Skip to content

repo: CI workflow cleanup and repository configuration alignment #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chrismaz11 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

repo: CI workflow cleanup and repository configuration alignment #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78b6225
chore: tighten CI and repo guardrails
chrismaz11 Mar 16, 2026
f06e381
ci: baseline new guardrail scripts
chrismaz11 Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,14 @@ ISSUER_PUBLIC_JWK_JSON='{"kty":"EC","crv":"P-256","x":"<x>","y":"<y>"}'
DB_PATH=attestations.sqlite
DATABASE_URL="file:./prisma/dev.db"
# Supabase aliases for apps/api Postgres (optional)
SUPABASE_URL=https://<project-ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=replace-with-server-only-service-role-key
SUPABASE_DB_URL=postgresql://postgres.<project-ref>:[password]@aws-0-<region>.pooler.supabase.com:6543/postgres?sslmode=require
SUPABASE_POOLER_URL=postgresql://postgres.<project-ref>:[password]@aws-0-<region>.pooler.supabase.com:6543/postgres?sslmode=require
SUPABASE_DIRECT_URL=postgresql://postgres:[password]@db.<project-ref>.supabase.co:5432/postgres?sslmode=require
# Optional helper if using Supabase CLI pooler URL discovery from `supabase/.temp/pooler-url`.
SUPABASE_DB_PASSWORD=replace-with-supabase-db-password
SUPABASE_SECRET_KEY=replace-with-server-only-secret-key
PORT=3000

# apps/api security controls
Expand Down
62 changes: 62 additions & 0 deletions .eslintrc.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,68 @@ module.exports = {
'import/order': ['error', { 'newlines-between': 'always' }],
'@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }]
},
overrides: [
{
files: [
'apps/api/src/server.ts',
'api/**/*.ts',
'apps/api/src/lib/**/*.ts',
'apps/api/src/receiptPdf.ts',
'apps/api/src/security.ts',
'apps/api/src/db.ts',
'apps/api/src/registryLoader.ts'
],
rules: {
'no-restricted-imports': ['error', {
paths: [
{
name: './services/registryAdapters.js',
message: 'Gateway code must use ./registry/catalog.js for public registry types and the verification engine interface for registry operations.'
},
{
name: './services/compliance.js',
message: 'Compliance evaluation is engine-owned. Route code must call the verification engine interface.'
},
{
name: './anchor.js',
message: 'Anchoring is engine-owned. Route code must call the verification engine interface.'
},
{
name: './engine/registry/adapterService.js',
message: 'Registry adapter orchestration is engine-owned. Route code must call the verification engine interface.'
},
{
name: './engine/compliance/cookCountyComplianceValidator.js',
message: 'Compliance evaluation is engine-owned. Route code must call the verification engine interface.'
},
{
name: './engine/anchoring/service.js',
message: 'Anchoring is engine-owned. Route code must call the verification engine interface.'
}
],
patterns: [
{
group: [
'**/packages/engine-internal/**',
'**/packages/core/src/**',
'**/packages/core/dist/**',
'**/src/core/**',
'**/src/verifiers/**',
'**/src/services/polygonMumbaiAnchor.js',
'**/engine/anchoring/**',
'**/engine/compliance/**',
'**/engine/registry/**',
'**/services/compliance.js',
'**/services/registryAdapters.js',
'**/anchor.js'
],
message: 'Gateway-facing code must use public contracts and the narrow verification engine interface only.'
}
]
}]
}
}
],
ignorePatterns: [
'**/node_modules/**',
'**/.next/**',
Expand Down
34 changes: 34 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,53 @@
version: 2

updates:
- package-ecosystem: "npm"

Check warning on line 4 in .github/dependabot.yml

View workflow job for this annotation

GitHub Actions / zizmor advisory audit

dependabot-cooldown 

dependabot.yml:4: insufficient cooldown in Dependabot updates: missing cooldown configuration

Check warning on line 4 in .github/dependabot.yml

View workflow job for this annotation

GitHub Actions / zizmor advisory audit

dependabot-cooldown 

dependabot.yml:4: insufficient cooldown in Dependabot updates: missing cooldown configuration
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "05:00"
timezone: "America/Chicago"
open-pull-requests-limit: 5
groups:
npm-production:
dependency-type: "production"
npm-development:
dependency-type: "development"
labels:
- "dependencies"
- "security"
commit-message:
prefix: "deps"

- package-ecosystem: "github-actions"

Check warning on line 23 in .github/dependabot.yml

View workflow job for this annotation

GitHub Actions / zizmor advisory audit

dependabot-cooldown 

dependabot.yml:23: insufficient cooldown in Dependabot updates: missing cooldown configuration

