feat(ci): real dependency scanning + security checklist truth-in-labeling (U20 — O7) - #51
Merged
Merged
Conversation
… audit gates (U20/O7) security.md's checklist claimed "automated dependency scanning" that existed nowhere in this repo's CI or stack packs. Make the claim true before commit 2 relabels it: - framework-invariants.yml: Trivy secret-scan job now runs `--scanners secret,vuln` (was secret-only), same blocking exit-code style. Trivially green today (no manifests in this repo); real for forks/adopters that add one. - Every stack-pack ci-gates.yml (TypeScript, Python, Go, Rust) gains one native dependency-audit step: `pnpm audit --audit-level high`, `uvx pip-audit`, `govulncheck ./...`, `cargo audit`. Each cites .claude/rules/security.md's Dependency Safety section rather than restating it. - Each pack's golden-path.skill.md "Gates Wiring" sentence corrected from "CI runs the identical gates" to name the new CI-only audit step — it has no local pre-commit-verification.sh equivalent, so the old claim would otherwise become a fresh instance of the exact false-claim pattern this unit exists to close. - MIGRATION.md (v4.0.x) and CHANGELOG.md document the change for adopters who already pasted a pack's ci-gates.yml block. Stack-pack README "Exemplar current as of" lines already read 2026-07 (current month); no edit needed since the granularity is monthly and no month boundary was crossed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… (U20/O7) Now that commit 1 makes dependency scanning real, relabel the checklist so mechanisms lead labels instead of the reverse: - Every Security Checklist line is tagged with its actual Enforcement Ladder rung (1–4), keeping the existing parenthetical style. - Secrets line: cites pre-tool-use-validator.sh's Bash redirect/heredoc coverage (not just Write/Edit) and Trivy's `secret,vuln` scanners — accurate post-hardening, rung 3+4. - Dependencies line: parenthetical is now genuinely true — cites the repo's own Trivy vuln scan plus the four stack-pack audit gates, rung 4. - The five adopter-only lines (input validation, SQL parameterization, auth/authz, encryption, error messages) get an explicit rung-1 marker: "adopter-level: enforce in your application/CI; this framework cannot check it" — no framework mechanism has ever checked these, so the bare checklist line was silently implying enforcement that didn't exist. - Enforcement Ladder preamble sentence reworded to name the per-line rung tags, replacing "step 1" with "rung 1" for consistency with the rest of the repo's vocabulary (postmortem, land-the-plane, CONTRIBUTING.md). File growth: 0 lines (85 -> 85) — every annotation extends an existing line rather than adding a new one. rules-lines total unchanged (426/500). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
U20 — research option O7, both halves: dependency scanning becomes real, then the security checklist stops implying enforcement it doesn't have. Closes the audit finding that
security.mdcited "automated dependency scanning" which existed nowhere.What changed
secret,vuln(blocking; trivially green here — no manifests — real for adopters/forks). Each stack pack'sci-gates.ymlgains its native audit gate:pnpm audit --audit-level high,uvx pip-audit,go install …/govulncheck@latest && govulncheck ./...(the official action was fetched and rejected — it duplicates the job's existing checkout/setup-go),cargo install cargo-audit --locked && cargo audit. Each step citessecurity.mdDependency Safety rather than restating it (packs' DRY lines).golden-path.skill.mdfiles said "CI runs the identical gates" — adding a CI-only audit step would have falsified that sentence the moment it landed. All four corrected to name the CI-only step. (The truth-in-labeling unit almost shipped a new labeling lie; the worker caught it.)secret,vuln), dependencies (rung 4, the parenthetical is finally true), and the five adopter-level items explicitly marked rung-1 ("this framework cannot check it"). Zero net line growth — every annotation extends an existing line;rules-linesstays 426/500.Provenance
check-invariants.shALL GREEN;test-hooks.shALL GREEN (no hooks touched);actionlintclean; pack YAML fragments parse-validated.Risk tier
low-medium — CI additions are blocking for adopters with vulnerable lockfiles (that is the point); this repo's own CI is unaffected in practice (no manifests). Note: parallel-open with #50 — disjoint files except the CHANGELOG tail; whichever merges second gets the usual trivial append rebase.
Test plan
🤖 Generated with Claude Code