Skip to content

Commit 92c1f2f

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
ci: deploy missing standard workflows (5 added)
Added from rsr-template-repo: standardizing CI/CD across all repos. Part of global TODO cleanup (2026-03-16). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent bade0ee commit 92c1f2f

5 files changed

Lines changed: 217 additions & 0 deletions

File tree

‎.github/workflows/instant-sync.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Instant Forge Sync - Triggers propagation to all forges on push/release
3+
name: Instant Sync
4+
5+
on:
6+
push:
7+
branches: [main, master]
8+
release:
9+
types: [published]
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
dispatch:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Trigger Propagation
19+
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
20+
with:
21+
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
22+
repository: hyperpolymath/.git-private-farm
23+
event-type: propagate
24+
client-payload: |-
25+
{
26+
"repo": "${{ github.event.repository.name }}",
27+
"ref": "${{ github.ref }}",
28+
"sha": "${{ github.sha }}",
29+
"forges": ""
30+
}
31+
32+
- name: Confirm
33+
run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

‎.github/workflows/npm-bun-blocker.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: NPM/Bun Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Block npm/bun
15+
run: |
16+
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
17+
echo "❌ npm/bun artifacts detected. Use Deno instead."
18+
exit 1
19+
fi
20+
echo "✅ No npm/bun violations"

‎.github/workflows/scorecard-enforcer.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
3+
name: OpenSSF Scorecard Enforcer
4+
5+
on:
6+
push:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 6 * * 1' # Weekly on Monday
10+
workflow_dispatch:
11+
12+
permissions: read-all
13+
14+
jobs:
15+
scorecard:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
id-token: write # For OIDC
20+
steps:
21+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run Scorecard
26+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: Upload SARIF
33+
uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v3
34+
with:
35+
sarif_file: results.sarif
36+
37+
- name: Check minimum score
38+
run: |
39+
# Parse score from results
40+
SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
41+
42+
echo "OpenSSF Scorecard Score: $SCORE"
43+
44+
# Minimum acceptable score (0-10 scale)
45+
MIN_SCORE=5
46+
47+
if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
48+
echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
49+
exit 1
50+
fi
51+
52+
# Check specific high-priority items
53+
check-critical:
54+
runs-on: ubuntu-latest
55+
steps:
56+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
57+
58+
- name: Check SECURITY.md exists
59+
run: |
60+
if [ ! -f "SECURITY.md" ]; then
61+
echo "::error::SECURITY.md is required"
62+
exit 1
63+
fi
64+
65+
- name: Check for pinned dependencies
66+
run: |
67+
# Check workflows for unpinned actions
68+
unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
69+
if [ -n "$unpinned" ]; then
70+
echo "::warning::Found unpinned actions:"
71+
echo "$unpinned"
72+
fi

‎.github/workflows/secret-scanner.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Prevention workflow - scans for hardcoded secrets before they reach main
3+
name: Secret Scanner
4+
5+
on:
6+
pull_request:
7+
push:
8+
branches: [main]
9+
10+
permissions: read-all
11+
12+
jobs:
13+
trufflehog:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
with:
18+
fetch-depth: 0 # Full history for scanning
19+
20+
- name: TruffleHog Secret Scan
21+
uses: trufflesecurity/trufflehog@6961f2bace57ab32b23b3ba40f8f420f6bc7e004 # v3
22+
with:
23+
extra_args: --only-verified --fail
24+
25+
gitleaks:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
fetch-depth: 0
31+
32+
- name: Gitleaks Secret Scan
33+
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
34+
env:
35+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36+
37+
# Rust-specific: Check for hardcoded crypto values
38+
rust-secrets:
39+
runs-on: ubuntu-latest
40+
if: hashFiles('**/Cargo.toml') != ''
41+
steps:
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
43+
44+
- name: Check for hardcoded secrets in Rust
45+
run: |
46+
# Patterns that suggest hardcoded secrets
47+
PATTERNS=(
48+
'const.*SECRET.*=.*"'
49+
'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
50+
'const.*TOKEN.*=.*"'
51+
'let.*api_key.*=.*"'
52+
'HMAC.*"[a-fA-F0-9]{32,}"'
53+
'password.*=.*"[^"]+"'
54+
)
55+
56+
found=0
57+
for pattern in "${PATTERNS[@]}"; do
58+
if grep -rn --include="*.rs" -E "$pattern" src/; then
59+
echo "WARNING: Potential hardcoded secret found matching: $pattern"
60+
found=1
61+
fi
62+
done
63+
64+
if [ $found -eq 1 ]; then
65+
echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
66+
exit 1
67+
fi

‎.github/workflows/ts-blocker.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: TypeScript/JavaScript Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Block new TypeScript/JavaScript
15+
run: |
16+
NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true)
17+
NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
18+
19+
if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
20+
echo "❌ New TS/JS files detected. Use ReScript instead."
21+
[ -n "$NEW_TS" ] && echo "$NEW_TS"
22+
[ -n "$NEW_JS" ] && echo "$NEW_JS"
23+
exit 1
24+
fi
25+
echo "✅ ReScript policy enforced"

0 commit comments

Comments
 (0)