KofTwentyTwo/Jarvis
2
0 Fork 0
Code Issues 111 Pull Requests 16 Actions Packages Projects Releases 4 Wiki Activity

ci: build hygiene — webview cleanup + OpenSSF Scorecard (#46, #178) #194

Merged
KofTwentyTwo merged 2 commits from ci/v0.2-wave-1-build-hygiene into develop 2026-05-14 14:29:49 +00:00
Conversation 0 Commits 2 Files Changed 3
+74
KofTwentyTwo commented 2026-05-14 14:07:48 +00:00 (Migrated from github.com)
Copy link
Copy source

Summary

First PR in the v0.2 Wave 1 sequence. Two infra-only changes grouped by surface area (per docs/superpowers/specs/2026-05-14-v0.2-wave-1-sequencing-design.md):

  • #46 — scripts/build-webview.sh now sweeps App/Resources/webview/assets/*.{js,js.map,css,css.map} before the rsync. Vite content-hashed bundle names rotated on every edit; without --delete rsync (kept for bus-harness.html / .gitignore preservation), stale chunks accumulated. Verified locally: ran bash scripts/build-webview.sh against a tree with 9 stale chunks; now only the active bundle + map remain in assets/.
  • #178 — New .github/workflows/scorecard.yml running ossf/scorecard-action@v2.4.0 on weekly cron + push to develop + workflow_dispatch. Canonical permissions set. README gains the OpenSSF Scorecard badge.

Test plan

  • Local: bash scripts/build-webview.sh leaves a clean assets/ (verified)
  • CI: boundary-gates green
  • CI: webview build green
  • CI: SPM matrix green
  • After merge: OpenSSF Scorecard workflow appears in Actions and produces a first run (or surfaces a clear permission failure to address)

Non-goals

Closes #46
Closes #178

## Summary First PR in the v0.2 Wave 1 sequence. Two infra-only changes grouped by surface area (per `docs/superpowers/specs/2026-05-14-v0.2-wave-1-sequencing-design.md`): - **#46** — `scripts/build-webview.sh` now sweeps `App/Resources/webview/assets/*.{js,js.map,css,css.map}` before the rsync. Vite content-hashed bundle names rotated on every edit; without `--delete` rsync (kept for `bus-harness.html` / `.gitignore` preservation), stale chunks accumulated. Verified locally: ran `bash scripts/build-webview.sh` against a tree with 9 stale chunks; now only the active bundle + map remain in `assets/`. - **#178** — New `.github/workflows/scorecard.yml` running `ossf/scorecard-action@v2.4.0` on weekly cron + push to develop + workflow_dispatch. Canonical permissions set. README gains the OpenSSF Scorecard badge. ## Test plan - [x] Local: `bash scripts/build-webview.sh` leaves a clean `assets/` (verified) - [ ] CI: boundary-gates green - [ ] CI: webview build green - [ ] CI: SPM matrix green - [ ] After merge: OpenSSF Scorecard workflow appears in Actions and produces a first run (or surfaces a clear permission failure to address) ## Non-goals - Doesn't touch PRs #185, #191, #192 - Doesn't touch the dist/ rebuild or comment scrubs (those land in PR1) Closes #46 Closes #178
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area:agent
area:build
area:bus
area:devtool
area:hud
area:logging
area:mcp
area:memory
area:vision
area:voice
audit-finding
bug
Something isn't working
 carry-forward
comment-cleanup
Comment / docstring cleanup per .planning/code-commenting-guide.md
 dependencies
Dependency updates
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 epic
good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 javascript
Pull requests that update javascript code
 migration
question
Further information is requested
 severity:critical
severity:high
severity:low
severity:medium
wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/Jarvis#194