Adds a per-fork deterministic audit that catches regressions of the
cross-app SSO contract in Pressingly/plane BEFORE they reach
foss-server-bundle-devstack. The bundle's CI runs an audit that emits
`?` for fork-side rows because the forks aren't checked out there;
this PR closes that gap from Plane's side.

What it checks

  scripts/sso-audit.sh runs three deterministic checks against the
  files in this fork that satisfy fork-side rows of
  awais786/sso-rules-moneta:openspec/specs/proxy-auth-middleware/spec.md:

    Row 14 — logout shape: apps/web/core/store/user/index.ts MUST NOT
             call /oauth2/sign_out. Per logout-flow spec the per-app
             button is navigation-only; portal "Logout all" handles
             oauth2-proxy clearing.

    Row 20 — session-identity reconciliation (Rule 2 mismatch flush):
             apps/api/plane/authentication/middleware/proxy_auth.py
             MUST import django.contrib.auth.logout AND invoke
             logout(request). Without it, the stale-session-on-user-
             switch leak returns. SECURITY-CRITICAL — exit 1 on miss.

    Row 21 — polynomial-regex avoidance: proxy_auth.py +
             proxy_auth_utils.py MUST NOT introduce an unanchored
             [^\s@]+@[^\s@]+\.[^\s@]+ regex. Plane uses substring
             check today, so this is a regression guard.

  When upstream sso-rules-moneta adds new fork-side rows, vendor the
  updated check by editing this script.

How it's wired

  .github/workflows/sso-audit.yml runs the script on:
    - pull_request paths: apps/api/plane/authentication/**, apps/web's
      auth-related modules, the script itself, the workflow itself
    - push to foss-main
    - weekly schedule (Mon 09:00 UTC)
    - manual workflow_dispatch

  Output is published in three places:
    - GitHub job summary (always)
    - Sticky PR comment via marocchino/sticky-pull-request-comment@v2
      (PR runs only — one comment per PR, updated on each push)
    - Exit code 1 on security-critical violations → merge blocked

Local dry-run

  On foss-main (pre-PR-29 state): row 20 fires ❌ because
  proxy_auth.py lacks the django_auth.logout import. Exit 1.
  Confirms the gate works.

  On fix/proxy-auth-stale-session-on-user-switch: all three rows ✅.
  Confirms the gate releases when the fix lands.

Note: the audit script lives at scripts/sso-audit.sh which was
otherwise gitignored under `scripts/`. The .gitignore is updated to a
more specific `scripts/*` glob with a `!scripts/sso-audit.sh`
negation so this single file can be tracked while leaving the rest
of scripts/ ignored.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

All four comments from the PR #32 review are valid. Fixes:

#1 (sso-audit.sh:29) — Row 14 description claimed three checks
   (no /oauth2/sign_out, portal-host redirect, no POST /auth/sign-out/)
   but the function only verifies the first. Narrows the comment to
   match what's actually implemented. The other two properties from
   logout-flow spec need runtime context or AST analysis; not in scope
   for this deterministic gate.

#2 (sso-auth.sh:131) — Row 20 detection was brittle:
   - Single-line regex missed parenthesized multiline imports
     (`from django.contrib.auth import (\n  login,\n  logout,\n)`)
   - Call regex required exact `logout(request)` — missed whitespace
     (`logout( request )`), keyword form (`logout(request=request)`),
     and aliased call sites (`auth_logout(request)`)
   Could false-fail on legitimate fixes → block merges spuriously.

   New detection uses Python's `ast` module to parse the proxy_auth.py
   import block and extract the in-scope name for
   django.contrib.auth.logout (alias or plain). Then a whitespace-tolerant
   grep checks for a call to that name. Handles every variant in one
   pass without writing multi-line regex in bash. Verified against a
   synthetic fixture with aliased + parenthesized + whitespaced call.

#3 (sso-audit.sh:191) — Output referenced `skills/app-rules/SKILL.md`,
   which lives in awais786/sso-rules-moneta, not in Pressingly/plane.
   Confused readers of the sticky PR comment. Replaced both repo-
   relative references with full GitHub URLs so the links work from
   the PR view.

#4 (.github/workflows/sso-audit.yml:62) — `marocchino/sticky-pull-
   request-comment@v2` needs `pull-requests: write`. PRs from external
   forks get a read-only GITHUB_TOKEN regardless of declared
   permissions, and the action errors out, marking the whole workflow
   failed even when the audit passed.

   Two-layer fix:
     - Skip the comment step on fork PRs via
       `github.event.pull_request.head.repo.full_name == github.repository`
     - Add `continue-on-error: true` as a defensive belt so other
       comment-posting failures (rate limit, GitHub API blip) don't
       fail the audit gate either

   The audit gate itself (final exit-1 step) is unaffected — still
   blocks merge on security-critical violations regardless of comment
   posting.

Local dry-run on foss-main still produces the expected red ❌ on row
20 with the new alias-aware detection. Switching to the fix branch
detects the import (as `logout`) and the call site correctly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot review on PR #32 flagged that the `\b` word-boundary in the
row-20 grep is a GNU `grep -E` extension and undefined on BSD / POSIX-
strict implementations. macOS / Alpine / busybox grep may interpret it
as literal backspace or literal `b`, causing the audit to silently
miss real `logout(...)` calls and false-fail rows that should pass.

Replaced with POSIX character-class boundary:

  (^|[^[:alnum:]_])<alias>[[:space:]]*\(

`(^|[^[:alnum:]_])` matches start-of-line OR any non-word character
before the alias name — semantically identical to `\b` at the left
edge, but using only ERE constructs that work in every grep
implementation. The right edge doesn't need a boundary because
`[[:space:]]*\(` already requires the next non-space character to be
`(`, which disambiguates `logout(` from `logout_more(`.

Verified against six fixtures:
  - `logout(request)`                              → match ✅
  - `auth_logout( request )`                       → match ✅
  - `    logout(request=request)`                  → match ✅
  - `my_xauth_logout(request)` vs alias=auth_logout → skip ✅
  - leading start-of-line                          → match ✅
  - `something_logout(request)` vs alias=logout    → skip ✅

The fifth Copilot comment is the last open one; the previous four are
addressed by commit 4fb4805.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Agent-Logs-Url: https://github.com/Pressingly/plane/sessions/69fdbaa7-1abb-4dcd-9d1a-04cb7edd4fd8

Agent-Logs-Url: https://github.com/Pressingly/plane/sessions/57ae3534-e3c7-4983-a658-6757fe345476