Skip to content

Commit 405ac30

Browse files
hyperpolymathhyperpolymath
authored
Merge branch 'main' into dependabot/github_actions/webfactory/ssh-agent-0.9.1
2 parents cf636de + f1919a0 commit 405ac30

29 files changed

Lines changed: 1400 additions & 53 deletions

‎.claude/CLAUDE.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
## Machine-Readable Artefacts
2+
3+
The following files in `.machine_readable/` contain structured project metadata:
4+
5+
- `STATE.scm` - Current project state and progress
6+
- `META.scm` - Architecture decisions and development practices
7+
- `ECOSYSTEM.scm` - Position in the ecosystem and related projects
8+
- `AGENTIC.scm` - AI agent interaction patterns
9+
- `NEUROSYM.scm` - Neurosymbolic integration config
10+
- `PLAYBOOK.scm` - Operational runbook
11+
12+
---
13+
114
# CLAUDE.md - AI Assistant Instructions
215

316
## Language Policy (Hyperpolymath Standard)
@@ -68,3 +81,4 @@ Both are FOSS with independent governance (no Big Tech).
6881
- No hardcoded secrets
6982
- SHA-pinned dependencies
7083
- SPDX license headers on all files
84+

‎.github/workflows/codeql.yml‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,40 @@
11
# SPDX-License-Identifier: AGPL-3.0-or-later
2-
name: CodeQL
2+
name: CodeQL Security Analysis
3+
34
on:
45
push:
5-
branches: [main]
6+
branches: [main, master]
67
pull_request:
7-
branches: [main]
8+
branches: [main, master]
89
schedule:
9-
- cron: "0 6 * * 1"
10+
- cron: '0 6 * * 1'
11+
1012
permissions: read-all
13+
1114
jobs:
1215
analyze:
13-
name: Analyze
1416
runs-on: ubuntu-latest
1517
permissions:
16-
actions: read
1718
contents: read
1819
security-events: write
1920
strategy:
2021
fail-fast: false
2122
matrix:
22-
language: [actions]
23+
include:
24+
- language: actions
25+
build-mode: none
26+
2327
steps:
2428
- name: Checkout
25-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
29+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
30+
2631
- name: Initialize CodeQL
27-
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3
32+
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
2833
with:
2934
languages: ${{ matrix.language }}
30-
- name: Autobuild
31-
uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3
35+
build-mode: ${{ matrix.build-mode }}
36+
3237
- name: Perform CodeQL Analysis
33-
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3
38+
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
3439
with:
3540
category: "/language:${{ matrix.language }}"
36-

‎.github/workflows/guix-nix-policy.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: Guix/Nix Package Policy
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
14+
- name: Enforce Guix primary / Nix fallback
15+
run: |
16+
# Check for package manager files
17+
HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
18+
HAS_NIX=$(find . -name "*.nix" 2>/dev/null | head -1)
19+
20+
# Block new package-lock.json, yarn.lock, Gemfile.lock, etc.
21+
NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E 'package-lock\.json|yarn\.lock|Gemfile\.lock|Pipfile\.lock|poetry\.lock|cargo\.lock' || true)
22+
if [ -n "$NEW_LOCKS" ]; then
23+
echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility."
24+
fi
25+
26+
# Prefer Guix, fallback to Nix
27+
if [ -n "$HAS_GUIX" ]; then
28+
echo "✅ Guix package management detected (primary)"
29+
elif [ -n "$HAS_NIX" ]; then
30+
echo "✅ Nix package management detected (fallback)"
31+
else
32+
echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds"
33+
fi
34+
35+
echo "✅ Package policy check passed"

‎.github/workflows/instant-sync.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: AGPL-3.0-or-later
1+
# SPDX-License-Identifier: MPL-2.0
22
# Instant Forge Sync - Triggers propagation to all forges on push/release
33
name: Instant Sync
44

‎.github/workflows/mirror.yml‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
runs-on: ubuntu-latest
1515
if: vars.GITLAB_MIRROR_ENABLED == 'true'
1616
steps:
17-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
17+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
1818
with:
1919
fetch-depth: 0
2020

@@ -32,7 +32,7 @@ jobs:
3232
runs-on: ubuntu-latest
3333
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
3434
steps:
35-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
35+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
3636
with:
3737
fetch-depth: 0
3838

