james.maesandCodex
36886cbaae
Pin reusable workflows to published standards 0.1.2. Require tagged commits on main, rerun the main quality and security gates before release, and fail preflight when NuGet publishing configuration is missing. Add pinned pre-commit hooks, JavaScript lint and dependency verification, PowerShell analysis and coverage-gate regression tests, and a trusted current-commit review-record check. Document the single-maintainer limitations and the unfinished OpenSSF assessment without claiming certification. Validation: seven Node and four Pester tests passed, lint and workflow checks passed, and 83 npm registry signatures plus 20 attestations verified. Full AppKit build, unit coverage and UI gates passed. Live check enforcement and owner attestations remain tracked follow-up work. Refs: #4, #6, #7, #8, #13, #15, #18 Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>
67 lines
2.2 KiB
YAML
67 lines
2.2 KiB
YAML
# K22-CODE-TS / K22-CODE-SH: repository tooling is checked before merges and releases.
|
|
name: scripts
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
workflow_call:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
javascript:
|
|
name: javascript
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Node
|
|
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: "24"
|
|
- name: Install locked development tools without lifecycle scripts
|
|
run: npm ci --ignore-scripts
|
|
- name: Lint JavaScript
|
|
run: npm run lint
|
|
- name: Test review validation
|
|
run: npm test
|
|
- name: Verify dependency signatures
|
|
run: npm audit signatures
|
|
|
|
powershell:
|
|
name: powershell
|
|
runs-on: windows-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install pinned analyzer and check scripts
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Install-Module PSScriptAnalyzer -RequiredVersion 1.25.0 -Scope CurrentUser -Force
|
|
Import-Module PSScriptAnalyzer -RequiredVersion 1.25.0
|
|
Invoke-ScriptAnalyzer -Path build -Recurse -Settings ./PSScriptAnalyzerSettings.psd1 -EnableExit
|
|
- name: Verify coverage gate rejection paths
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -Force
|
|
Import-Module Pester -RequiredVersion 5.7.1
|
|
$testConfiguration = New-PesterConfiguration
|
|
$testConfiguration.Run.Path = 'build/Assert-Coverage.Tests.ps1'
|
|
$testConfiguration.Run.Exit = $true
|
|
$testConfiguration.TestResult.Enabled = $true
|
|
$testConfiguration.TestResult.OutputPath = 'TestResults/coverage-gate.xml'
|
|
Invoke-Pester -Configuration $testConfiguration
|