Chore/cicd optimizations

.github/workflows/boj-build.yml

@@ -1,19 +1,19 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: BoJ Server Build Trigger
-
 on:
   push:
-    branches: [ main, master ]
+    branches: [main, master]
   workflow_dispatch:
-
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
+permissions:
+  contents: read

.github/workflows/ci.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: CI
 
@@ -87,14 +88,14 @@ jobs:
 
       - name: Setup Python
         if: needs.detect.outputs.has_python == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
           cache: 'pip'
 
       - name: Setup Go
         if: needs.detect.outputs.has_go == 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: '1.22'
           cache: true
@@ -141,14 +142,14 @@ jobs:
 
       - name: Setup Python
         if: needs.detect.outputs.has_python == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
 
       - name: Setup Go
         if: needs.detect.outputs.has_go == 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
@@ -181,7 +182,7 @@ jobs:
 
       - name: Upload coverage
         if: success() && github.event_name == 'push'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
@@ -205,13 +206,13 @@ jobs:
 
       - name: Setup Python
         if: needs.detect.outputs.has_python == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
 
       - name: Setup Go
         if: needs.detect.outputs.has_go == 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: '1.22'
 
@@ -277,19 +278,19 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to GitHub Container Registry
         if: github.event_name == 'push'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -300,7 +301,7 @@ jobs:
             type=sha
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           push: ${{ github.event_name == 'push' }}
@@ -328,7 +329,7 @@ jobs:
           path: dist/
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           generate_release_notes: true
           files: dist/*

.github/workflows/codeql.yml

@@ -3,7 +3,8 @@
 # Scans for security vulnerabilities and coding errors
 # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning
 
-permissions: read-all
+permissions:
+  contents: read
 
 name: "CodeQL Security Analysis"
 
@@ -119,26 +120,26 @@ jobs:
 
       - name: Setup Python
         if: matrix.language == 'python'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
 
       - name: Setup Go
         if: matrix.language == 'go'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: '1.22'
 
       - name: Setup Java
         if: matrix.language == 'java-kotlin'
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           distribution: 'temurin'
           java-version: '21'
 
       - name: Setup .NET
         if: matrix.language == 'csharp'
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: '8.0.x'
 

.github/workflows/guix-nix-policy.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Guix/Nix Package Policy
 on: [push, pull_request]

.github/workflows/hypatia-scan.yml

@@ -11,7 +11,8 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan:

.github/workflows/mirror.yml

@@ -7,7 +7,8 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   mirror-gitlab:

.github/workflows/npm-bun-blocker.yml

@@ -2,7 +2,8 @@
 name: NPM/Bun Blocker
 on: [push, pull_request]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check:

.github/workflows/quality.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Code Quality
 on: [push, pull_request]

.github/workflows/rsr-antipattern.yml

@@ -5,7 +5,8 @@
 # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
 # Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
 
-permissions: read-all
+permissions:
+  contents: read
 
 name: RSR Anti-Pattern Check
 

.github/workflows/scorecard-enforcer.yml

@@ -9,7 +9,8 @@ on:
     - cron: '0 6 * * 1'  # Weekly on Monday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scorecard:

.github/workflows/scorecard.yml

@@ -6,7 +6,8 @@ on:
   schedule:
     - cron: '0 4 * * 0'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:

.github/workflows/secret-scanner.yml

@@ -7,7 +7,8 @@ on:
   push:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   trufflehog:

.github/workflows/security-policy.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Security Policy
 on: [push, pull_request]

.github/workflows/ts-blocker.yml

@@ -2,7 +2,8 @@
 name: TypeScript/JavaScript Blocker
 on: [push, pull_request]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check:

.github/workflows/wellknown-enforcement.yml

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-permissions: read-all
+permissions:
+  contents: read
 
 name: Well-Known Standards (RFC 9116 + RSR)
 on:

.github/workflows/workflow-linter.yml

@@ -10,7 +10,8 @@ on:
     paths:
       - '.github/workflows/**'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   lint-workflows:

.machine_readable/contractiles/dust/Dustfile.a2ml

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Dustfile — Cleanup and Hygiene Contract
+
+[dustfile]
+version = "1.0.0"
+format = "a2ml"
+
+[cleanup]
+stale-branch-policy = "delete-after-merge"
+artifact-retention = "90-days"
+cache-policy = "clear-on-release"
+
+[hygiene]
+linting = "required"
+formatting = "required"
+dead-code-removal = "encouraged"
+todo-tracking = "tracked-in-issues"
+
+[reversibility]
+backup-before-destructive = true
+rollback-mechanism = "git-revert"
+data-retention-policy = "preserve-30-days"

.machine_readable/integrations/feedback-o-tron.a2ml

@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Feedback-o-Tron Integration — Autonomous Bug Reporting
+
+[integration]
+name = "feedback-o-tron"
+type = "bug-reporter"
+repository = "https://github.com/hyperpolymath/feedback-o-tron"
+
+[reporting-config]
+platforms = ["github", "gitlab", "bugzilla"]
+deduplication = true
+audit-logging = true
+auto-file-upstream = "on-external-dependency-failure"

.machine_readable/integrations/proven.a2ml

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Proven Integration — Formally Verified Safety Library
+
+[integration]
+name = "proven"
+type = "safety-library"
+repository = "https://github.com/hyperpolymath/proven"
+version = "1.2.0"
+
+[binding-policy]
+approach = "thin-ffi-wrapper"
+unsafe-patterns = "replace-with-proven-equivalent"
+modules-available = ["SafeMath", "SafeString", "SafeJSON", "SafeURL", "SafeRegex", "SafeSQL", "SafeFile", "SafeTemplate", "SafeCrypto"]
+
+[adoption-guidance]
+priority = "high"
+scope = "all-string-json-url-crypto-operations"
+migration = "incremental — replace unsafe patterns as encountered"

.machine_readable/integrations/verisimdb.a2ml

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# VeriSimDB Feed — Cross-Repo Analytics Data Store
+
+[integration]
+name = "verisimdb"
+type = "data-feed"
+repository = "https://github.com/hyperpolymath/nextgen-databases"
+data-store = "verisimdb-data"
+
+[feed-config]
+emit-scan-results = true
+emit-build-metrics = true
+emit-dependency-graph = true
+format = "hexad"
+destination = "verisimdb-data/feeds/"

.machine_readable/integrations/vexometer.a2ml

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Vexometer Integration — Irritation Surface Analysis
+
+[integration]
+name = "vexometer"
+type = "friction-measurement"
+repository = "https://github.com/hyperpolymath/vexometer"
+
+[measurement-config]
+dimensions = 10
+emit-isa-reports = true
+lazy-eliminator = true
+satellite-interventions = true
+
+[hooks]
+cli-tools = "measure-on-error"
+ui-panels = "measure-on-interaction"
+build-failures = "measure-on-failure"