Skip to content

fix: restore CI audit job and add missing cache-dependency-path #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 2 commits into from
Closed

fix: restore CI audit job and add missing cache-dependency-path #4

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c387ec9
Initial plan
Copilot Jun 30, 2026
f1f1dc6
fix: restore ci.yml with audit job and add cache-dependency-path
Copilot Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 29 additions & 14 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,38 @@
name: CI
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
workflow_dispatch:
jobs:
build:
validate:
runs-on: ubuntu-latest
Comment on lines +9 to 10
defaults:
run:
working-directory: . # <-- repo root, not loop-engineering/loop-engineering
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-node@v4
with:
node-version: 20.x
node-version: 20
cache: npm
cache-dependency-path: |
frontend/package-lock.json
doc/package-lock.json
- name: Install frontend deps
if: hashFiles('frontend/package-lock.json') != ''
working-directory: frontend
cache-dependency-path: tools/loop-audit/package-lock.json
- working-directory: tools/loop-audit
run: npm ci
- name: Install docs deps
if: hashFiles('doc/package-lock.json') != ''
working-directory: doc
- working-directory: tools/loop-audit
run: node dist/cli.js .. --level L2

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Audit the repository root in validate

With this step running from tools/loop-audit, the target .. resolves to /workspace/loop-engineering/tools instead of the repository root. The audit CLI treats the first non-flag as the target and exits with code 2 for scores below 40 (tools/loop-audit/src/cli.ts), and running this command locally audits tools at 10/L0, so the new validate job will fail on every push/PR; use ../.. after building to scan the root.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add a real L2 gate for validate

--level is not one of loop-audit's parsed options; the CLI only selects the first non-flag target and exits nonzero when the score is below 40. Once the target path is fixed, a repo that drops from L2 to L1 but remains above score 40 will still pass this validate step despite the command advertising an L2 gate, so add an actual level check or remove the misleading flag.

Useful? React with 👍 / 👎.

audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
cache-dependency-path: tools/loop-audit/package-lock.json
- working-directory: tools/loop-audit
run: npm ci
- working-directory: tools/loop-audit
run: npm run build
Comment on lines +37 to +38
Loading