james.maesandClaude Opus 4.7
439e1ee2f5
* ci(build-webview): sweep stale hashed chunks before rsync (#46) Vite emits content-hashed asset names (e.g. `index-CXPb0I5z.js`), so the active bundle filename rotates on every source/dependency edit. The existing rsync runs without `--delete` (to preserve `bus-harness.html` and `.gitignore`), so old chunks accumulated in `App/Resources/webview/assets/` — observed 9 stale `index-*.js` / `.js.map` pairs locally before this fix. Add an explicit `rm -f` of the asset glob (JS + JS map + CSS + CSS map) before the rsync drops the fresh bundle. The preserved files (`bus-harness.html`, `index.html`, `.gitignore`) live one level up in `$DEST`, not in `$DEST/assets`, so the rm cannot reach them. Verified locally: `bash scripts/build-webview.sh` now leaves exactly one `index-*.js` + `.js.map` in `assets/` (matching the reference in `index.html`). Refs #46 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * ci(scorecard): add OpenSSF Scorecard workflow + README badge (#178) Adds `.github/workflows/scorecard.yml` running `ossf/scorecard-action@v2.4.0` on: - Weekly cron (Mondays 06:00 UTC) for posture drift detection - Push to develop for prompt regression visibility - workflow_dispatch for ad-hoc runs Permissions follow the canonical Scorecard set (`id-token: write`, `contents: read`, `security-events: write`) with top-level `read-all` and job-scoped writes. Results are published to the OpenSSF public dataset (powers the README badge URL) and uploaded as SARIF to code-scanning. The workflow consumes no untrusted user inputs in `run:` blocks, so it is not exposed to workflow-injection patterns documented in github.blog/security/.../how-to-catch-github-actions-workflow-injections. README.md gains the standard Scorecard badge next to the existing license/platform/swift badges. Refs #178 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
# OpenSSF Scorecard — security supply-chain posture for KofTwentyTwo/Jarvis.
|
|
#
|
|
# Issue #178. Scorecard scores 18 security checks (Branch-Protection, Code-Review,
|
|
# Pinned-Dependencies, SAST, Token-Permissions, etc.) and publishes results as
|
|
# SARIF to GitHub code-scanning. A weekly schedule keeps the score fresh; we
|
|
# also re-run on every push to develop so significant posture regressions show
|
|
# up promptly. The badge in README.md links back to the public scorecard page.
|
|
#
|
|
# Permissions are the canonical Scorecard set:
|
|
# - id-token: write OIDC for publish-results
|
|
# - contents: read read repo tree
|
|
# - security-events: write upload SARIF to code-scanning
|
|
#
|
|
# This workflow runs on github-hosted ubuntu-latest. Self-hosted Grogu is not
|
|
# used here -- Scorecard is short, network-bound, and benefits from a clean
|
|
# ephemeral environment.
|
|
#
|
|
# Workflow consumes no untrusted user inputs (no github.event.* interpolation
|
|
# in run: blocks), so it is safe from workflow-injection patterns.
|
|
|
|
name: OpenSSF Scorecard
|
|
|
|
on:
|
|
schedule:
|
|
# Mondays at 06:00 UTC. Off-peak relative to weekday push spikes.
|
|
- cron: "0 6 * * 1"
|
|
push:
|
|
branches: [develop]
|
|
workflow_dispatch:
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
analysis:
|
|
name: Scorecard analysis
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run Scorecard
|
|
uses: ossf/scorecard-action@v2.4.0
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
# publish_results: true uploads anonymized scores to the OpenSSF
|
|
# public dataset, which is what powers the README badge URL
|
|
# (api.scorecard.dev). Safe for a public repo; would need
|
|
# reconsidering if the repo were ever made private.
|
|
publish_results: true
|
|
|
|
- name: Upload SARIF to code-scanning
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: results.sarif
|