield — deep security scan (102 rules
# across secrets, permissions, hooks, MCP servers, and agent config)

Copilot uses AI. Check for mistakes.
# 2. Org-specific structural checks — required files, cross-references,
# SKILL.md frontmatter validation

name: AgentShield

on:
push:
branches: [main]
pull_request:
branches: [main]

permissions:
contents: read

jobs:
agent-shield:
name: AgentShield
Comment on lines +18 to +23

Copilot AI Apr 8, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For consistency with other workflows in this repo (e.g., codeql-analysis.yml, sonarcloud.yml), consider setting workflow-level permissions: {} and moving contents: read under the job’s permissions:. This keeps the workflow least-privilege by default if additional jobs are added later.

Suggested change
permissions:
contents: read
jobs:
agent-shield:
name: AgentShield
permissions: {}
jobs:
agent-shield:
name: AgentShield
permissions:
contents: read

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

# --- Deep security scan via AgentShield CLI ---
# Uses ecc-agentshield (https://github.com/affaan-m/agentshield)
# 102 rules: secrets, permissions, hooks, MCP servers, agent config
- name: AgentShield Security Scan
run: |
npx ecc-agentshield@1.4.0 scan \
--path . \
--min-severity high \
--format terminal

# --- Org-specific structural checks ---
- name: Check required agent files exist
run: |
status=0

if [ ! -f "CLAUDE.md" ]; then
echo "::error::Missing CLAUDE.md"
status=1
fi

if [ ! -f "AGENTS.md" ]; then
echo "::error::Missing AGENTS.md"
status=1
fi

exit $status

- name: Validate cross-references
run: |
status=0

if [ -f "CLAUDE.md" ] && \
! grep -qi 'AGENTS.md' CLAUDE.md; then
echo "::error file=CLAUDE.md::Must reference AGENTS.md"
status=1
fi

if [ -f "AGENTS.md" ] && \
! grep -qi 'petry-projects/\.github' AGENTS.md; then
echo "::error file=AGENTS.md::Must reference org standards"
status=1
fi

exit $status

- name: Validate SKILL.md frontmatter
run: |
status=0

while IFS= read -r file; do
frontmatter=$(awk \
'/^---$/{n++; next} n==1{print} n>=2{exit}' \
"$file")

if [ -z "$frontmatter" ]; then
echo "::error file=$file::Missing YAML frontmatter"
status=1
continue
fi

if ! echo "$frontmatter" | grep -q '^name:'; then
echo "::error file=$file::Missing 'name' field"
status=1
fi
if ! echo "$frontmatter" | grep -q '^description:'; then
echo "::error file=$file::Missing 'description' field"
status=1
fi
done < <(find . -name 'SKILL.md' \
-not -path '*/node_modules/*' \
-not -path '*/.git/*')

if [ "$status" -eq 0 ]; then
echo "All SKILL.md frontmatter validated."
fi
exit $status
Loading