ci: harden workflows and contract registry validation (#9)

* ci: add dependabot github-actions updates

Add a github-actions package ecosystem entry so third-party actions
pinned with mutable tags (e.g. @v4) get auto-updated weekly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: harden workflow permissions and timeouts

* test(contracts): verify published registry drift

* fix(runtime): bound worker request payloads

* fix(contracts): restore canonical CAS schema ids

* fix(contracts): pin canonical v1.1.1 release

---------

Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.github/workflows/codeql.yml

@@ -8,6 +8,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read

.github/workflows/contract-registry-live.yml

@@ -0,0 +1,41 @@
+name: Contract registry live drift
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  verify-v1-1:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Compare published v1.1.1 release with vendored contracts
+        env:
+          REGISTRY_BASE: https://coding-autopilot-system.github.io/cas-contracts/registry
+          PINNED_VERSION: 1.1.1
+          VENDORED_ROOT: tests/contracts/cas-contracts/v1.1.1
+        shell: python
+        run: |
+          import hashlib, json, os, pathlib, urllib.request
+          base = os.environ["REGISTRY_BASE"]
+          version = os.environ["PINNED_VERSION"]
+          root = pathlib.Path(os.environ["VENDORED_ROOT"])
+          with urllib.request.urlopen(f"{base}/index.json", timeout=20) as response:
+              index = json.load(response)
+          if version not in index.get("releases", []):
+              raise SystemExit(f"published registry is missing release {version}")
+          with urllib.request.urlopen(f"{base}/releases/v{version}/manifest.json", timeout=20) as response:
+              manifest = json.load(response)
+          for entry in manifest["schemas"]:
+              local = (root / entry["path"]).read_bytes()
+              if hashlib.sha256(local).hexdigest() != entry["sha256"]:
+                  raise SystemExit(f"vendored digest drift: {entry['path']}")
+              with urllib.request.urlopen(f"{base}/releases/v{version}/{entry['path']}", timeout=20) as response:
+                  published = response.read()
+              if published != local:
+                  raise SystemExit(f"published content drift: {entry['path']}")

.github/workflows/pages.yml

@@ -6,14 +6,13 @@ on:
       - master
 permissions:
   contents: read
-  pages: write
-  id-token: write
 concurrency:
   group: "pages"
   cancel-in-progress: false
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -25,10 +24,14 @@ jobs:
         with:
           path: ./site
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-lint.yml

@@ -9,6 +9,9 @@ on:
 jobs:
   main:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/stale.yml

@@ -6,6 +6,10 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@v8
         with:

maf_starter/loop_worker_cli.py

@@ -14,6 +14,8 @@
     run_bounded_specialists,
 )
 
+MAX_REQUEST_BYTES = 1_000_000
+
 
 @dataclass(frozen=True)
 class WorkerEnvelope:
@@ -68,7 +70,15 @@ def main() -> int:
     parser.add_argument("--request", help="JSON worker request; stdin is used when omitted")
     args = parser.parse_args()
     try:
-        payload = json.loads(args.request if args.request is not None else sys.stdin.read())
+        if args.request is not None:
+            request_text = args.request
+            request_size = len(request_text.encode("utf-8"))
+        else:
+            request_text = sys.stdin.read(MAX_REQUEST_BYTES + 1)
+            request_size = len(request_text.encode("utf-8"))
+        if request_size > MAX_REQUEST_BYTES:
+            raise ValueError(f"Worker request exceeds {MAX_REQUEST_BYTES} bytes")
+        payload = json.loads(request_text)
         result = asyncio.run(execute_request(payload))
     except (ValueError, json.JSONDecodeError) as error:
         print(json.dumps({"error": str(error)}), file=sys.stderr)

tests/contracts/cas-contracts/v1.1.0/common.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
   "title": "CAS Common Definitions v1.1",
   "$defs": {
     "actor": {

tests/contracts/cas-contracts/v1.1.0/manifest.json

@@ -4,32 +4,32 @@
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
       "path": "common.schema.json",
-      "sha256": "078026d60c219658fe0fc5cf7c4f786acdcf0c492121f7d688d5078b33ca25af"
+      "sha256": "75d300c99779327d90872373bfc1661ba04ca1bb52335dec45fe926594ea5d7b"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
       "path": "phase-execution-request.schema.json",
-      "sha256": "927ffda5ba809e58627ba25b3275355644b510b0ae1c76f446aa7b7f291f08fd"
+      "sha256": "4577f1dc99bd04b0ccd84255d4f34935a686273f4ed4cd030ba32e2caf54315a"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
       "path": "phase-execution-result.schema.json",
-      "sha256": "1d353e20cf6338c2de4a9bec0bad83ca0dec6c9feb5434c5e6264fdc075e7c25"
+      "sha256": "bcffcbcf4e502a1d578ccce3ba0326e91f5562cd1979a83489b394cdeb4b50e1"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
       "path": "phase-verification-result.schema.json",
-      "sha256": "ec5b97a2bf75892530442f666d23a8b6dbb8f13bda0efe49553d3f64cd41b995"
+      "sha256": "ec84a47574424a5c148030f87d8a3f3cdd3041ce24056242fb6f81ddfd3c1340"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
       "path": "sdlc-lifecycle-event.schema.json",
-      "sha256": "bd955637761679d3b6e8ee09fb7b693b1d0362615b0865204c5ae3bacb3809dc"
+      "sha256": "6e397fb7f76703593fcecb95c1b53d6de0657157d7b99272ca2bb310de5d780f"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
       "path": "sdlc-profile.schema.json",
-      "sha256": "f4974e911e7cb88191c1a331470c8cd7a79d1c7311c963dd70cd9c8f524ebe45"
+      "sha256": "c435ceadceb9bde7f5c698f9ce896c12f6e5adba3811191a820e472d151ef971"
     }
   ]
 }

tests/contracts/cas-contracts/v1.1.0/phase-execution-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
   "title": "PhaseExecutionRequest",
   "type": "object",
   "allOf": [

tests/contracts/cas-contracts/v1.1.0/phase-execution-result.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
   "title": "PhaseExecutionResult",
   "type": "object",
   "allOf": [