ci: harden workflows and registry compatibility (#14)

* ci: add dependabot github-actions updates

Add a github-actions package ecosystem entry so third-party actions
pinned with mutable tags (e.g. @v4) get auto-updated weekly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: harden workflow permissions and timeouts

* test(contracts): verify published registry drift

* docs(build): correct project verification commands

* fix: normalize contract digest comparisons

* fix(contracts): pin canonical v1.1.1 release

* fix(contracts): canonicalize release bytes as LF

---------

Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -10,6 +10,9 @@ on:
 jobs:
   build:
     runs-on: windows-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/codeql.yml

@@ -8,6 +8,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read

.github/workflows/contract-registry-live.yml

@@ -0,0 +1,50 @@
+name: Contract registry live drift
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  verify-v1-1:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Compare published v1.1.1 release with vendored contracts
+        env:
+          REGISTRY_BASE: https://coding-autopilot-system.github.io/cas-contracts/registry
+          PINNED_VERSION: 1.1.1
+          VENDORED_ROOT: src/GsdOrchestrator.Tests/Contracts/cas-contracts/v1.1.1
+        shell: python
+        run: |
+          import hashlib, json, os, pathlib, urllib.request
+
+          def canonical_bytes(data: bytes) -> bytes:
+              return data.replace(b"\r\n", b"\n")
+
+          def sha256_hex(data: bytes) -> str:
+              return hashlib.sha256(canonical_bytes(data)).hexdigest()
+
+          base = os.environ["REGISTRY_BASE"]
+          version = os.environ["PINNED_VERSION"]
+          root = pathlib.Path(os.environ["VENDORED_ROOT"])
+          with urllib.request.urlopen(f"{base}/index.json", timeout=20) as response:
+              index = json.load(response)
+          if version not in index.get("releases", []):
+              raise SystemExit(f"published registry is missing release {version}")
+          with urllib.request.urlopen(f"{base}/releases/v{version}/manifest.json", timeout=20) as response:
+              manifest = json.load(response)
+          for entry in manifest["schemas"]:
+              local = (root / entry["path"]).read_bytes()
+              if sha256_hex(local) != entry["sha256"]:
+                  raise SystemExit(f"vendored digest drift: {entry['path']}")
+              with urllib.request.urlopen(f"{base}/releases/v{version}/{entry['path']}", timeout=20) as response:
+                  published = response.read()
+              if sha256_hex(published) != entry["sha256"]:
+                  raise SystemExit(f"published digest drift: {entry['path']}")
+              if canonical_bytes(published) != canonical_bytes(local):
+                  raise SystemExit(f"published content drift: {entry['path']}")

.github/workflows/pages.yml

@@ -6,14 +6,13 @@ on:
       - master
 permissions:
   contents: read
-  pages: write
-  id-token: write
 concurrency:
   group: "pages"
   cancel-in-progress: false
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -25,10 +24,14 @@ jobs:
         with:
           path: ./site
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-lint.yml

@@ -9,6 +9,9 @@ on:
 jobs:
   main:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/stale.yml

@@ -6,6 +6,10 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@v8
         with:

CLAUDE.md

@@ -53,7 +53,8 @@ All configuration is environment-variable driven (`.env` or shell):
 ## Build & Test
 
 ```powershell
-dotnet build src/GsdOrchestrator.sln
+dotnet build src/GsdOrchestrator/GsdOrchestrator.csproj
+dotnet build src/GsdOrchestrator.Tests/GsdOrchestrator.Tests.csproj
 dotnet test src/GsdOrchestrator.Tests/GsdOrchestrator.Tests.csproj
 ```
 

src/GsdOrchestrator.Tests/ContractCompatibilityTests.cs

@@ -1,4 +1,5 @@
 using System.Security.Cryptography;
+using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
 using GsdOrchestrator.Workflows.Models;
@@ -18,24 +19,35 @@ namespace GsdOrchestrator.Tests;
 /// check self-contained and offline (no JSON-Schema validator NuGet dependency).
 ///
 /// Cross-repo reference note: cas-contracts is a separate repo. In isolated CI only
-/// this repo is checked out, so the pinned v1.1.0 release is vendored under
-/// GsdOrchestrator.Tests/Contracts/cas-contracts/v1.1.0/ (same convention as the
+/// this repo is checked out, so the pinned v1.1.1 release is vendored under
+/// GsdOrchestrator.Tests/Contracts/cas-contracts/v1.1.1/ (same convention as the
 /// Python consumers). When the sibling ../cas-contracts checkout is present
 /// (local dev), an extra test asserts the vendored copy has not drifted upstream.
 /// </summary>
 public class ContractCompatibilityTests
 {
     // The cas-contracts version this consumer targets. Kept in lockstep with the
     // vendored release and with SdlcProfile.CasSdlcV1.ProfileVersion.
+    private const string PinnedReleaseVersion = "1.1.1";
     private const string PinnedSchemaVersion = "1.1.0";
     private const string PinnedProfileVersion = "v1.1";
 
     private static string ContractRoot { get; } = Path.Combine(
-        AppContext.BaseDirectory, "Contracts", "cas-contracts", $"v{PinnedSchemaVersion}");
+        AppContext.BaseDirectory, "Contracts", "cas-contracts", $"v{PinnedReleaseVersion}");
 
     private static JsonNode LoadSchema(string name) =>
         JsonNode.Parse(File.ReadAllText(Path.Combine(ContractRoot, name)))!;
 
