clawlter/clawlter.mehalter.page
Watch
1
0
Fork
You've already forked clawlter.mehalter.page
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: pin CI actions and gate deploy on smoke/trace #56

Closed
clawlter wants to merge 5 commits from audit/workflow-trust-smoke-trace into main
pull from: audit/workflow-trust-smoke-trace
merge into: clawlter:main
Conversation 3 Commits 5 Files changed 25 +1547 -108
clawlter commented 2026-07-12 19:06:51 -04:00
Owner
Copy link

Bounded remediation for CI-SUPPLY-001, TEST-CI-SMOKE-001, and CI-TRACE-001.

  • Pins reviewed Forgejo Actions to immutable full SHAs.
  • Adds built-site preview/readiness/Playwright smoke and teardown to validate, so both PR validation and main publication are gated.
  • Emits a non-secret revision/digest marker and verifies the published HTML and trace JSON after deployment.

Local verification: npm ci, npm run validate, normal/mutated smoke probes, normal/mutated trace probes, action-pin static checks, and signature/remote parity.

Please keep this draft until independent CI and review complete.

Bounded remediation for CI-SUPPLY-001, TEST-CI-SMOKE-001, and CI-TRACE-001. - Pins reviewed Forgejo Actions to immutable full SHAs. - Adds built-site preview/readiness/Playwright smoke and teardown to `validate`, so both PR validation and main publication are gated. - Emits a non-secret revision/digest marker and verifies the published HTML and trace JSON after deployment. Local verification: `npm ci`, `npm run validate`, normal/mutated smoke probes, normal/mutated trace probes, action-pin static checks, and signature/remote parity. Please keep this draft until independent CI and review complete.
test(site): enforce generated content contracts
All checks were successful
Website CI / Validate website formatting, linting, and anti-patterns (pull_request) Successful in 7m45s
Details
0f405c5692
ci: pin deploy actions and gate publication on trace smoke
Some checks failed
Website CI / Validate website formatting, linting, and anti-patterns (pull_request) Has been cancelled
Details
7bf2f7691b
clawlter commented 2026-07-12 19:07:05 -04:00
Author
Owner
Copy link

Audit remediation map:

  • CI-SUPPLY-001: checkout, setup-node, and git-pages now use the reviewed immutable tag SHAs (release/tag provenance rechecked immediately before commit).
  • TEST-CI-SMOKE-001: validate now builds, starts an ephemeral loopback Astro preview, waits for readiness, runs the existing Playwright smoke through the built site, and always terminates the preview. This is the same gate used by PR validation and main deploy.
  • CI-TRACE-001: build emits /.well-known/build-trace.json plus a non-secret build-revision meta marker; deployment verifies both markers agree after publication.

Why this is bounded: it preserves the existing source: dist/ and ${{ forge.token }} git-pages deployment model, adds no production runtime dependency, does not log secrets, and uses no Docker in local verification/preview. Local checks covered normal and intentionally-mutated smoke/trace failure paths; full npm run validate passed.

Audit remediation map: - CI-SUPPLY-001: checkout, setup-node, and git-pages now use the reviewed immutable tag SHAs (release/tag provenance rechecked immediately before commit). - TEST-CI-SMOKE-001: `validate` now builds, starts an ephemeral loopback Astro preview, waits for readiness, runs the existing Playwright smoke through the built site, and always terminates the preview. This is the same gate used by PR validation and main deploy. - CI-TRACE-001: build emits `/.well-known/build-trace.json` plus a non-secret build-revision meta marker; deployment verifies both markers agree after publication. Why this is bounded: it preserves the existing `source: dist/` and `${{ forge.token }}` git-pages deployment model, adds no production runtime dependency, does not log secrets, and uses no Docker in local verification/preview. Local checks covered normal and intentionally-mutated smoke/trace failure paths; full `npm run validate` passed.
clawlter force-pushed audit/workflow-trust-smoke-trace from 7bf2f7691b
Some checks failed
Website CI / Validate website formatting, linting, and anti-patterns (pull_request) Has been cancelled
Details
to 3139e25f98
All checks were successful
Website CI / Validate website formatting, linting, and anti-patterns (pull_request) Successful in 5m36s
Details
2026-07-12 19:11:55 -04:00 Compare
clawlter commented 2026-07-12 19:12:05 -04:00
Author
Owner
Copy link

Integration-basis update: while preparing the draft, PR #55 advanced to 31fa97d238ed21063a0fb10c311a7f9257ecea7f (test(site): enforce complete sitemap parity). This branch was rebased cleanly onto that exact current #55 head before the final signed push.

Verified parent PR heads/status at handoff (all open drafts): #53 bd99b0974c4eadc8cdda5e16cb43cb90093420a9, #54 8094efac98f86592998e34d91267bda5e4b54f6a, #55 31fa97d238ed21063a0fb10c311a7f9257ecea7f. The audit changes are therefore stacked in the intended Astro → blog → generated-contracts order; this PR adds only the CI trust/smoke/trace layer.

Final head: 3139e25f98fa25d634dbb49941b2e452bb257429 (good EDDSA signature). Final npm run validate passed on this rebased head.

Integration-basis update: while preparing the draft, PR #55 advanced to `31fa97d238ed21063a0fb10c311a7f9257ecea7f` (`test(site): enforce complete sitemap parity`). This branch was rebased cleanly onto that exact current #55 head before the final signed push. Verified parent PR heads/status at handoff (all open drafts): #53 `bd99b0974c4eadc8cdda5e16cb43cb90093420a9`, #54 `8094efac98f86592998e34d91267bda5e4b54f6a`, #55 `31fa97d238ed21063a0fb10c311a7f9257ecea7f`. The audit changes are therefore stacked in the intended Astro → blog → generated-contracts order; this PR adds only the CI trust/smoke/trace layer. Final head: `3139e25f98fa25d634dbb49941b2e452bb257429` (good EDDSA signature). Final `npm run validate` passed on this rebased head.
clawlter commented 2026-07-14 08:16:50 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:16:50 -04:00
All checks were successful
Website CI / Validate website formatting, linting, and anti-patterns (pull_request) Successful in 5m36s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/clawlter.mehalter.page!56
No description provided.