|
| 1 | +{ |
| 2 | + "schema_version": "proof-pr.v1", |
| 3 | + "receipt_id": "saagpatel-github-repo-auditor-proof-pr-dogfood", |
| 4 | + "generated_at": "2026-06-20T09:00:00Z", |
| 5 | + "subject": { |
| 6 | + "repo": "saagpatel/GithubRepoAuditor", |
| 7 | + "pr_number": null, |
| 8 | + "pr_url": null, |
| 9 | + "base_ref": "main", |
| 10 | + "base_sha": "b69bd828a240572594ed4a8afec159e546fccefa", |
| 11 | + "head_ref": "chore/proof-pr-dogfood", |
| 12 | + "head_sha": "pending-pr-head" |
| 13 | + }, |
| 14 | + "producer": { |
| 15 | + "tool": "proof-pr", |
| 16 | + "version": "0.1.3", |
| 17 | + "agent": "codex", |
| 18 | + "mode": "local" |
| 19 | + }, |
| 20 | + "risk": { |
| 21 | + "tier": "T3", |
| 22 | + "reasons": [ |
| 23 | + "adds a GitHub Actions workflow", |
| 24 | + "introduces proof-pr as a reusable CI evidence consumer", |
| 25 | + "commits a machine-readable proof receipt" |
| 26 | + ], |
| 27 | + "changed_surfaces": [ |
| 28 | + "github-actions", |
| 29 | + "proof-receipt", |
| 30 | + "public-repo-evidence" |
| 31 | + ] |
| 32 | + }, |
| 33 | + "change": { |
| 34 | + "summary": "Adds an advisory proof-pr dogfood workflow and committed receipt for GitHub Repo Auditor.", |
| 35 | + "files_touched": [ |
| 36 | + ".github/workflows/proof-pr.yml", |
| 37 | + "proof-pr.json" |
| 38 | + ], |
| 39 | + "diff_stats": { |
| 40 | + "files": 2, |
| 41 | + "additions": 175, |
| 42 | + "deletions": 0 |
| 43 | + }, |
| 44 | + "scope_notes": "No application code, package metadata, generated portfolio truth, or release workflow behavior changes." |
| 45 | + }, |
| 46 | + "evidence": [ |
| 47 | + { |
| 48 | + "id": "proof-pr-validate", |
| 49 | + "kind": "repo-native", |
| 50 | + "command": [ |
| 51 | + "proof-pr validate proof-pr.json" |
| 52 | + ], |
| 53 | + "status": "passed", |
| 54 | + "required": true, |
| 55 | + "summary": "Committed receipt validates against proof-pr.v1 schema." |
| 56 | + }, |
| 57 | + { |
| 58 | + "id": "proof-pr-render", |
| 59 | + "kind": "repo-native", |
| 60 | + "command": [ |
| 61 | + "proof-pr render proof-pr.json" |
| 62 | + ], |
| 63 | + "status": "passed", |
| 64 | + "required": true, |
| 65 | + "summary": "Receipt renders into the standard Markdown PR block." |
| 66 | + }, |
| 67 | + { |
| 68 | + "id": "workflow-yaml", |
| 69 | + "kind": "repo-native", |
| 70 | + "command": [ |
| 71 | + "ruby -e \"require 'yaml'; YAML.load_file('.github/workflows/proof-pr.yml')\"" |
| 72 | + ], |
| 73 | + "status": "passed", |
| 74 | + "required": true, |
| 75 | + "summary": "New workflow YAML parses." |
| 76 | + }, |
| 77 | + { |
| 78 | + "id": "public-fixture-proof-package", |
| 79 | + "kind": "repo-native", |
| 80 | + "command": [ |
| 81 | + "PYTHONDONTWRITEBYTECODE=1 python3 scripts/validate_proof_package.py docs/demo-proof/public-fixture/proof-package.json" |
| 82 | + ], |
| 83 | + "status": "passed", |
| 84 | + "required": true, |
| 85 | + "summary": "Existing public fixture proof package remains valid." |
| 86 | + }, |
| 87 | + { |
| 88 | + "id": "secrets-scan", |
| 89 | + "kind": "security", |
| 90 | + "command": [ |
| 91 | + "gitleaks detect --source . --no-banner --redact --verbose" |
| 92 | + ], |
| 93 | + "status": "passed", |
| 94 | + "required": true, |
| 95 | + "summary": "No leaks found in the dogfood worktree." |
| 96 | + }, |
| 97 | + { |
| 98 | + "id": "public-boundary-scan", |
| 99 | + "kind": "security", |
| 100 | + "status": "passed", |
| 101 | + "required": true, |
| 102 | + "summary": "No private repo names, local paths, personal email, or token prefixes found in the new public dogfood files." |
| 103 | + }, |
| 104 | + { |
| 105 | + "id": "full-test-suite", |
| 106 | + "kind": "test", |
| 107 | + "status": "skipped", |
| 108 | + "required": false, |
| 109 | + "summary": "No Python source, package metadata, or generated truth surface changed.", |
| 110 | + "reason": "The PR adds only an advisory workflow caller and proof receipt; normal CI still runs on pull_request." |
| 111 | + }, |
| 112 | + { |
| 113 | + "id": "screenshots", |
| 114 | + "kind": "screenshot", |
| 115 | + "status": "not_applicable", |
| 116 | + "required": false, |
| 117 | + "summary": "No UI, workbook, dashboard, or visual artifact changed." |
| 118 | + } |
| 119 | + ], |
| 120 | + "security": { |
| 121 | + "secrets_scan": { |
| 122 | + "status": "passed", |
| 123 | + "summary": "Gitleaks scan found no leaks." |
| 124 | + }, |
| 125 | + "permission_diff": { |
| 126 | + "status": "passed", |
| 127 | + "summary": "New workflow grants explicit read-only permissions: contents: read and actions: read." |
| 128 | + }, |
| 129 | + "redaction": { |
| 130 | + "status": "not_applicable", |
| 131 | + "summary": "No screenshots or generated portfolio artifacts are included in this PR." |
| 132 | + } |
| 133 | + }, |
| 134 | + "rollback": { |
| 135 | + "status": "documented", |
| 136 | + "path": "Revert this PR or remove .github/workflows/proof-pr.yml and proof-pr.json.", |
| 137 | + "notes": "The workflow is manual-only and advisory, so rollback does not require data migration or external cleanup." |
| 138 | + }, |
| 139 | + "artifacts": [ |
| 140 | + { |
| 141 | + "id": "proof-pr-json", |
| 142 | + "kind": "json", |
| 143 | + "path_or_url": "proof-pr.json", |
| 144 | + "description": "Committed proof-pr dogfood receipt.", |
| 145 | + "required": true, |
| 146 | + "external": false |
| 147 | + } |
| 148 | + ], |
| 149 | + "limitations": [ |
| 150 | + "The committed receipt uses pending-pr-head because a receipt committed in the same change cannot know its final commit SHA before the commit exists.", |
| 151 | + "PR number and PR URL should be reflected in the pull request proof block after PR creation.", |
| 152 | + "The workflow is manual-only for dogfood; pull_request enforcement is intentionally deferred." |
| 153 | + ], |
| 154 | + "overall": { |
| 155 | + "status": "passed_with_warnings", |
| 156 | + "review_decision": "ready_with_operator_awareness" |
| 157 | + } |
| 158 | +} |
0 commit comments