feat(governance): offload generic checks to mature OSS tooling (#1156 B2.6) - #1294
Merged
Conversation
…B2.6) ADR-0144 implementation slice: - Replace the bespoke explicit-any checker (tools/check-type-safety.ts + test + task + AutoFlow gate) with deno lint's no-explicit-any rule (AST-based, stricter, green on all 887 linted files). - Adopt markdownlint-cli2@0.23.2 for Markdown structure (thin .markdownlint-cli2.jsonc, gitignore-scoped, rule set green repo-wide; fixes 5 trailing-space + 3 EOF-newline violations in www/content/blog). - Adopt gitleaks 8.30.1 (CI step, binary pinned by version + SHA-256) for secret scanning; delete the custom SECRET_CONTENT_PATTERNS regex scan from check-repo-hygiene.ts. .gitleaks.toml allowlists only deliberate Stripe placeholder fixtures. - Adopt actionlint 1.7.12 (CI step, binary pinned by version + SHA-256) for workflow linting; clean on all 8 workflows. - Adopt zizmor via zizmorcore/zizmor-action@v0.6.3 (pinned SHA registered in ACTION_VERSION_PINS, offline audits, advanced-security off) for workflow security; fix all 11 artipacked findings with persist-credentials: false, and suppress 4 findings with in-band reasons (release-lane credential persistence, pinned npm floor, GitHub-controlled template expansions). - .github/zizmor.yml disables only the self-repository style audit (./local-action form is already audited by check-action-pins). Net governance surface: -1 custom checker (-210 LOC incl. tests), -1 custom task, -1 custom AutoFlow gate, zero new workflows/jobs.
Contributor
|
APIError: Insufficient Balance |
actionlint on the ubuntu runner runs shellcheck over every run block (absent locally on macOS); fix the six findings it reported: four unused loop counters renamed to _, an intentional SC2086 word-split and an intentional SC2016 single-quoted EICAR signature documented with in-band disable comments.
Deploying openelement with
|
| Latest commit: |
f1db345
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0c897327.lessjs.pages.dev |
| Branch Preview URL: | https://feat-1288-b26-oss-governance.lessjs.pages.dev |
Contributor
|
APIError: Insufficient Balance |
zizmor-action audits dependabot.yml in addition to workflows (its default input collection); fix the dependabot-cooldown finding with a 7-day bake-in period for github-actions updates.
Contributor
|
APIError: Insufficient Balance |
This was referenced Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #1156 (Beta.2 slice of stage #1288; ADR-0144, ADR-0151). Beta.2 bar met for all replacement/deletion scope; adoption candidates with no prior custom machinery are adopted or deferred with reasons below — see "Beta.3 remainder". Not using "Closes" so the issue stays open for the recorded remainder.
Problem
The repo carried bespoke implementations of generic governance concerns: a hand-rolled regex scanner for explicit
any(tools/check-type-safety.ts), a hand-rolled secret-content regex scan insidecheck-repo-hygiene.ts, and no mature coverage at all for Markdown structure, workflow linting, or workflow security — while ADR-0144 already assigns those concerns to pinned OSS tools.Owner
Single owner per concern after this PR (no dual authority):
anybandeno lintno-explicit-any(deno.json)check-type-safety.ts+ test + task + AutoFlow gate, −210 LOC).gitleaks.toml)SECRET_CONTENT_PATTERNSscan incheck-repo-hygiene.ts)lint:markdowntask + AutoFlow gate)zizmorcore/zizmor-action@v0.6.3(SHA-pinned, registered inACTION_VERSION_PINS)check-action-pins.ts(unchanged, OE-owned)check-package-artifacts.tsagainst packed tarballscodeql.yml), dependency-review-actionFull checker inventory (classification)
(a) Generic, replaceable → action taken
check-type-safety.ts(explicit-anyregex scan)deno lintno-explicit-any; file, test, task, gate deletedSECRET_CONTENT_PATTERNSincheck-repo-hygiene.ts(b) OpenElement-specific invariants → stay project-owned
check-action-pins.ts(action SHA registry + version-comment audit trail + dependency-review presence),check-workflow-slimming.ts(workflow-count cap, removed-workflow absence),check-project-workflow.ts(governance doc anchors),check-repo-hygiene.tsremainder (removed-package/AutoFlow2 residue, tracked generated artifacts, tracked-ignored files, large binaries),check-architecture-contract.ts,check-signal-protocol-boundary.ts,check-deno-api-free.ts,check-frozen-semantics.ts(ADR-0122),check-package-graph.ts,check-package-surface.ts,check-public-interface-snapshot.ts,verify-package-configs.ts,check-docs-truth.tsfamily (public/strategic/current/claims/www/text/evidence),check-version-anchors.ts,check-release-truth.ts,check-release-state-machine.ts,check-evidence-freshness.ts,check-supabase-migrations.ts,check-supabase-recipe-parity.ts,check-fullstack-boundary.ts,check-www-theme-tokens.ts,check-visual-baseline-duplicates.ts,check-coverage.ts,check-critical-path-tests.ts,check-audit-citations.ts,check-static-output-freeze.ts,check-public-docs-integrity.ts,check-v044-*stage gates, AutoFlow release-lane machinery (B2.7/B2.9 own its shrink).Per-tool verdicts (issue-named candidates)
