ci: centralize CI workflows and pre-commit hooks by danielewood · Pull Request #45 · sensiblebit/certkit

danielewood · 2026-02-16T19:39:44Z

Summary

Move PR conventions and Go CI checks to org-wide reusable workflows in sensiblebit/.github
Centralize all pre-commit hooks (branch-name, commit-message, goimports, wasm, go-vet, go-build, go-test) to sensiblebit/.github
Remove local scripts/checks.py — single source of truth is now the central repo
Add weekly pre-commit autoupdate workflow to keep hook versions current
Downgrade prettier from v4 alpha to v3.1.0 stable

Test plan

CI passes with reusable workflows (PR conventions, Go CI)
Pre-commit hooks work locally via central .github repo
WASM check skips gracefully (no cmd/wasm path argument needed)
Pre-commit autoupdate workflow can be triggered manually

🤖 Generated with Claude Code

Replace inline PR title, branch name, commit message, verified commit, and Go build/test/lint/vuln jobs with calls to reusable workflows from sensiblebit/.github. Project-specific jobs (WASM, Web, Lint) remain. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Move go-vet, go-build, go-test, goimports, branch-name, commit-message, and wasm hooks to the org-wide .github repo. Remove local scripts/checks.py — single source of truth is now the central repo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Calls org-wide reusable workflow to run `pre-commit autoupdate` weekly and open a PR when hook versions are outdated. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR centralizes CI and pre-commit enforcement by switching this repo to org-wide reusable workflows and shared pre-commit hooks in sensiblebit/.github, removing the duplicated local implementation.

Changes:

Replace local pre-commit hook implementations with hooks sourced from sensiblebit/.github and remove scripts/checks.py.
Refactor GitHub Actions CI to use org-wide reusable workflows for PR conventions and Go CI, while keeping project-specific jobs (e.g., WASM).
Add a scheduled/manual workflow to run pre-commit autoupdate, and pin Prettier back to a stable v3 release in pre-commit.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
`scripts/checks.py`	Removes the local shared-checks implementation now replaced by centralized tooling.
`.pre-commit-config.yaml`	Switches several hooks to `sensiblebit/.github` and downgrades the Prettier mirror to `v3.1.0`.
`.github/workflows/pre-commit-autoupdate.yml`	Adds a scheduled/manual workflow that delegates to the org-wide autoupdate workflow.
`.github/workflows/ci.yml`	Replaces local CI jobs with org-wide reusable workflows and keeps/updates project-specific job wiring.

Copilot · 2026-02-16T19:43:24Z

.pre-commit-config.yaml


-  - repo: local
+  - repo: https://github.com/sensiblebit/.github
+    rev: "27cc26b"


The hook repo revision is pinned to a short SHA ("27cc26b"). For reproducibility and supply-chain safety, pin to an immutable ref (prefer a full commit SHA or a version tag) so pre-commit resolves the exact intended revision even if the short SHA becomes ambiguous.

Suggested change

rev: "27cc26b"

rev: "27cc26b4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b"

Copilot · 2026-02-16T19:43:24Z

.github/workflows/pre-commit-autoupdate.yml

+
+jobs:
+  autoupdate:
+    uses: sensiblebit/.github/.github/workflows/pre-commit-autoupdate.yml@main


This workflow calls a reusable workflow pinned to the moving @main ref. Consider pinning to a tag or full commit SHA to avoid unexpected CI changes/breakages when the central workflow is updated.