Check warning on line 23 in .github/dependabot.yml

View workflow job for this annotation

GitHub Actions / zizmor advisory audit

dependabot-cooldown 

dependabot.yml:23: insufficient cooldown in Dependabot updates: missing cooldown configuration
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "05:30"
timezone: "America/Chicago"
open-pull-requests-limit: 5
groups:
github-actions:
patterns:
- "*"
labels:
- "dependencies"
- "security"
commit-message:
prefix: "deps"

- package-ecosystem: "cargo"

Check warning on line 41 in .github/dependabot.yml

View workflow job for this annotation

GitHub Actions / zizmor advisory audit

dependabot-cooldown 

dependabot.yml:41: insufficient cooldown in Dependabot updates: missing cooldown configuration

Check warning on line 41 in .github/dependabot.yml

View workflow job for this annotation

GitHub Actions / zizmor advisory audit

dependabot-cooldown 

dependabot.yml:41: insufficient cooldown in Dependabot updates: missing cooldown configuration
directory: "/circuits/non_mem_gadget"
schedule:
interval: "weekly"
day: "monday"
time: "06:00"
timezone: "America/Chicago"
open-pull-requests-limit: 3
labels:
- "dependencies"
- "security"
commit-message:
prefix: "deps"
33 changes: 26 additions & 7 deletions .github/pull_request_template.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,33 @@
## Summary

- Describe the change
- Describe the change and why it is needed.

## AI Disclosure
## Change Type

- [ ] AI-assisted changes are included in this PR
- [ ] Runtime or API behavior
- [ ] Security or repo governance
- [ ] Workflow or CI configuration
- [ ] Documentation or claims boundary only
- [ ] Dependency update

## Review Checklist
## Security Review

- [ ] Human review requested
- [ ] Tests added or updated where appropriate
- [ ] Security impact is described
- [ ] No secrets, tokens, cookies, or raw PII were added to code, logs, fixtures, or docs
- [ ] Security impact and remaining risks are described
- [ ] New permissions, auth assumptions, or trust-boundary changes are called out
- [ ] Dependency changes were reviewed for risk

## Claims Boundary And Docs

- [ ] Public-facing claims or evaluator docs were updated if needed
- [ ] No unsupported claims were introduced

## Validation

- [ ] Human review requested
- [ ] Tests or validation commands were run where appropriate
- [ ] Workflow changes were reviewed for least privilege and pinned actions

## AI Disclosure

- [ ] AI-assisted changes are included in this PR
33 changes: 33 additions & 0 deletions .github/workflows/contracts-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: TrustSignal Contracts CI

on:
pull_request:
paths:
- "packages/contracts/**"
- ".github/workflows/contracts-ci.yml"
push:
branches:
- work
- master
paths:
- "packages/contracts/**"
- ".github/workflows/contracts-ci.yml"

jobs:
contracts-build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Setup Node.js
uses: actions/setup-node@v6
with:
node-version: 22
cache: npm

- name: Install dependencies
run: npm ci

- name: Compile contracts
run: npm run build:contracts
Comment on lines +18 to +33

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 3 days ago

In general, the fix is to add an explicit permissions: block that grants only the minimal required scopes for GITHUB_TOKEN. For a build-only workflow that just checks out the repo and installs/builds code, contents: read is sufficient.

The best minimal, non-functional-change fix here is to add a root-level permissions: block under the workflow name: and on: section (or immediately after on:) to apply to all jobs (currently just contracts-build). We will set contents: read, which allows checkout and read access but prevents unintended writes. No additional imports or methods are needed since this is YAML configuration only.

Concretely, in .github/workflows/contracts-ci.yml, insert:

permissions:
  contents: read

at the workflow root, between the on: block (ending at line 14) and the jobs: key (line 16). This documents the permissions and ensures the workflow does not accidentally inherit broader defaults.

Suggested changeset 1
.github/workflows/contracts-ci.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/contracts-ci.yml b/.github/workflows/contracts-ci.yml
--- a/.github/workflows/contracts-ci.yml
+++ b/.github/workflows/contracts-ci.yml
@@ -13,6 +13,9 @@
       - "packages/contracts/**"
       - ".github/workflows/contracts-ci.yml"
 
+permissions:
+  contents: read
+
 jobs:
   contracts-build:
     runs-on: ubuntu-latest
EOF
@@ -13,6 +13,9 @@
- "packages/contracts/**"
- ".github/workflows/contracts-ci.yml"

permissions:
contents: read

jobs:
contracts-build:
runs-on: ubuntu-latest
Copilot is powered by AI and may make mistakes. Always verify output.
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Replace undefined build:contracts invocation

This job runs npm run build:contracts, but the repository scripts do not define build:contracts in package.json, so the workflow fails immediately with “Missing script” whenever it is triggered instead of compiling contracts. Please either add that script at the root or invoke the workspace build command directly.

Useful? React with 👍 / 👎.

