Repository navigation
test(ci): pin reusable-workflow policy and guardrail negative controls - #13
Open
SaulBuilds wants to merge 1 commit into
Open
SaulBuilds wants to merge 1 commit into
SaulBuilds wants to merge 1 commit into
Conversation
Adds scripts/ci/test_workflow_policy.py (stdlib unittest, no network) and runs it from ci.yml: - negative controls for workflow-guardrails.sh: each check (C1 misplaced workflow, C2 continue-on-error / exit-code swallow, C3 mutable branch pin and mutable cross-repo ref, C4 template expansion in run:) is fed a mutated copy of the workflow tree and must report FAIL; the clean tree must PASS. - policy pins the guardrail does not look at: blocking dependency audit in the rust/js/python pipelines (default on), callable checksum-pinned secret scan, missing requested js script fails the job, package-manager allowlist, Slither on by default, every remote action SHA-pinned, Dependabot config in .github/, caller snippets pinned to a SHA, protocol-constrained install lines, reachable security-report channel, README row per reusable workflow. Revert check: each guarded property was reverted one at a time in a scratch tree; every one turns a named test red. No workflow behaviour changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KGMeatV8UjtCB4CTbWuAv4
BerryManifold
approved these changes
Oct 27, 2026
BerryManifold
left a comment
BerryManifold
left a comment
Contributor
There was a problem hiding this comment.
Automated Codex static review of 8e8f8b0a92f120ef6482ee1acf3141466d0c1760 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.
Matr0xshka
approved these changes
Oct 27, 2026
Matr0xshka
left a comment
Matr0xshka
left a comment
There was a problem hiding this comment.
Automated Codex static review of 8e8f8b0a92f120ef6482ee1acf3141466d0c1760 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tests only; no workflow behaviour changes. These are org-wide templates, so this PR adds checks rather than edits.
What
scripts/ci/test_workflow_policy.py(stdlib unittest, no network), run fromci.yml:workflow-guardrails.sh: each check (C1 misplaced workflow, C2 continue-on-error /|| true, C3 mutable branch pin / mutable cross-repo ref, C4${{ }}inrun:) is run against a mutated temp copy of the tree and must report FAIL. The clean tree must PASS..github/; caller snippets pinned to a SHA; install lines constrained to--proto '=https' --tlsv1.2; a reachable security-report channel; a README row for each reusable workflow.Standard: met
workflow-guardrails.shPASS.test-canon-guardrail.shPASS.Left open (owner)
reusable-canon-guardrail.ymlchecks out the shared script at a fixed SHA that predates the path-only exclusion fix, so callers still run the older script. The fix is to bump thatref:to a post-fix SHA. That changes what runs in every caller, so I'm leaving it for a deliberate bump.🤖 Generated with Claude Code
https://claude.ai/code/session_01KGMeatV8UjtCB4CTbWuAv4