Suggested change

uses: sensiblebit/.github/.github/workflows/pre-commit-autoupdate.yml@main

uses: sensiblebit/.github/.github/workflows/pre-commit-autoupdate.yml@v1

Copilot · 2026-02-16T19:43:24Z

.github/workflows/ci.yml

  pr-conventions:
-    name: PR Conventions
    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Check branch name
-        id: branch
-        run: python3 scripts/checks.py branch-name "${{ github.head_ref }}"
-      - name: Check commit messages
-        if: success() || failure()
-        id: commits
-        run: python3 scripts/checks.py commit-message --ci --base-ref "origin/${{ github.base_ref }}"
-      - name: Check commits are verified
-        if: success() || failure()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: python3 scripts/checks.py verified-commits "${{ github.repository }}" "${{ github.event.pull_request.number }}"
-
-  # ── Go ──────────────────────────────────────────────
-
-  go-checks:
-    name: Go Checks
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-          check-latest: true
-          cache: true
-      - name: Build
-        id: build
-        run: go build -trimpath ./...
-      - name: Vet
-        if: success() || failure()
-        id: vet
-        run: go vet ./...
-      - name: Check goimports
-        if: success() || failure()
-        run: python3 scripts/checks.py goimports
-
-  go-test:
-    name: Go Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-          check-latest: true
-          cache: true
-      - run: go test -race -count=1 ./...
-
-  golangci-lint:
-    name: Lint (golangci-lint)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-          check-latest: true
-          cache: true
-      - uses: golangci/golangci-lint-action@v9
-        with:
-          version: latest
+    uses: sensiblebit/.github/.github/workflows/pr-conventions.yml@main

-  govulncheck:
-    name: Vulnerability Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: stable
-          check-latest: true
-          cache: true
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
-      - name: Run govulncheck
-        run: govulncheck ./...
+  go-ci:
+    uses: sensiblebit/.github/.github/workflows/go-ci.yml@main


Both reusable workflows are referenced via the moving @main ref. To make CI deterministic and reduce the risk of unexpected breakages, pin these to a tag or full commit SHA (and bump intentionally when you want updates).

Copilot · 2026-02-16T19:43:24Z

.github/workflows/ci.yml

        if: success() || failure()
        run: npx markdownlint-cli@0.47.0 --config .markdownlint.yaml '**/*.md'


The PR description says Prettier is downgraded to v3.1.0, but CI still runs npx prettier@latest --check ..., which can reintroduce v4+ behavior and create CI vs pre-commit drift. Pin the CI Prettier version to match .pre-commit-config.yaml (or update the PR description if using latest is intentional).

Replace inline prettier + markdownlint steps with call to sensiblebit/.github lint workflow. Only wasm_exec.js exclusion is project-specific. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@claude

Replace inline @claude mention handler with thin caller to sensiblebit/.github reusable workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Issue templates now come from sensiblebit/.github fallback. PR template kept as project-specific override (changelog checklist). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Copilot · 2026-02-16T19:51:20Z

.github/workflows/claude.yml

+  actions: read
+
 jobs:
  claude:


The job-level if: guard was removed when switching to the reusable workflow, so this workflow will invoke the Claude workflow on every matching event (issue comment, review comment, issue opened/assigned, review submitted). That increases CI noise/cost and can expose the Claude secret to untrusted triggers unless the reusable workflow re-implements the same authorization and @claude-mention gating. Re-add an if: condition here (as before) or pass explicit inputs to ensure only trusted users and explicit @claude mentions can trigger runs.

Suggested change

claude:

claude:

if: >

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

(github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'COLLABORATOR')) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

(github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'COLLABORATOR')) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

(github.event.review.author_association == 'MEMBER' || github.event.review.author_association == 'OWNER' || github.event.review.author_association == 'COLLABORATOR')) ||

(github.event_name == 'issues' &&

contains(github.event.issue.body, '@claude') &&

(github.event.issue.author_association == 'MEMBER' || github.event.issue.author_association == 'OWNER' || github.event.issue.author_association == 'COLLABORATOR'))

Copilot · 2026-02-16T19:51:20Z

.github/workflows/ci.yml

-        if: success() || failure()
-        run: python3 scripts/checks.py goimports
+  go-ci:
+    uses: sensiblebit/.github/.github/workflows/go-ci.yml@main


go-ci is now delegated to a reusable workflow, but this repo’s documented CI requirements include running go test -race in CI (CLAUDE.md T-3) plus the previous lint/vuln checks that were removed from this file. Please ensure the reusable go-ci.yml still runs go test -race and the required checks, or add/enable the missing steps/inputs here so CI enforcement remains unchanged.

Suggested change

uses: sensiblebit/.github/.github/workflows/go-ci.yml@main

uses: sensiblebit/.github/.github/workflows/go-ci.yml@main

with:

run-race: true

run-lint: true

run-vuln: true

Copilot · 2026-02-16T19:51:21Z

.pre-commit-config.yaml


-  - repo: local
+  - repo: https://github.com/sensiblebit/.github
+    rev: "27cc26b"


The pre-commit rev is pinned to a short SHA (27cc26b). For reproducibility and to avoid ambiguity, pin to a full commit SHA (40 chars) or a signed/tagged release in sensiblebit/.github.