@@ -50,7 +50,7 @@ jobs:
5050
runs-on: ubuntu-latest
5151
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
5252
steps:
53-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
53+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
5454
with:
5555
fetch-depth: 0
5656

@@ -68,7 +68,7 @@ jobs:
6868
runs-on: ubuntu-latest
6969
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
7070
steps:
71-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
71+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
7272
with:
7373
fetch-depth: 0
7474

@@ -86,7 +86,7 @@ jobs:
8686
runs-on: ubuntu-latest
8787
if: vars.DISROOT_MIRROR_ENABLED == 'true'
8888
steps:
89-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
89+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
9090
with:
9191
fetch-depth: 0
9292

@@ -104,7 +104,7 @@ jobs:
104104
runs-on: ubuntu-latest
105105
if: vars.GITEA_MIRROR_ENABLED == 'true'
106106
steps:
107-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
107+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
108108
with:
109109
fetch-depth: 0
110110

@@ -122,14 +122,20 @@ jobs:
122122
runs-on: ubuntu-latest
123123
if: vars.RADICLE_MIRROR_ENABLED == 'true'
124124
steps:
125-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
125+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
126126
with:
127127
fetch-depth: 0
128128

129+
- name: Setup Rust
130+
uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable
131+
with:
132+
toolchain: stable
133+
129134
- name: Install Radicle
130135
run: |
131-
curl -sSf https://radicle.xyz/install | sh
132-
echo "$HOME/.radicle/bin" >> $GITHUB_PATH
136+
# Install via cargo (safer than curl|sh)
137+
cargo install radicle-cli --locked
138+
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
133139
134140
- name: Mirror to Radicle
135141
run: |

‎.github/workflows/npm-bun-blocker.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: NPM/Bun Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
14+
- name: Block npm/bun
15+
run: |
16+
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
17+
echo "❌ npm/bun artifacts detected. Use Deno instead."
18+
exit 1
19+
fi
20+
echo "✅ No npm/bun violations"

‎.github/workflows/quality.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: Code Quality
3+
on: [push, pull_request]
4+
5+
6+
permissions: read-all
7+
8+
jobs:
9+
lint:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
steps:
14+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
15+
16+
- name: Check file permissions
17+
run: |
18+
find . -type f -perm /111 -name "*.sh" | head -10 || true
19+
20+
- name: Check for secrets
21+
uses: trufflesecurity/trufflehog@05cccb53bc9e13bc6d17997db5a6bcc3df44bf2f # v3.92.3
22+
with:
23+
path: ./
24+
base: ${{ github.event.pull_request.base.sha || github.event.before }}
25+
head: ${{ github.sha }}
26+
continue-on-error: true
27+
28+
- name: Check TODO/FIXME
29+
run: |
30+
echo "=== TODOs ==="
31+
grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.res" --include="*.py" --include="*.ex" . | head -20 || echo "None found"
32+
33+
- name: Check for large files
34+
run: |
35+
find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
36+
37+
- name: EditorConfig check
38+
uses: editorconfig-checker/action-editorconfig-checker@8c9b118d446fce7e6410b6c0a3ce2f83bd04e97a # v2.1.0
39+
continue-on-error: true
40+
41+
docs:
42+
runs-on: ubuntu-latest
43+
permissions:
44+
contents: read
45+
steps:
46+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
47+
- name: Check documentation
48+
run: |
49+
MISSING=""
50+
[ ! -f "README.md" ] && [ ! -f "README.adoc" ] && MISSING="$MISSING README"
51+
[ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ] && MISSING="$MISSING LICENSE"
52+
[ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] && MISSING="$MISSING CONTRIBUTING"
53+
54+
if [ -n "$MISSING" ]; then
55+
echo "::warning::Missing docs:$MISSING"
56+
else
57+
echo "✅ Core documentation present"
58+
fi

‎.github/workflows/rsr-antipattern.yml‎

Lines changed: 63 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,92 @@
11
# SPDX-License-Identifier: AGPL-3.0-or-later
2-
name: RSR Language Policy
2+
# RSR Anti-Pattern CI Check
3+
# SPDX-License-Identifier: AGPL-3.0-or-later
4+
#
5+
# Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
6+
# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
7+
8+
name: RSR Anti-Pattern Check
39

410
on:
511
push:
6-
branches: [main]
12+
branches: [main, master, develop]
713
pull_request:
8-
branches: [main]
14+
branches: [main, master, develop]
15+
916