17 changes: 17 additions & 0 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
name: Security / Dependency Review

on:
pull_request:

permissions:
contents: read

jobs:
dependency-review:
name: Dependency diff review
runs-on: ubuntu-latest
steps:
- name: Dependency review
uses: actions/dependency-review-action@v4 # GitHub-maintained action pinned to supported major; Dependabot tracks updates.
with:
fail-on-severity: high
26 changes: 26 additions & 0 deletions .github/workflows/messaging-guardrails.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: TrustSignal Messaging Guardrails

on:
pull_request:
paths:
- "README.md"
- "USER_MANUAL.md"
- "docs/**"
- "apps/web/**"
- "package.json"
- "scripts/check-public-messaging.sh"

jobs:
messaging-check:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Setup Node.js
uses: actions/setup-node@v6
with:
node-version: 22

- name: Run messaging guardrail check
run: npm run messaging:check
Comment on lines +15 to +26

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 3 days ago

To fix this, explicitly limit the GITHUB_TOKEN permissions in the workflow to the minimum needed. This job only needs to read repository contents to check out code and run an npm script, so we can safely set contents: read at the workflow root. Adding a top-level permissions block applies to all jobs that do not override it, matching current behavior but with explicit least-privilege settings.

Concretely, in .github/workflows/messaging-guardrails.yml, add a permissions: section near the top-level, alongside name: and on:. For this workflow, a minimal and appropriate block is:

permissions:
  contents: read

No other changes, imports, or new definitions are required, and existing functionality remains the same while documenting and constraining token permissions.

Suggested changeset 1
.github/workflows/messaging-guardrails.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/messaging-guardrails.yml b/.github/workflows/messaging-guardrails.yml
--- a/.github/workflows/messaging-guardrails.yml
+++ b/.github/workflows/messaging-guardrails.yml
@@ -1,5 +1,8 @@
 name: TrustSignal Messaging Guardrails
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
EOF
@@ -1,5 +1,8 @@
name: TrustSignal Messaging Guardrails

permissions:
contents: read

on:
pull_request:
paths:
Copilot is powered by AI and may make mistakes. Always verify output.
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Replace undefined messaging:check invocation

The workflow executes npm run messaging:check, but no messaging:check script exists in the repo’s package.json, so this guardrail job will fail on every matching PR with a missing-script error. Add the script or run the shell check script directly so the workflow can actually validate messaging.

Useful? React with 👍 / 👎.

82 changes: 24 additions & 58 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,78 +1,44 @@
# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.
name: Security / OpenSSF Scorecard

name: Scorecard supply-chain security
on:
# For Branch-Protection check. Only the default branch is supported. See
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
branch_protection_rule:
# To guarantee Maintained check is occasionally updated. See
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
schedule:
- cron: '36 3 * * 1'
push:
branches: [ "master" ]
branches:
- main
schedule:
- cron: "23 4 * * 1"

# Declare default permissions as read only.
permissions: read-all
permissions: {}

jobs:
analysis:
name: Scorecard analysis
scorecard:
name: OpenSSF Scorecard analysis
runs-on: ubuntu-latest
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
permissions:
# Needed to upload the results to code-scanning dashboard.
security-events: write
# Needed to publish results and get a badge (see publish_results below).
actions: read
contents: read
id-token: write
# Uncomment the permissions below if installing in a private repository.
# contents: read
# actions: read

security-events: write
steps:
- name: "Checkout code"
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Checkout
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.1.7
with:
persist-credentials: false

- name: "Run analysis"
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
- name: Run OpenSSF Scorecard
uses: ossf/scorecard-action@v2.4.3
with:
results_file: results.sarif
results_file: scorecard-results.sarif
results_format: sarif
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
# - you want to enable the Branch-Protection check on a *public* repository, or
# - you are installing Scorecard on a *private* repository
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
# repo_token: ${{ secrets.SCORECARD_TOKEN }}

# Public repositories:
# - Publish results to OpenSSF REST API for easy access by consumers
# - Allows the repository to include the Scorecard badge.
# - See https://github.com/ossf/scorecard-action#publishing-results.
# For private repositories:
# - `publish_results` will always be set to `false`, regardless
# of the value entered here.
publish_results: true

# (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
# file_mode: git

# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
- name: Upload Scorecard SARIF
uses: github/codeql-action/upload-sarif@v4 # GitHub-maintained action pinned to supported major; Dependabot tracks updates.
with:
name: SARIF file
path: results.sarif
retention-days: 5
sarif_file: scorecard-results.sarif

# Upload the results to GitHub's code scanning dashboard (optional).
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@v3
- name: Upload Scorecard artifact
uses: actions/upload-artifact@v4 # GitHub-maintained action pinned to supported major; Dependabot tracks updates.
with:
sarif_file: results.sarif
name: scorecard-results
path: scorecard-results.sarif
retention-days: 7
Loading
Loading