Skip to content

Commit 2f3d573

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
ci: deploy missing standard workflows (5 added)
Added from rsr-template-repo: standardizing CI/CD across all repos. Part of global TODO cleanup (2026-03-16). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 4d706e0 commit 2f3d573

5 files changed

Lines changed: 246 additions & 0 deletions

File tree

‎.github/workflows/instant-sync.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Instant Forge Sync - Triggers propagation to all forges on push/release
3+
name: Instant Sync
4+
5+
on:
6+
push:
7+
branches: [main, master]
8+
release:
9+
types: [published]
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
dispatch:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Trigger Propagation
19+
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
20+
with:
21+
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
22+
repository: hyperpolymath/.git-private-farm
23+
event-type: propagate
24+
client-payload: |-
25+
{
26+
"repo": "${{ github.event.repository.name }}",
27+
"ref": "${{ github.ref }}",
28+
"sha": "${{ github.sha }}",
29+
"forges": ""
30+
}
31+
32+
- name: Confirm
33+
run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

‎.github/workflows/npm-bun-blocker.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: NPM/Bun Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Block npm/bun
15+
run: |
16+
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
17+
echo "❌ npm/bun artifacts detected. Use Deno instead."
18+
exit 1
19+
fi
20+
echo "✅ No npm/bun violations"

‎.github/workflows/scorecard-enforcer.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
3+
name: OpenSSF Scorecard Enforcer
4+
5+
on:
6+
push:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 6 * * 1' # Weekly on Monday
10+
workflow_dispatch:
11+
12+
permissions: read-all
13+
14+
jobs:
15+
scorecard:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
id-token: write # For OIDC
20+
steps:
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run Scorecard
26+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: Upload SARIF
33+
uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v3
34+
with:
35+
sarif_file: results.sarif
36+
37+
- name: Check minimum score
38+
run: |
39+
# Parse score from results
40+
SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
41+
42+
echo "OpenSSF Scorecard Score: $SCORE"
43+
44+
# Minimum acceptable score (0-10 scale)
45+
MIN_SCORE=5
46+
47+
if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
48+
echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
49+
exit 1
50+
fi
51+
52+
# Check specific high-priority items
53+
check-critical:
54+
runs-on: ubuntu-latest
55+
steps:
56+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
57+
58+
- name: Check SECURITY.md exists
59+
run: |
60+
if [ ! -f "SECURITY.md" ]; then
61+
echo "::error::SECURITY.md is required"
62+
exit 1
63+
fi
64+
65+
- name: Check for pinned dependencies
66+
run: |
67+
# Check workflows for unpinned actions
68+
unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
69+
if [ -n "$unpinned" ]; then
70+
echo "::warning::Found unpinned actions:"
71+
echo "$unpinned"
72+
fi

‎.github/workflows/ts-blocker.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: TypeScript/JavaScript Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Block new TypeScript/JavaScript
15+
run: |
16+
NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true)
17+
NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
18+
19+
if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
20+
echo "❌ New TS/JS files detected. Use ReScript instead."
21+
[ -n "$NEW_TS" ] && echo "$NEW_TS"
22+
[ -n "$NEW_JS" ] && echo "$NEW_JS"
23+
exit 1
24+
fi
25+
echo "✅ ReScript policy enforced"

‎.github/workflows/wellknown-enforcement.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Well-Known Standards (RFC 9116 + RSR)
3+
on:
4+
push:
5+
branches: [main, master]
6+
paths:
7+
- '.well-known/**'
8+
- 'security.txt'
9+
pull_request:
10+
paths:
11+
- '.well-known/**'
12+
schedule:
13+
# Weekly expiry check
14+
- cron: '0 9 * * *'
15+
workflow_dispatch:
16+
17+
18+
permissions: read-all
19+
20+
jobs:
21+
validate:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
steps:
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
28+
- name: RFC 9116 security.txt validation
29+
run: |
30+
SECTXT=""
31+
[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"
32+
[ -f "security.txt" ] && SECTXT="security.txt"
33+
34+
if [ -z "$SECTXT" ]; then
35+
echo "::warning::No security.txt found. See https://github.com/{{OWNER}}/well-known-ecosystem"
36+
exit 0
37+
fi
38+
39+
# Required: Contact
40+
grep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }
41+
42+
# Required: Expires
43+
if ! grep -q "^Expires:" "$SECTXT"; then
44+
echo "::error::Missing Expires field"
45+
exit 1
46+
fi
47+
48+
# Check expiry
49+
EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1)
50+
if date -d "$EXPIRES" > /dev/null 2>&1; then
51+
DAYS=$(( ($(date -d "$EXPIRES" +%s) - $(date +%s)) / 86400 ))
52+
if [ $DAYS -lt 0 ]; then
53+
echo "::error::security.txt EXPIRED"
54+
exit 1
55+
elif [ $DAYS -lt 30 ]; then
56+
echo "::warning::security.txt expires in $DAYS days"
57+
else
58+
echo "✅ security.txt valid ($DAYS days)"
59+
fi
60+
fi
61+
62+
- name: RSR well-known compliance
63+
run: |
64+
MISSING=""
65+
[ ! -f ".well-known/security.txt" ] && [ ! -f "security.txt" ] && MISSING="$MISSING security.txt"
66+
[ ! -f ".well-known/ai.txt" ] && MISSING="$MISSING ai.txt"
67+
[ ! -f ".well-known/humans.txt" ] && MISSING="$MISSING humans.txt"
68+
69+
if [ -n "$MISSING" ]; then
70+
echo "::warning::Missing RSR recommended files:$MISSING"
71+
echo "Reference: https://github.com/{{OWNER}}/well-known-ecosystem/.well-known/"
72+
else
73+
echo "✅ RSR well-known compliant"
74+
fi
75+
76+
- name: Mixed content check
77+
run: |
78+
MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com' | head -5 || true)
79+
if [ -n "$MIXED" ]; then
80+
echo "::error::Mixed content (HTTP in HTML)"
81+
echo "$MIXED"
82+
exit 1
83+
fi
84+
echo "✅ No mixed content"
85+
86+
- name: DNS security records check
87+
if: hashFiles('CNAME') != ''
88+
run: |
89+
DOMAIN=$(cat CNAME 2>/dev/null | tr -d '\n')
90+
if [ -n "$DOMAIN" ]; then
91+
echo "Checking DNS for $DOMAIN..."
92+
# CAA record
93+
dig +short CAA "$DOMAIN" | grep -q "issue" && echo "✅ CAA record" || echo "::warning::No CAA record"
94+
# DNSSEC
95+
dig +dnssec +short "$DOMAIN" | grep -q "RRSIG" && echo "✅ DNSSEC" || echo "::warning::No DNSSEC"
96+
fi

0 commit comments

Comments
 (0)