artipackedfindings (persist-credentials: falseon every read-only checkout); 4 suppressions carry in-band reasons (release-lane tag-push credential, pinned npm-floor install, two GitHub-controlled template expansions);self-repositorystyle audit disabled in.github/zizmor.ymlbecause./local-action form is already audited bycheck-action-pins. Offline audits only — deterministic.markdownlint-cli2.jsonc(gitignore-scoped, 7 structure rules green repo-wide after fixing 5 trailing-space + 3 EOF-newline violations); AutoFlow gate on push/ci/releasecheck-workflow-slimmingcaps workflows at 8 and we are at exactly 8 — raising the cap is a policy decision; no custom link checker exists to retire, so it is pure addition against this stage's net-reduction bar.gitleaks.tomlcheck-package-artifacts.tsagainst packed tarballs; overlap verified — custom remainder is OE-specificcodeql.yml, alerts adjudicated under #1281Renovate vs Dependabot (decision point, not executed)
Repo currently uses Dependabot (
.github/dependabot.yml,github-actionsecosystem only). ADR-0144 names "Renovate Deno manager". Switching buys Deno/JSR dependency discovery Dependabot lacks, but it changes update PR cadence/grouping, requires installing the Renovate GitHub App (external state), and invalidates the existing Dependabot history/PR flow. This needs an explicit maintainer decision; nothing in this PR changes dependency automation.Before / after (governance surface)
tools/check-*.tsincl. tests)autoflow-cijob).gitleaks.toml,.markdownlint-cli2.jsonc,.github/zizmor.yml, 42 LOC total)Net: strictly down in custom scripts/checkers/policy owners; flat in tasks/gates/jobs; zero new workflows.
Evidence
Local, on this branch (macOS, Deno workspace):
deno lint --rules-include=no-explicit-anyon a plantedconst x: any→ exit 1markdownlint-cli2@0.23.2on planted MD012/MD042 violations → exit 1gitleakson a planted AWS-shaped key → exit 1; full history scan of this repo → 0 leaksactionlinton a planted bad runner label → exit 1; on the real tree → exit 0zizmor --offlineon a planted${{ github.event.issue.title }}expansion → exit 14; on the real tree → 0 findings, exit 0deno task lint→ 0 (887 files,no-explicit-anynow enabled)deno fmt --check→ 0 (1562 files)deno task typecheck→ 0deno task test→ 0 (1767 passed, 105 steps; starter workspace 150 passed)deno task arch:check,repo:hygiene,workflow:check,workflow:check-slimming,actions:check-pins,lint:markdown,docs:truth,text-integrity:check,www:check-current-truth→ all exit 0deno task pack:dry-run→ 0;deno task package-artifacts:check→ 0 (5 packages; note:deno.jsonis strict-JSON parsed bytools/publish-npm.ts, so the lint-rule comment had to live outside deno.json)autoflow-cijob. Two CI-only discoveries were fixed in follow-up commits: actionlint's shellcheck integration (absent on macOS) reported 6 findings (4 unused loop counters →_, 2 intentional idioms documented with in-band disable comments), and zizmor-action's default collection also auditsdependabot.yml, where thedependabot-cooldownfinding was fixed with a 7-day update cooldown.Scope
Touched:
deno.json(lint rule, task swap),tools/autoflow/policy.ts(gate swap),tools/check-action-pins.ts(register zizmor-action pin),tools/check-architecture-contract.ts(drop stale exclusion),tools/check-repo-hygiene.ts(delete secret scan), deletedtools/check-type-safety.ts+ test, 3 new tool configs, 7 workflow files (new steps +persist-credentials), 4www/content/blogMarkdown whitespace fixes. No frozen-semantics paths touched; no package source changed; no public API changed.Risk
persist-credentials: falseadded to 11 checkouts: verified by grep that no affected workflow runsgit push/git fetch/ghagainst the repo; the release lane (which pushes the immutable tag) keeps its credential via a reasoned zizmor suppression. Release-lane dry-run at the next stage boundary will confirm.www:check-current-truth, full build insidedeno task test) green.Beta.3 remainder (recorded on #1156)
check-project-workflow.