feat(repo-standard): add opt-in spell-gate (cspell dictionary allowlist) - #54
Merged
Conversation
Every repo that opts in (spell: true + a cspell.json) gets a proactive dictionary gate: CI fails on any token not in the English/software dictionaries or the repo's words allowlist. Catches nonsense / promotional insertions on first sight (a smuggled product name is not a word) — adding a term to the allowlist is a reviewed diff. This is where it would have caught 'xquik' in verbspec at PR time. Shared base = start from bounded-systems/conformance's cspell.json (proven at conformance#11); per-repo cspell.json overrides. Opt-in (default false) like sbom, so repos adopt as they seed their allowlist. SHA-pinned setup-bun. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 8, 2026
bdelanghe
added a commit
that referenced
this pull request
Jul 8, 2026
… (#57) repo-standard.yml @ #54 raised its permission floor above `contents: read` (sbom needs `contents: write`, scorecard needs `actions: read`). GitHub validates a called reusable workflow's permission requests as the UNION of all its jobs, at load time, before any `if:` — so every caller, even a read-only spell/security PR run, had to grant the superset or hit a zero-jobs `startup_failure`. That is why #54 could not start and why conformance#19 is blocked. Restore one reusable workflow = one authority ceiling: - repo-standard.yml — stays `contents: read` (osv, dependency-review, spell, test, descriptor); drops the scorecard/sbom jobs + inputs - repo-scorecard.yml — `contents: read` + `actions: read` (scorecard) - repo-release.yml — `contents: write` (sbom); adds an `upload-release-assets` input so callers can take the SBOM artifact without a release upload Callers opt into the elevated ceilings with dedicated, event-gated jobs, so a PR run never instantiates write authority. Add repo-standard-selftest.yml: calls each reusable workflow at its intended ceiling. GitHub validates the permission union at load time, so a future revision that raises a floor fails here, pre-merge, instead of in every downstream repo — the self-test guard #55/#56 identified as missing. It also doubles as the reference caller template. Fixes #55. Closes #56. Unblocks conformance#19. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes the spell-gate org-wide. Adds a
spelljob torepo-standard.yml(opt-in, default false — likesbom): every repo that setsspell: trueand has acspell.jsongets a proactive dictionary gate — CI fails on any token not in the dictionaries or the repo'swordsallowlist.This is the model from conformance#11, now inheritable by all 72 repos — and it's exactly where it would've caught
xquikinverbspecat PR time.conformance'scspell.json; per-repocspell.jsonoverrides.SHA-pinned
setup-bun; YAML validated. Signed → plain-mergeable.Follow-up: a truly shared imported dictionary (published cspell config package) so a base-word update reaches every repo; for now it's copy-to-start.
🤖 Generated with Claude Code