699b2d7769
* ci(security): run deterministic eval tests in affected-area CI (Task 04) The build-check job validated build + suite structure but never ran the tests, and its summary referenced a `test:ci` script that did not exist. Make affected-area CI meaningful: - Add `test:ci` to evals/framework running the offline, deterministic Vitest allowlist (7 files / 112 tests) — no model, network, or paid execution. - Add a required "Run deterministic tests" step to build-check; a failure fails the job and the existing PR summary gate (which keys on build-check.result) fails closed. - Correct the summary note to state test:ci runs the deterministic allowlist and that model/network agent suites are excluded on PRs. The broader deterministic suite has 3 pre-existing failing files (framework-confidence, logger, test-runner; confirmed failing before this work) which are intentionally out of the allowlist and tracked separately. Validated locally: build, validate:suites:all, and test:ci all exit 0. * ci(security): least privilege permissions + pin actions to SHAs (Task 05) Harden all 9 GitHub Actions workflows: Least privilege: - Add explicit top-level `permissions: contents: read` to installer-checks, validate-test-suites, and opencode (opencode's job keeps the writes it needs; the top level now defaults to read). - Every workflow now declares an explicit top-level permissions block. - Write scopes retained only where justified (releases, doc/registry commits, follow-up PRs, and sync-docs' issues.create). Immutable action pinning: - Pin every `uses:` to a full 40-char commit SHA with a version comment, including first-party actions/* (checkout, github-script, setup-node, upload-artifact) and third-party (oven-sh/setup-bun). - Replace the two mutable refs that could change under us at any push: ludeeus/action-shellcheck@master and sst/opencode/github@latest. Record all SHAs, versions, and permission justifications in docs/maintenance/repository-recovery/action-pin-inventory.md. Verified: all 9 workflows parse as valid YAML; no floating tag/branch refs remain; every workflow has a top-level permissions block. * docs(security): add SECURITY.md and private-reporting checklist (Task 06) - Add root SECURITY.md: supported versions (0.7.x), private reporting via GitHub's "Report a vulnerability", best-effort response expectations, coordinated disclosure, and no-secret guidance. - Add private-vulnerability-reporting checklist that separates repository file work (this PR) from GitHub settings changes that require their own approval (Task 07: enabling private vulnerability reporting). No external links to validate; the reporting path uses the repo Security tab. SECURITY.md documents the private reporting path ahead of Task 07 enabling it. * ci(security): add dependency governance and ownership controls (Task 08) - .github/dependabot.yml: weekly grouped github-actions updates (keeps the Task 05 SHA pins current). Scoped to actions only — the primary lockfile is bun.lock and Dependabot's npm ecosystem would desync it; npm dependency risk is covered by dependency-review below. - .github/workflows/dependency-review.yml: runs on PRs with contents: read, SHA-pinned actions, fail-on-severity: high to block newly introduced high-severity vulnerabilities (exceptions documented inline). - .github/CODEOWNERS: default owner @darrenhinde with explicit ownership of security-sensitive paths (workflows, dependabot, CODEOWNERS, SECURITY.md, scripts/validation). Verified: dependabot.yml and dependency-review.yml are valid YAML; dependency-review actions are SHA-pinned with contents: read; CODEOWNERS owner is the repository owner. * docs(security): record GitHub security settings evidence (Task 07) Enable private vulnerability reporting and record read-back evidence. Settings changed (each approved immediately before, verified by read-back): - Private vulnerability reporting: enabled=false -> enabled=true. The Security tab now offers "Report a vulnerability", making the path documented in SECURITY.md live. - Dependency Graph / Dependabot alerts: 404 -> 204. This was an undocumented prerequisite of Task 08's dependency-review.yml, which failed with "Dependency graph is not enabled"; the Dependency Review check on PR #336 went fail -> pass after enabling it. No other repository setting was modified; secret scanning and push protection are unchanged, and dependabot_security_updates remains disabled (out of scope, would need its own approval). Both changes are reversible via the corresponding DELETE calls. Marks Part B of the private-vulnerability-reporting checklist complete.
