james.maesandClaude Fable 5.1
a562acd55c
* ci: adopt the standards' pull-request, security, CodeQL and Scorecard gates
Call the KofTwentyTwo/standards reusable workflows (pinned to 855cf44):
pr-gates (Conventional Commit title, DCO, dependency review), security
(gitleaks over history, Trivy + OSV-Scanner on the lock files, zizmor +
actionlint), codeql (security-extended for csharp and actions, gated at
high), plus the Scorecard workflow. Root scanner configs, global.json,
.pre-commit-config.yaml with the dotnet-format hook, and the standard
PSScriptAnalyzer settings come with them.
Harden the existing workflows: persist-credentials false on every checkout,
no restore cache in the release job, verify-job outputs and inputs read from
environment variables instead of ${{ }} inside run:, concurrency on release,
locked restores for publish and pack (the CLI now declares win-x64 so its
lock file carries that runtime graph).
Release assets: a CycloneDX 1.6 SBOM per artifact (attached and attested),
SHA256SUMS (renamed; the channel feed is listed too), LICENSE inside the CLI
zip and the app payload, and release notes generated from Conventional
Commit subjects by .github/scripts/New-ReleaseNotes.ps1 with breaking and
security changes first. Generated pull requests use Conventional Commit
titles; Dependabot gets the 7-day cooldown and the ci prefix; the NuGet
update script holds back versions younger than the cooldown.
The old job names and dependency-review.yml stay until protect-main lists
the new required contexts (#66).
Closes #63
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
* ci: pin the standards workflows to the commit that exempts file-licensed packages
standards#4 (merged as ae174f5) adds the `allow-dependencies-licenses` input to
the reusable pull-request workflow, fixes the DCO check for commits whose author
has no GitHub login, and accepts `security` titles. The three callers move to
that commit, and pr-gates.yml exempts LibGit2Sharp, Microsoft.WindowsAppSDK and
Microsoft.Windows.SDK.BuildTools from the license check (standards EX-0003):
their nuspecs name a license file, so the dependency graph reports NOASSERTION.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
56 lines
2.1 KiB
PowerShell
56 lines
2.1 KiB
PowerShell
# KofTwentyTwo PowerShell analysis (K22-CODE-SH-05), from KofTwentyTwo/standards
|
|
# configs/shell/PSScriptAnalyzerSettings.psd1. CI runs:
|
|
# Invoke-ScriptAnalyzer -Path . -Recurse -Settings ./PSScriptAnalyzerSettings.psd1 -EnableExit
|
|
# and `Invoke-Formatter` with the same settings for layout. PowerShell supports the
|
|
# Kingsrook layout fully: next-line (Allman) braces and 3-space indentation.
|
|
@{
|
|
Severity = @('Error', 'Warning', 'Information')
|
|
IncludeDefaultRules = $true
|
|
ExcludeRules = @()
|
|
Rules = @{
|
|
PSPlaceOpenBrace = @{
|
|
Enable = $true
|
|
OnSameLine = $false
|
|
NewLineAfter = $true
|
|
IgnoreOneLineBlock = $true
|
|
}
|
|
PSPlaceCloseBrace = @{
|
|
Enable = $true
|
|
NewLineAfter = $true
|
|
IgnoreOneLineBlock = $true
|
|
NoEmptyLineBefore = $true
|
|
}
|
|
PSUseConsistentIndentation = @{
|
|
Enable = $true
|
|
IndentationSize = 3
|
|
Kind = 'space'
|
|
PipelineIndentation = 'IncreaseIndentationForFirstPipeline'
|
|
}
|
|
PSUseConsistentWhitespace = @{
|
|
Enable = $true
|
|
CheckInnerBrace = $true
|
|
# Kingsrook writes if(...) with no space; the rule cannot require that, so it
|
|
# is not checked either way.
|
|
CheckOpenParen = $false
|
|
CheckOpenBrace = $false
|
|
CheckOperator = $true
|
|
CheckPipe = $true
|
|
CheckSeparator = $true
|
|
CheckParameter = $true
|
|
}
|
|
PSAlignAssignmentStatement = @{
|
|
Enable = $true
|
|
CheckHashtable = $true
|
|
}
|
|
PSUseCorrectCasing = @{ Enable = $true }
|
|
PSAvoidUsingCmdletAliases = @{ Enable = $true }
|
|
PSAvoidUsingWriteHost = @{ Enable = $true }
|
|
PSProvideCommentHelp = @{
|
|
Enable = $true
|
|
ExportedOnly = $false
|
|
BlockComment = $true
|
|
Placement = 'before'
|
|
}
|
|
}
|
|
}
|