+    private static byte[] ReadCanonicalUtf8Bytes(string path)
+    {
+        var text = File.ReadAllText(path);
+        var normalized = text.ReplaceLineEndings("\n");
+        return Encoding.UTF8.GetBytes(normalized);
+    }
+
+    private static string Sha256Hex(byte[] bytes) =>
+        Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
+
     /// <summary>Walk up from the test output directory to find a sibling
     /// cas-contracts/registry/releases/v{version} checkout, or null if absent.</summary>
     private static string? ResolveUpstreamRoot()
@@ -44,7 +56,7 @@ private static JsonNode LoadSchema(string name) =>
         while (dir is not null)
         {
             var candidate = Path.Combine(
-                dir.FullName, "cas-contracts", "registry", "releases", $"v{PinnedSchemaVersion}");
+                dir.FullName, "cas-contracts", "registry", "releases", $"v{PinnedReleaseVersion}");
             if (Directory.Exists(candidate))
             {
                 return candidate;
@@ -115,18 +127,41 @@ private static JsonObject BuildProfileWirePayload()
     public void VendoredRelease_MatchesManifestHashes()
     {
         var manifest = LoadSchema("manifest.json");
-        Assert.Equal(PinnedSchemaVersion, (string?)manifest["version"]);
+        Assert.Equal(PinnedReleaseVersion, (string?)manifest["version"]);
 
         foreach (var entry in manifest["schemas"]!.AsArray())
         {
             var path = (string)entry!["path"]!;
             var expected = (string)entry["sha256"]!;
-            var bytes = File.ReadAllBytes(Path.Combine(ContractRoot, path));
-            var actual = Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
+            var bytes = ReadCanonicalUtf8Bytes(Path.Combine(ContractRoot, path));
+            var actual = Sha256Hex(bytes);
             Assert.Equal(expected, actual);
         }
     }
 
+    [Fact]
+    public void CanonicalSchemaDigest_IgnoresLineEndings()
+    {
+        var crlfPath = Path.GetTempFileName();
+        var lfPath = Path.GetTempFileName();
+
+        try
+        {
+            File.WriteAllText(crlfPath, "{\r\n  \"name\": \"schema\"\r\n}\r\n", new UTF8Encoding(false));
+            File.WriteAllText(lfPath, "{\n  \"name\": \"schema\"\n}\n", new UTF8Encoding(false));
+
+            var crlf = Sha256Hex(ReadCanonicalUtf8Bytes(crlfPath));
+            var lf = Sha256Hex(ReadCanonicalUtf8Bytes(lfPath));
+
+            Assert.Equal(crlf, lf);
+        }
+        finally
+        {
+            File.Delete(crlfPath);
+            File.Delete(lfPath);
+        }
+    }
+
     [Fact]
     public void PinnedVersion_IsTheVersionThisConsumerEmits()
     {
@@ -214,8 +249,8 @@ public void VendoredRelease_MatchesUpstreamSourceOfTruth()
         {
             var upstream = Path.Combine(upstreamRoot, Path.GetFileName(file));
             Assert.True(File.Exists(upstream), $"upstream missing {Path.GetFileName(file)}");
-            var local = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(file)));
-            var remote = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(upstream)));
+            var local = Sha256Hex(ReadCanonicalUtf8Bytes(file));
+            var remote = Sha256Hex(ReadCanonicalUtf8Bytes(upstream));
             Assert.Equal(remote, local);
         }
     }

src/GsdOrchestrator.Tests/Contracts/cas-contracts/v1.1.0/common.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",
   "title": "CAS Common Definitions v1.1",
   "$defs": {
     "actor": {

src/GsdOrchestrator.Tests/Contracts/cas-contracts/v1.1.0/manifest.json

@@ -2,34 +2,34 @@
   "version": "1.1.0",
   "schemas": [
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/common.schema.json",
       "path": "common.schema.json",
-      "sha256": "078026d60c219658fe0fc5cf7c4f786acdcf0c492121f7d688d5078b33ca25af"
+      "sha256": "111ea168b873aa99a5f2d731f1295320c83c8424156546be9dbdc5624c597562"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-request.schema.json",
       "path": "phase-execution-request.schema.json",
-      "sha256": "927ffda5ba809e58627ba25b3275355644b510b0ae1c76f446aa7b7f291f08fd"
+      "sha256": "a9dd60ade628f98cdc97fec9900f4b429f81e0fe07413a2ff21cd42188f85fb6"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-execution-result.schema.json",
       "path": "phase-execution-result.schema.json",
-      "sha256": "1d353e20cf6338c2de4a9bec0bad83ca0dec6c9feb5434c5e6264fdc075e7c25"
+      "sha256": "7c56cc51aa0f8ae878a4f8219a4b1bedc20697f57d557797a0907a7163df1f7e"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/phase-verification-result.schema.json",
       "path": "phase-verification-result.schema.json",
-      "sha256": "ec5b97a2bf75892530442f666d23a8b6dbb8f13bda0efe49553d3f64cd41b995"
+      "sha256": "800cfceecd61a16883a5be67f0da9ff9fa8865450c62e92676a878189c12b6cc"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-lifecycle-event.schema.json",
       "path": "sdlc-lifecycle-event.schema.json",
-      "sha256": "bd955637761679d3b6e8ee09fb7b693b1d0362615b0865204c5ae3bacb3809dc"
+      "sha256": "f746915fc3687496be216d0b8bcfec0398a8c5eebb765ff8c63e7c9ee88b174f"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v1.1/sdlc-profile.schema.json",
       "path": "sdlc-profile.schema.json",
-      "sha256": "f4974e911e7cb88191c1a331470c8cd7a79d1c7311c963dd70cd9c8f524ebe45"
+      "sha256": "80e75549b7ef49182aba640576228db6bed674f15847b154bbf83d7953e23334"
     }
   ]
 }