Add Claude Code GitHub Workflow#2
Merged
Merged
Conversation
6 tasks
andybons
added a commit
that referenced
this pull request
Jan 13, 2026
- Add structured logging for collector errors instead of silent failures - Rename RekorProofsValid to RekorProofsPresent to clarify verification status - Update CLI output to indicate Rekor proofs are not verified in offline mode - Verify no race conditions with -race flag (all tests pass) Closes review suggestions #1, #2, #3 from PR #3
andybons
added a commit
that referenced
this pull request
Jan 13, 2026
…cation (#3) * docs(plans): add tamper-proof log database design Design for cryptographically verifiable logging with: - Hash-chained entries with Merkle tree organization - Agent isolation via write-only Unix socket - Tiered attestation (per-entry for critical, batched for console) - Sigstore/Rekor integration for external anchoring - CLI, proof bundles, and Go API for verification * docs(audit): add runtime-aware transport section for agent isolation Adds detailed transport mechanisms for both Docker (Unix socket) and Apple containers (TCP + token auth). Documents why different transports are needed and provides unified interface pattern. * chore: add .worktrees to gitignore * docs(audit): add Phase 1 implementation plan for tamper-proof logs * feat(audit): add Entry type with hash-chain verification Add the foundational Entry type for tamper-proof logging: - EntryType constants for console, network, and credential logs - Entry struct with sequence, timestamp, type, prev hash, data, and hash - SHA-256 hash computation over all fields (seq, ts, type, prev, data) - Verify method to check entry integrity - newEntryWithTimestamp helper for deterministic testing * fix(audit): improve Entry robustness and clarity - Add documentation that Data field must be JSON-serializable to avoid hash collisions when marshaling fails - Replace manual sequence encoding with binary.BigEndian.PutUint64() for improved clarity and maintainability * test(audit): add Entry.Verify() tests for tamper detection * feat(audit): add SQLite-backed Store for tamper-proof logs Implements Store with SQLite persistence for hash-chained log entries. The Store maintains chain state (lastSeq, lastHash) in memory and uses a mutex for thread safety. Schema stores entries with sequence as primary key and hash as unique constraint. * fix(audit): address code review issues for Store - Add comment for blank import of modernc.org/sqlite driver - Fix ignored errors in TestStore_Append_ChainedEntries - Add TestStore_PersistenceAcrossReopen to verify hash chain continuity after closing and reopening the store * feat(audit): add Store query methods Get, Count, and Range * fix(audit): address code review issues for Store query methods - Change Count() to return (uint64, error) for consistency with other methods - Add comments explaining why time.Parse and json.Unmarshal errors are safe to ignore in scan helpers (data format controlled by Append) * feat(audit): add VerifyChain for tamper detection * fix(audit): improve VerifyChain test assertions * feat(audit): add Collector with Unix socket transport * fix(audit): handle errors in Collector for tamper-proof integrity * feat(audit): add TCP transport with token authentication * fix(audit): add read deadline for TCP auth to prevent slow-loris * feat(audit): add typed entry helpers for console, network, credential * fix(audit): add field assertions to AppendCredential test * test(audit): add integration test for full workflow * fix(audit): check errors in integration test for Go idioms * chore(audit): address linter feedback * fix(proxy): use constant-time comparison for token authentication Use crypto/subtle.ConstantTimeCompare instead of == for auth token comparison to prevent timing attacks. While practical exploitation over HTTP is unlikely for 256-bit tokens due to network jitter, constant-time comparison is a security best practice that eliminates the theoretical risk entirely. * feat(audit): add MerkleNode type with leaf hash computation * feat(audit): add internal node hash computation with domain separation * feat(audit): add MerkleTree with BuildFromEntries * feat(audit): add inclusion proof generation * feat(audit): add inclusion proof verification * feat(audit): add MerkleRoot storage and persistence * feat(audit): add ProveEntry for generating inclusion proofs * test(audit): add Merkle proof integration test * feat(audit): add Signer type with Ed25519 key generation * feat(audit): add Sign and Verify methods to Signer * feat(audit): add Attestation type with storage * feat(audit): add Auditor type for verification * feat(cli): add agent audit command * fix(cli): handle UserHomeDir error and use proper error return * test(audit): add audit workflow integration test * chore(audit): address linter feedback for Phase 3 * build(deps): add sigstore-go for Rekor integration * feat(audit): add RekorClient wrapper * feat(audit): add RekorProof type and Upload method signature * feat(audit): add Rekor proof storage * feat(audit): add Rekor proof count to Auditor verification * feat(cli): show Rekor proof status in audit output * test(audit): add Rekor workflow integration test * fix(audit): check json.Unmarshal error in LoadRekorProofs * feat(audit): add ProofBundle type * feat(audit): add Store.Export() for proof bundles * feat(audit): add ProofBundle.Verify() for offline verification * test(audit): add JSON round-trip test for ProofBundle * feat(cli): add --export flag to audit command * feat(cli): add verify-bundle command for offline verification * feat(audit): add ExportWithProofs() for selective inclusion proofs * test(audit): add bundle workflow integration test * chore(audit): address linter feedback for Phase 5 * fix(audit): preserve canonical JSON for hash verification across round-trips The hash chain verification was failing after database round-trips because: - Struct types marshal JSON fields in definition order - map[string]any types marshal JSON keys in sorted order After loading from DB, Data becomes map[string]any, producing different JSON and thus different hashes. Fix: Store the original JSON in Entry.dataJSON and use it for hash computation. This ensures verification works correctly regardless of how Data is represented in memory. Also adds E2E demo test showing the full tamper-proof workflow. * docs(audit): add tamper-proof audit logging documentation - Add audit/ package to CLAUDE.md architecture section - Add Audit Logging flow to Key Flows section - Add agent audit and verify-bundle commands to README - Add Tamper-Proof Audit Logging section explaining verification * fix(audit): address PR review feedback - Add structured logging for collector errors instead of silent failures - Rename RekorProofsValid to RekorProofsPresent to clarify verification status - Update CLI output to indicate Rekor proofs are not verified in offline mode - Verify no race conditions with -race flag (all tests pass) Closes review suggestions #1, #2, #3 from PR #3 * docs(audit): update CLI output examples to match actual format * style(audit): fix struct field alignment
This was referenced Jan 13, 2026
This was referenced Jan 20, 2026
This was referenced Jan 27, 2026
This was referenced Feb 1, 2026
9 tasks
This was referenced Mar 6, 2026
This was referenced Mar 17, 2026
This was referenced Apr 12, 2026
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!