Suggested change

rev: "27cc26b"

rev: v1.0.0

Copilot · 2026-02-16T19:51:21Z

.pre-commit-config.yaml

-        always_run: true
-        pass_filenames: false
-
      - id: commit-message


The commit-message hook previously ran only at the commit-msg stage. With the stage override removed here, it will run at the default stage unless the hook itself declares stages: [commit-msg] in the central repo. To avoid silently losing commit-msg enforcement, explicitly set stages: [commit-msg] for this hook in this config (or confirm it’s enforced by the hook definition).

Suggested change

- id: commit-message

- id: commit-message

stages: [commit-msg]

@claude

Avoid spinning up a runner for every issue comment/review when only @claude mentions need processing. Auth check stays in the reusable workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

claude · 2026-02-16T19:56:30Z

Code review

Issue found: Missing CHANGELOG.md entry

This PR modifies CI configuration files, adds a new workflow (pre-commit-autoupdate.yml), changes pre-commit configuration, and deletes scripts/checks.py (279 lines). This represents a notable architectural change (centralizing workflows to org-wide reusable workflows) that should be documented in CHANGELOG.md.

Rule violated: CL-1 (MUST)

Every commit that changes behavior, fixes a bug, or adds a feature must add a line to the ## [Unreleased] section of CHANGELOG.md. Internal-only changes (CI config, CLAUDE.md, test-only) do not require an entry unless they are notable. When in doubt, add an entry

This PR is notable because:

It fundamentally restructures how CI works by moving to organization-wide reusable workflows
It deletes the entire scripts/checks.py file that was core to the CI infrastructure
It removes local pre-commit hook implementations and replaces them with remote references
It adds a new weekly autoupdate workflow
It deletes all issue templates

Recommendation: Add an entry to the ## [Unreleased] section under ### Changed:

### Changed

- Migrate CI workflows and pre-commit hooks to organization-wide reusable workflows ([#45])

Checked for bugs and CLAUDE.md compliance.

claude · 2026-02-16T20:00:16Z

Code review

1 security issue found:

Security: Authorization check removed from Claude workflow

Location: .github/workflows/claude.yml lines 22-27

Issue: The authorization check that restricted Claude Code workflow execution to repository owner, org members, and collaborators has been removed from the caller workflow.

Original code (before this PR):

if: |
  (
    (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
    (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
    (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
    (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
  ) && (
    github.event.sender.login == github.repository_owner ||
    github.event.comment.author_association == 'OWNER' ||
    github.event.comment.author_association == 'MEMBER' ||
    github.event.comment.author_association == 'COLLABORATOR'
  )

New code (after this PR):

if: |
  (
    (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
    (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
    (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
    (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
  )

Security implications:

This represents a defense-in-depth regression:

Secret exposure before authorization: The CLAUDE_CODE_OAUTH_TOKEN secret is now passed to the reusable workflow for ANY user who writes @claude in a comment, with no local authorization gate. The original design had the authorization check at the earliest possible point—before the job runs, before secrets are transmitted.
External auth dependency: The auth logic has moved to a separate repository (sensiblebit/.github) where changes are not subject to this repo's review process. If the reusable workflow's auth check has a bug, is misconfigured, or is later modified, the CLAUDE_CODE_OAUTH_TOKEN could be exposed to unauthorized users.
Attack surface: Any GitHub user who can comment on an issue or PR in this repository can now trigger the workflow to start, allocate a runner, and receive the OAuth token secret before any authorization check occurs.

Recommendation:

Either:

Option 1 (Defense-in-depth): Restore the authorization check in the caller's if condition alongside the reusable workflow call. This provides layered security even if the reusable workflow also has the check.
Option 2 (Verify external check): Before merging, verify that the reusable workflow at sensiblebit/.github/.github/workflows/claude.yml@main contains an equivalent authorization check and accept the reduced defense-in-depth posture.

Security best practice for GitHub Actions is to gate secret-consuming workflows as early as possible. The caller-side authorization gate should be retained.