125 lines
4.9 KiB
YAML
125 lines
4.9 KiB
YAML
name: Update Component Registry (Direct Push)
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- '.opencode/**'
|
|
- '!registry.json'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
update-and-validate-registry:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y jq
|
|
|
|
- name: Make scripts executable
|
|
run: |
|
|
chmod +x scripts/registry/validate-registry.sh
|
|
chmod +x scripts/registry/auto-detect-components.sh
|
|
chmod +x scripts/registry/register-component.sh
|
|
|
|
- name: Auto-detect new components
|
|
id: auto_detect
|
|
run: |
|
|
echo "## 🔍 Auto-Detection Results" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
|
|
# Run auto-detect in dry-run mode first
|
|
if ./scripts/registry/auto-detect-components.sh --dry-run > /tmp/detect-output.txt 2>&1; then
|
|
cat /tmp/detect-output.txt >> $GITHUB_STEP_SUMMARY
|
|
|
|
# Check if new components were found
|
|
if grep -q "Found.*new component" /tmp/detect-output.txt; then
|
|
echo "new_components=true" >> $GITHUB_OUTPUT
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "⚠️ New components detected - will auto-add to registry" >> $GITHUB_STEP_SUMMARY
|
|
else
|
|
echo "new_components=false" >> $GITHUB_OUTPUT
|
|
echo "✅ No new components found" >> $GITHUB_STEP_SUMMARY
|
|
fi
|
|
else
|
|
echo "new_components=false" >> $GITHUB_OUTPUT
|
|
echo "❌ Auto-detection failed" >> $GITHUB_STEP_SUMMARY
|
|
fi
|
|
|
|
- name: Add new components to registry
|
|
if: steps.auto_detect.outputs.new_components == 'true'
|
|
run: |
|
|
echo "## 📝 Adding New Components" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
|
|
./scripts/registry/auto-detect-components.sh --auto-add | tee -a $GITHUB_STEP_SUMMARY
|
|
|
|
- name: Validate registry
|
|
id: validate
|
|
run: |
|
|
echo "## ✅ Registry Validation" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
|
|
if ./scripts/registry/validate-registry.sh -v > /tmp/validation-output.txt 2>&1; then
|
|
echo "validation=passed" >> $GITHUB_OUTPUT
|
|
echo "✅ All registry paths are valid!" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
|
tail -20 /tmp/validation-output.txt >> $GITHUB_STEP_SUMMARY
|
|
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
|
else
|
|
echo "validation=failed" >> $GITHUB_OUTPUT
|
|
echo "❌ Registry validation failed!" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
|
cat /tmp/validation-output.txt >> $GITHUB_STEP_SUMMARY
|
|
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "⚠️ WARNING: Direct push to main with invalid registry!" >> $GITHUB_STEP_SUMMARY
|
|
echo "Please fix registry.json and push a correction." >> $GITHUB_STEP_SUMMARY
|
|
# Don't exit 1 here - we already pushed to main, just warn
|
|
fi
|
|
|
|
- name: Commit registry updates
|
|
if: steps.auto_detect.outputs.new_components == 'true'
|
|
run: |
|
|
git config --local user.email "github-actions[bot]@users.noreply.github.com"
|
|
git config --local user.name "github-actions[bot]"
|
|
|
|
if ! git diff --quiet registry.json; then
|
|
git add registry.json
|
|
git commit -m "chore: auto-update registry with new components [skip ci]"
|
|
git push
|
|
|
|
echo "## 🚀 Registry Updated" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "Registry has been automatically updated with new components." >> $GITHUB_STEP_SUMMARY
|
|
fi
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "---" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "### Registry Statistics" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
jq -r '
|
|
"- **Agents:** \(.components.agents | length)",
|
|
"- **Subagents:** \(.components.subagents | length)",
|
|
"- **Commands:** \(.components.commands | length)",
|
|
"- **Tools:** \(.components.tools | length)",
|
|
"- **Plugins:** \(.components.plugins | length)",
|
|
"- **Contexts:** \(.components.contexts | length)"
|
|
' registry.json >> $GITHUB_STEP_SUMMARY
|