james.maesandCodex GPT-6
38dd5c1488
This replaces the blocked history in PR #3 with one properly attributed, signed/DCO commit. The owner personally reviewed and approved PR #3 in the release session. **No file changes from the approved candidate:** bothbaee14f492ande605df62c4have exact Git treea85912cbad. Original PR #3 and its commits are preserved for review history. Historical commits were locally signed but GitHub reported no_user; protected merge checks those introduced commits even for squash merging. This commit resolves attribution without bypassing or weakening signature rules. The reader, Settings, themes, source highlighting/split, live reload, file associations, Print/PDF, About credits, toolbar/footer/editor fixes, user-first README/screenshots and developer guides are exactly the approved implementation. Stable/dev separation and protected Azure signing caller are unchanged. Evidence: - Approved treebaee14f/ CI38285775463 passes all checks. Downloaded focused29/29, published111/111, stable110/110 and dev110/110 TRXs have zero failures/skips. Core coverage100% lines/98.86% branches; actual update/restart/coexistence/default-preservation receipts verify. - New single-commit hooks, online workflow security, signing and DCO pass. GitHub must rerun all required checks on this commit; results are not copied across SHAs. - Live repository setup validates18 Actions-bound checks, with only fuzzing added and all prior protections preserved. - OpenSSF project15417 is now owner-reviewed and saved at70% under owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment, not a passing badge. - Production CI OIDC and signed1.0/dev publication remain required; local representative signing is not CI proof. Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work remains tracked in #33. Closes #4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34. Refs #1, #5, #30, #31, #33. Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Codex GPT-6 <noreply@openai.com>
90 lines
3.9 KiB
YAML
90 lines
3.9 KiB
YAML
# K22-CODE-SH: check repository tooling before merges and releases.
|
|
name: scripts
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
workflow_call:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
javascript:
|
|
name: javascript
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Node
|
|
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: "24"
|
|
- name: Install locked tools without lifecycle scripts
|
|
run: npm ci --ignore-scripts
|
|
- name: Lint and test review validation
|
|
run: |
|
|
npm run lint
|
|
npm test
|
|
- name: Verify dependency signatures
|
|
run: npm audit signatures
|
|
|
|
powershell:
|
|
name: powershell
|
|
runs-on: windows-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install pinned analyzer and check scripts
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Install-Module PSScriptAnalyzer -RequiredVersion 1.25.0 -Scope CurrentUser -Force
|
|
Import-Module PSScriptAnalyzer -RequiredVersion 1.25.0
|
|
# Negative fixtures prove neither partition can silently lose its rules.
|
|
$casingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "get-content -literalpath 'fixture.txt'" -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing)
|
|
if('PSUseCorrectCasing' -notin $casingFixture.RuleName) { throw 'The casing pass did not detect incorrect casing.' }
|
|
$remainingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "Write-Host 'fixture'" -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing)
|
|
if('PSAvoidUsingWriteHost' -notin $remainingFixture.RuleName) { throw 'The remaining-rule pass did not detect Write-Host.' }
|
|
# Keep casing in its own pass: command metadata races other rules in 1.25.0.
|
|
# https://github.com/PowerShell/PSScriptAnalyzer/issues/1708
|
|
foreach($script in Get-ChildItem -LiteralPath build -Recurse -File | Where-Object Extension -In '.ps1', '.psm1', '.psd1')
|
|
{
|
|
Write-Output "Analyzing $($script.Name)"
|
|
try
|
|
{
|
|
$findings = @(
|
|
Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -IncludeRule PSUseCorrectCasing
|
|
Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -ExcludeRule PSUseCorrectCasing
|
|
)
|
|
}
|
|
catch
|
|
{
|
|
Write-Output $_.Exception.ToString()
|
|
throw
|
|
}
|
|
if($findings.Count -gt 0) { $findings | Format-Table; throw "Script analysis failed: $($script.Name)" }
|
|
}
|
|
- name: Verify script boundary tests
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -Force
|
|
Import-Module Pester -RequiredVersion 5.7.1
|
|
$testConfiguration = New-PesterConfiguration
|
|
$testConfiguration.Run.Path = @('build/Assert-Coverage.Tests.ps1', 'build/GitHubRepository.Tests.ps1', 'build/Distribution.Tests.ps1', 'build/InstalledUpdates.Tests.ps1', 'build/PackageBytes.Tests.ps1', 'build/ReleaseSigning.Tests.ps1')
|
|
$testConfiguration.Run.Exit = $true
|
|
$testConfiguration.TestResult.Enabled = $true
|
|
$testConfiguration.TestResult.OutputPath = 'TestResults/coverage-gate.xml'
|
|
Invoke-Pester -Configuration $testConfiguration
|