Defense-in-depth: gate secret transmission behind OWNER/MEMBER/ COLLABORATOR check at the caller level, not just the reusable workflow. Also adds missing CHANGELOG entry for #45. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Defense-in-depth: gate secret transmission behind OWNER/MEMBER/ COLLABORATOR check at the caller level, not just the reusable workflow. Check author_association on the correct event object for each trigger type (comment, review, issue) — previously only comment-based events were checked, silently blocking members on review and issue events. Also adds missing CHANGELOG entries for #45 and #46. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Defense-in-depth: gate secret transmission behind OWNER/MEMBER/ COLLABORATOR check at the caller level, not just the reusable workflow. Check author_association on the correct event object for each trigger type (comment, review, issue) — previously only comment-based events were checked, silently blocking members on review and issue events. Also adds missing CHANGELOG entries for #45 and #46. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

danielewood and others added 3 commits February 16, 2026 14:23

ci: add weekly pre-commit autoupdate workflow

a4b427a

Calls org-wide reusable workflow to run `pre-commit autoupdate` weekly and open a PR when hook versions are outdated. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings February 16, 2026 19:39

Copilot started reviewing on behalf of danielewood February 16, 2026 19:40 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

ci: use org-wide reusable lint workflow

0ae61e5

Replace inline prettier + markdownlint steps with call to sensiblebit/.github lint workflow. Only wasm_exec.js exclusion is project-specific. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

This comment has been minimized.

Sign in to view

ci: use org-wide reusable Claude Code workflow

d0ad5a8

Replace inline @claude mention handler with thin caller to sensiblebit/.github reusable workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings February 16, 2026 19:47

Copilot started reviewing on behalf of danielewood February 16, 2026 19:48 View session

This comment has been minimized.

Sign in to view

ci: remove issue templates, use org-wide defaults

ab6d408

Issue templates now come from sensiblebit/.github fallback. PR template kept as project-specific override (changelog checklist). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot AI reviewed Feb 16, 2026

View reviewed changes

ci: add @claude mention filter to caller workflow

7a2cc04

Avoid spinning up a runner for every issue comment/review when only @claude mentions need processing. Auth check stays in the reusable workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

danielewood merged commit 8841eaf into main Feb 16, 2026
16 checks passed

danielewood deleted the ci/reusable-workflows branch February 16, 2026 19:56

This was referenced Feb 16, 2026

fix: restore authorization check on Claude workflow caller #46

Merged

fix(ci): add changelog entry and improve workflow skip logic #44

Closed

This was referenced Feb 24, 2026

feat(web): add Inspect tab, certkitInspect WASM, and FormatDN #66

Merged

fix: harden error handling, type assertions, and overflow guards #76

Merged

	rev: "27cc26b"
	rev: "27cc26b4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b"

	uses: sensiblebit/.github/.github/workflows/pre-commit-autoupdate.yml@main
	uses: sensiblebit/.github/.github/workflows/pre-commit-autoupdate.yml@v1

		if: success() \|\| failure()
		run: npx markdownlint-cli@0.47.0 --config .markdownlint.yaml '*/.md'

-  claude:
+  claude:
+    if: >
+      (github.event_name == 'issue_comment' &&
+      contains(github.event.comment.body, '@claude') &&
+      (github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review_comment' &&
+      contains(github.event.comment.body, '@claude') &&
+      (github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review' &&
+      contains(github.event.review.body, '@claude') &&
+      (github.event.review.author_association == 'MEMBER' || github.event.review.author_association == 'OWNER' || github.event.review.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'issues' &&
+      contains(github.event.issue.body, '@claude') &&
+      (github.event.issue.author_association == 'MEMBER' || github.event.issue.author_association == 'OWNER' || github.event.issue.author_association == 'COLLABORATOR'))

-    uses: sensiblebit/.github/.github/workflows/go-ci.yml@main
+    uses: sensiblebit/.github/.github/workflows/go-ci.yml@main
+    with:
+      run-race: true
+      run-lint: true
+      run-vuln: true

	- id: commit-message
	- id: commit-message
	stages: [commit-msg]

Conversation

danielewood commented Feb 16, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claude bot commented Feb 16, 2026

Code review

Uh oh!

claude bot commented Feb 16, 2026

Code review

Security: Authorization check removed from Claude workflow

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants