Skip to content

ci: fix 3 security HIGHs (govern audit row 3) #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
m9751 merged 2 commits into from
Jun 18, 2026
Merged

ci: fix 3 security HIGHs (govern audit row 3) #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7096838
ci: SHA-pin lychee-action (govern row 3, github HR#2)
m9751 Jun 18, 2026
465f25f
ci: extract github.event SHA to env (govern row 3, github HR#4)
m9751 Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/doc-link-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
restore-keys: cache-lychee-

- name: Run lychee
uses: lycheeverse/lychee-action@v2
uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
with:
args: >-
--no-progress
Expand Down
8 changes: 6 additions & 2 deletions .github/workflows/rules-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,11 +57,13 @@ jobs:
echo "Validator self-test passed: good fixture accepted, bad fixture rejected."

- name: Done Criteria schema validation
env:
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
run: |
set -e
# Find any plan files added or modified in this PR.
# Plans live under plans/ at the repo root or examples/plans/.
changed=$(git diff --name-only --diff-filter=AM "${{ github.event.pull_request.base.sha || github.event.before }}" HEAD -- 'plans/**/*.md' 'examples/plans/**/*.md' 2>/dev/null || true)
changed=$(git diff --name-only --diff-filter=AM "$BASE_SHA" HEAD -- 'plans/**/*.md' 'examples/plans/**/*.md' 2>/dev/null || true)
if [ -z "$changed" ]; then
echo "No plan files added/modified in this PR — skipping Done Criteria validation."
exit 0
Expand All @@ -85,10 +87,12 @@ jobs:
echo "Empty-rule-body gate self-test passed: real rules accepted, stub rejected."

- name: Empty-rule-body gate on changed rule files
env:
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
run: |
set -e
# Find rule files added/modified in this PR.
changed=$(git diff --name-only --diff-filter=AM "${{ github.event.pull_request.base.sha || github.event.before }}" HEAD -- 'examples/claude-code-rules/**/*.md' 2>/dev/null || true)
changed=$(git diff --name-only --diff-filter=AM "$BASE_SHA" HEAD -- 'examples/claude-code-rules/**/*.md' 2>/dev/null || true)
if [ -z "$changed" ]; then
echo "No rule files added/modified in this PR — skipping per-file check."
exit 0
Expand Down
Loading