Skip to content

Commit 7d0260c

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
ci: deploy missing standard workflows (6 added)
Added from rsr-template-repo: standardizing CI/CD across all repos. Part of global TODO cleanup (2026-03-16). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 46347e7 commit 7d0260c

6 files changed

Lines changed: 252 additions & 0 deletions

File tree

‎.github/workflows/guix-nix-policy.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Guix/Nix Package Policy
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Enforce Guix primary / Nix fallback
15+
run: |
16+
# Check for package manager files
17+
HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
18+
HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1)
19+
20+
# Block new package-lock.json, yarn.lock, Gemfile.lock, etc.
21+
NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
22+
if [ -n "$NEW_LOCKS" ]; then
23+
echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility."
24+
fi
25+
26+
# Prefer Guix, fallback to Nix
27+
if [ -n "$HAS_GUIX" ]; then
28+
echo "✅ Guix package management detected (primary)"
29+
elif [ -n "$HAS_NIX" ]; then
30+
echo "✅ Nix package management detected (fallback)"
31+
else
32+
echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds"
33+
fi
34+
35+
echo "✅ Package policy check passed"

‎.github/workflows/instant-sync.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Instant Forge Sync - Triggers propagation to all forges on push/release
3+
name: Instant Sync
4+
5+
on:
6+
push:
7+
branches: [main, master]
8+
release:
9+
types: [published]
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
dispatch:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Trigger Propagation
19+
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
20+
with:
21+
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
22+
repository: hyperpolymath/.git-private-farm
23+
event-type: propagate
24+
client-payload: |-
25+
{
26+
"repo": "${{ github.event.repository.name }}",
27+
"ref": "${{ github.ref }}",
28+
"sha": "${{ github.sha }}",
29+
"forges": ""
30+
}
31+
32+
- name: Confirm
33+
run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"

‎.github/workflows/npm-bun-blocker.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: NPM/Bun Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Block npm/bun
15+
run: |
16+
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
17+
echo "❌ npm/bun artifacts detected. Use Deno instead."
18+
exit 1
19+
fi
20+
echo "✅ No npm/bun violations"

‎.github/workflows/security-policy.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Security Policy
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Security checks
15+
run: |
16+
FAILED=false
17+
18+
# Block MD5/SHA1 for security (allow for checksums/caching)
19+
WEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)
20+
if [ -n "$WEAK_CRYPTO" ]; then
21+
echo "⚠️ Weak crypto (MD5/SHA1) detected. Use SHA256+ for security:"
22+
echo "$WEAK_CRYPTO"
23+
fi
24+
25+
# Block HTTP URLs (except localhost)
26+
HTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)
27+
if [ -n "$HTTP_URLS" ]; then
28+
echo "⚠️ HTTP URLs found. Use HTTPS:"
29+
echo "$HTTP_URLS"
30+
fi
31+
32+
# Block hardcoded secrets patterns
33+
SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
34+
if [ -n "$SECRETS" ]; then
35+
echo "❌ Potential hardcoded secrets detected!"
36+
FAILED=true
37+
fi
38+
39+
if [ "$FAILED" = true ]; then
40+
exit 1
41+
fi
42+
43+
echo "✅ Security policy check passed"

‎.github/workflows/ts-blocker.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: TypeScript/JavaScript Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Block new TypeScript/JavaScript
15+
run: |
16+
NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true)
17+
NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
18+
19+
if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
20+
echo "❌ New TS/JS files detected. Use ReScript instead."
21+
[ -n "$NEW_TS" ] && echo "$NEW_TS"
22+
[ -n "$NEW_JS" ] && echo "$NEW_JS"
23+
exit 1
24+
fi
25+
echo "✅ ReScript policy enforced"

‎.github/workflows/wellknown-enforcement.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
name: Well-Known Standards (RFC 9116 + RSR)
3+
on:
4+
push:
5+
branches: [main, master]
6+
paths:
7+
- '.well-known/**'
8+
- 'security.txt'
9+
pull_request:
10+
paths:
11+
- '.well-known/**'
12+
schedule:
13+
# Weekly expiry check
14+
- cron: '0 9 * * *'
15+
workflow_dispatch:
16+
17+
18+
permissions: read-all
19+
20+
jobs:
21+
validate:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
steps:
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
28+
- name: RFC 9116 security.txt validation
29+
run: |
30+
SECTXT=""
31+
[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"
32+
[ -f "security.txt" ] && SECTXT="security.txt"
33+
34+
if [ -z "$SECTXT" ]; then
35+
echo "::warning::No security.txt found. See https://github.com/{{OWNER}}/well-known-ecosystem"
36+
exit 0
37+
fi
38+
39+
# Required: Contact
40+
grep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }
41+
42+
# Required: Expires
43+
if ! grep -q "^Expires:" "$SECTXT"; then
44+
echo "::error::Missing Expires field"
45+
exit 1
46+
fi
47+
48+
# Check expiry
49+
EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1)
50+
if date -d "$EXPIRES" > /dev/null 2>&1; then
51+
DAYS=$(( ($(date -d "$EXPIRES" +%s) - $(date +%s)) / 86400 ))
52+
if [ $DAYS -lt 0 ]; then
53+
echo "::error::security.txt EXPIRED"
54+
exit 1
55+
elif [ $DAYS -lt 30 ]; then
56+
echo "::warning::security.txt expires in $DAYS days"
57+
else
58+
echo "✅ security.txt valid ($DAYS days)"
59+
fi
60+
fi
61+
62+
- name: RSR well-known compliance
63+
run: |
64+
MISSING=""
65+
[ ! -f ".well-known/security.txt" ] && [ ! -f "security.txt" ] && MISSING="$MISSING security.txt"
66+
[ ! -f ".well-known/ai.txt" ] && MISSING="$MISSING ai.txt"
67+
[ ! -f ".well-known/humans.txt" ] && MISSING="$MISSING humans.txt"
68+
69+
if [ -n "$MISSING" ]; then
70+
echo "::warning::Missing RSR recommended files:$MISSING"
71+
echo "Reference: https://github.com/{{OWNER}}/well-known-ecosystem/.well-known/"
72+
else
73+
echo "✅ RSR well-known compliant"
74+
fi
75+
76+
- name: Mixed content check
77+
run: |
78+
MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com' | head -5 || true)
79+
if [ -n "$MIXED" ]; then
80+
echo "::error::Mixed content (HTTP in HTML)"
81+
echo "$MIXED"
82+
exit 1
83+
fi
84+
echo "✅ No mixed content"
85+
86+
- name: DNS security records check
87+
if: hashFiles('CNAME') != ''
88+
run: |
89+
DOMAIN=$(cat CNAME 2>/dev/null | tr -d '\n')
90+
if [ -n "$DOMAIN" ]; then
91+
echo "Checking DNS for $DOMAIN..."
92+
# CAA record
93+
dig +short CAA "$DOMAIN" | grep -q "issue" && echo "✅ CAA record" || echo "::warning::No CAA record"
94+
# DNSSEC
95+
dig +dnssec +short "$DOMAIN" | grep -q "RRSIG" && echo "✅ DNSSEC" || echo "::warning::No DNSSEC"
96+
fi

0 commit comments

Comments
 (0)