1017
permissions: read-all
1118

1219
jobs:
13-
check-banned-patterns:
14-
name: Check for banned languages/patterns
20+
antipattern-check:
1521
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
1624
steps:
17-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
18-
25+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
26+
1927
- name: Check for TypeScript
2028
run: |
21-
if find . -name "*.ts" -o -name "*.tsx" | grep -v node_modules | grep -q .; then
22-
echo "::error::TypeScript files found! Use ReScript instead (per RSR policy)"
29+
# Exclude bindings/deno/ - those are Deno FFI files using Deno.dlopen, not plain TypeScript
30+
# Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI
31+
TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true)
32+
if [ -n "$TS_FILES" ]; then
33+
echo "❌ TypeScript files detected - use ReScript instead"
34+
echo "$TS_FILES"
2335
exit 1
2436
fi
25-
echo "✓ No TypeScript files found"
26-
37+
echo "✅ No TypeScript files (Deno FFI bindings excluded)"
38+
2739
- name: Check for Go
2840
run: |
2941
if find . -name "*.go" | grep -q .; then
30-
echo "::error::Go files found! Use Rust instead (per RSR policy)"
42+
echo "❌ Go files detected - use Rust/WASM instead"
43+
find . -name "*.go"
3144
exit 1
3245
fi
33-
echo "✓ No Go files found"
34-
35-
- name: Check for npm/Node artifacts
46+
echo "✅ No Go files"
47+
48+
- name: Check for Python (non-SaltStack)
3649
run: |
37-
if [ -f "package-lock.json" ] || [ -d "node_modules" ]; then
38-
echo "::error::npm artifacts found! Use Deno instead (per RSR policy)"
50+
PY_FILES=$(find . -name "*.py" | grep -v salt | grep -v _states | grep -v _modules | grep -v pillar | grep -v venv | grep -v __pycache__ || true)
51+
if [ -n "$PY_FILES" ]; then
52+
echo "❌ Python files detected - only allowed for SaltStack"
53+
echo "$PY_FILES"
3954
exit 1
4055
fi
41-
echo "✓ No npm artifacts found"
42-
43-
- name: Check for Python (non-SaltStack)
56+
echo "✅ No non-SaltStack Python files"
57+
58+
- name: Check for npm lockfiles
4459
run: |
45-
banned_py=$(find . -name "*.py" | grep -v -E "(salt|pillar|states|_modules|_states)" | head -1)
46-
if [ -n "$banned_py" ]; then
47-
echo "::error::Python files found outside SaltStack! Use ReScript/Rust (per RSR policy)"
60+
if [ -f "package-lock.json" ] || [ -f "yarn.lock" ]; then
61+
echo "❌ npm/yarn lockfile detected - use Deno instead"
4862
exit 1
4963
fi
50-
echo "✓ No banned Python files found"
51-
52-
- name: Check for Makefiles
64+
echo "✅ No npm lockfiles"
65+
66+
- name: Check for tsconfig
5367
run: |
54-
if [ -f "Makefile" ] || [ -f "makefile" ] || find . -name "*.mk" | grep -q .; then
55-
echo "::error::Makefile found! Use Justfile or Mustfile instead (per RSR policy)"
68+
if [ -f "tsconfig.json" ]; then
69+
echo "❌ tsconfig.json detected - use ReScript instead"
5670
exit 1
5771
fi
58-
echo "✓ No Makefiles found"
72+
echo "✅ No tsconfig.json"
73+
74+
- name: Verify Deno presence (if package.json exists)
75+
run: |
76+
if [ -f "package.json" ]; then
77+
if [ ! -f "deno.json" ] && [ ! -f "deno.jsonc" ]; then
78+
echo "⚠️ Warning: package.json without deno.json - migration recommended"
79+
fi
80+
fi
81+
echo "✅ Deno configuration check complete"
82+
83+
- name: Summary
84+
run: |
85+
echo "╔════════════════════════════════════════════════════════════╗"
86+
echo "║ RSR Anti-Pattern Check Passed ✅ ║"
87+
echo "║ ║"
88+
echo "║ Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell, ║"
89+
echo "║ Guile/Scheme, SaltStack (Python) ║"
90+
echo "║ ║"
91+
echo "║ Blocked: TypeScript, Go, npm, Python (non-Salt) ║"
92+
echo "╚════════════════════════════════════════════════════════════╝"

0 commit comments

Comments
 (0)