feat(audit): report-only org-wide actions-conformance audit (#19, #7) - #27
Merged
Conversation
scripts/audit/actions.ts scans every repo's workflows against: R1a floating-branch ref to an org reusable workflow (hard tamper risk) R1b tag ref to an org reusable workflow (mutable; prefer SHA) R3 external action not SHA-pinned (org sha_pinning) R2 third-party actions outside the canonical reusable-workflow set (sprawl) The canonical set is derived from .github's repo-*.yml, so it self-updates as the reusable workflows grow. Report-only (exit 0), wired as actions-audit.yml on a daily schedule + dispatch; promote to blocking via `audit:actions:strict` (fails on R1a+R3) once the floating-branch refs are cleaned up. Baseline today: R1a=16 (all gh-project-room trigger-sync@main), R1b=72 (mostly mint release/version @vx — a semver-tracking policy call), R3=5, R2=15. Enforcement layer for the outer-set normalization (#57/#58): keeps the canonical set small by flagging any repo that introduces an unpinned or off-catalog action. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A report-only, org-wide actions-conformance audit —
scripts/audit/actions.ts(Deno) +actions-audit.yml. It's the enforcement layer for the outer-set normalization (.github#57/#58): the whole point of routing repos through pinned reusable workflows is undone if nothing catches drift.The rules
@main)@vX)sha_pinning_requiredThe canonical set is derived live from
.github'srepo-*.yml, so it self-updates as the reusable workflows grow — no hand-maintained list.Baseline today (report-only, exit 0)
gh-project-room/…/trigger-sync.yml@main(the front-desk notify pattern). The one genuinely worth fixing.mint/{release-provenance,version}.yml@v0.3.1. This is the intentional semver-tracking pattern — a policy call, not a bug.prx/pages.yml configure-pages@v6).Phased promotion
Report-only now (baseline the current state, like
scripts/audit.mjs). Flipdeno task audit:actions→audit:actions:strictto make it fail on R1a + R3 (the hard, objective rules) once the 16 floating-branch refs are pinned. R1b/R2 stay informational.Dogfooding
actions-audit.ymlis bespoke (runs a Deno audit, likeconformance-gate.yml) but SHA-pins its own actions — it passes its own R3.PR checklist
.github, not re-listedAdvances #19 and the enforcement epic #7.
🤖 Generated with Claude Code