ci: inherited-controls assertion test for portfolio repos

[millsmillsymills]

Context

Plan-2 portfolio spec Section 3 enumerates the Plan-1 inherited controls every portfolio repo must carry: CodeQL, Scorecard, zizmor, gitleaks, actionlint, harden-runner egress block + allowlist, SHA-pinned actions + persist-credentials false, dependency-review, SBOM + SLSA-3, signed-commits ruleset.

Today this is asserted in prose. A CI check should verify each portfolio repo's workflow set actually contains all of the above before the repo is marked pin-grade.

Acceptance

• Scheduled workflow (or per-repo CI gate) that walks each portfolio repo's .github/workflows/ and asserts:
  • Each control's expected action is present and pinned to a full SHA.
  • harden-runner runs in every job.
  • actions/checkout everywhere uses persist-credentials: false.
• Output is a per-repo report posted as an issue or workflow summary.
• Negative test: deliberately remove a control's workflow in a test repo and confirm the check fails.

Blocked on

• At least one MVP portfolio repo existing.

Source

Follow-up from review of PR #37/#39 (Plan-2 portfolio spec).

[millsmillsymills]

🤖 Automated multi-agent issue review

Recommendation: keep-open · Priority: P3 · Effort: medium · Premise still valid: True

Review. A well-specified enhancement to add a CI check that walks each portfolio repo's .github/workflows/ and asserts the Plan-1 inherited controls (SHA-pinned actions, harden-runner in every job, persist-credentials:false, plus CodeQL/Scorecard/zizmor/gitleaks/dependency-review/SBOM/signed-commits) are present before a repo is marked pin-grade. The premise is accurate: the spec enumerates these controls in prose only and no such check exists today. But the issue's own blocker is unmet — none of the three content portfolio repos exist yet (all 404), so there is nothing to assert against. It should stay open and blocked, not be picked up by an agent despite its ready-for-agent label.

Suggested next step. Keep open but treat as blocked: it cannot be implemented or meaningfully tested until at least one of the named MVP portfolio repos (controls-as-code first per spec order) is created. Remove the misleading 'ready-for-agent' label and add a 'blocked' label, or convert the 'Blocked on' line into a tracked dependency/sub-issue. When a portfolio repo lands, build it as a scheduled workflow in the management repo (or the .github repo) that enumerates target repos, fetches each .github/workflows/, and asserts control presence + full-SHA pinning + harden-runner-per-job + persist-credentials:false, emitting a per-repo workflow-summary/issue report; include the negative test called out in acceptance.

Adversarial re-review (concurs). premise recheck: confirmed

The review reproduces against the code: the inherited controls are asserted in spec prose only (Section 3, lines 84-102), no enforcing CI check exists (scripts/check-pinned-repos.sh only checks org pin display drift), and the blocker is real (three content repos 404 and are absent from Tofu; the fourth MVP repo '.github' exists but has zero workflows). Keep-open/blocked/P3/medium/not-actionable stands; the only refinement is that the spec names four MVP repos including '.github', not three content repos, but that does not change the conclusion."

Open points raised:

• Reviewer says 'none of the three content portfolio repos exist.' The spec (docs/superpowers/specs/2026-05-14-millsymills-portfolio-content.md, lines 14, 45-51, 167) actually names FOUR MVP repos including '.github', which DOES exist. So the issue's blocker 'at least one MVP portfolio repo existing' is technically partly satisfied. This does not overturn the conclusion: the '.github' repo's tree contains only profile/README.md + assets/avatar.png (verified via git tree API) with zero .github/workflows/, and its pin-grade bar per the spec is org-profile rendering rather than the inherited CI control set, so there is still effectively nothing meaningful to assert controls against.

_{Posted by a review + adversarial-review agent sweep across all open issues. No code was changed; no PRs were opened.}

[millsmillsymills]

This was generated by AI during triage.

Relabeling ready-for-agent → ready-for-human. Blocked: none of the MVP portfolio content repos exist yet (the .github repo exists but has no workflows to assert against), and creating them is gated on ADRs 0003-0006 (#46), a maintainer decision. Matches the 2026-06-23 review-sweep recommendation in this thread. Relabel back once a portfolio repo lands.