archipelagoandClaude Opus 5
a3283cffb4
Layer (b) — core/clippy.toml bans rand::random and rand::thread_rng crate-wide, each with a reason naming KEY-05 and pointing at the evidence doc. No CI change was needed: the Rust job already runs `cargo clippy --all-targets --all-features -- -D warnings` from core/, so a disallowed_methods hit is already a build failure. --all-targets covers tests deliberately — a fixture keeping the default is a template for the next production call site. Ordering was asserted before the file was written, not after: the residual count of unmigrated call sites is 0, so this cannot turn CI red for other agents on this shared tree. Layer (c) — core/deny.toml makes the rand major split change-detecting: global multiple-versions = "allow", a per-crate deny-multiple-versions for rand, and a dated grandfather skip pinning =0.9.2 exactly. The tree as it stands passes; a third version or a change to either member fails. Both gates were OBSERVED working, not assumed: - Reintroducing one banned call produced the disallowed_methods error with the reason text reaching the developer at the failure point; reverting returned the residual count to 0. - `cargo deny check bans` exits 0 as-is. Removing the grandfather entry made it exit 2 and print both dependency trees, independently confirming F-07's account of where each rand version comes from. Restored, it exits 0 again. Policy (checkpoint Task 5, human-approved): bans-only. The advisories gate is NOT enabled — it fails builds when a new CVE is published against an existing dep with no local change, which on a tree where several agents push continuously would block everyone at an arbitrary hour, with remediation often meaning a bump to an exactly-pinned crypto dependency. No break-glass procedure exists. F-07's advisory half stays OPEN and is recorded as such. cargo-deny is pinned to 0.20.2 and installed from crates.io rather than via EmbarkStudios/cargo-deny-action, because that action exposes no input to pin the tool version — an unpinned supply-chain checker would reintroduce, at the CI layer, the exact "backend fixed by configuration rather than stated" shape this plan exists to remove. crates.io is also the source vetted at the Task 5 legitimacy gate (EmbarkStudios, repo resolves, ~4.79M downloads). RECORDED HONESTLY: layer (b)'s gate is live but not yet EFFECTIVE. The tree carries 42 pre-existing clippy warnings — unused imports, dead code, ~39 style lints — that are already errors under -D warnings, so that CI step cannot pass today for reasons unrelated to KEY-05. Until a dedicated lint-clearing pass lands, a new banned RNG call would be one error among many rather than a distinctive build-stopper. Pre-existing and out of scope; clearing it right before an OTA would be poor sequencing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
101 lines
2.6 KiB
YAML
101 lines
2.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
RUST_VERSION: stable
|
|
NODE_VERSION: 20
|
|
|
|
jobs:
|
|
rust:
|
|
name: Rust
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: core
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Rust
|
|
uses: actions-rust-lang/setup-rust-toolchain@v1
|
|
with:
|
|
toolchain: ${{ env.RUST_VERSION }}
|
|
components: rustfmt, clippy
|
|
|
|
- name: Format
|
|
run: cargo fmt --all -- --check
|
|
|
|
# KEY-05 layer (b) is enforced HERE, with no step of its own: core/clippy.toml
|
|
# bans the defaulted RNG entry points, and `-D warnings` already turns a
|
|
# `disallowed_methods` hit into a build failure. `--all-targets` covers tests
|
|
# too, deliberately. See docs/security/KEY-05-ENTROPY-ENFORCEMENT.md
|
|
- name: Clippy
|
|
run: cargo clippy --all-targets --all-features -- -D warnings
|
|
|
|
# KEY-05 layer (c) — see core/deny.toml for the policy and its rationale.
|
|
#
|
|
# The version is pinned deliberately. EmbarkStudios/cargo-deny-action exposes
|
|
# no input to pin the cargo-deny version, and an unpinned supply-chain checker
|
|
# is a contradiction in terms, so the tool is installed from crates.io — the
|
|
# source actually vetted at the 10-06 Task 5 legitimacy checkpoint — rather
|
|
# than by adding another unvetted action to this workflow.
|
|
#
|
|
# `check bans` ONLY: the advisories gate is not enabled (bans-only policy).
|
|
- name: Supply chain (cargo-deny)
|
|
run: |
|
|
cargo install --locked cargo-deny --version 0.20.2
|
|
cargo deny check bans
|
|
|
|
- name: Test
|
|
run: cargo test --all-features
|
|
|
|
frontend:
|
|
name: Frontend
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: neode-ui
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
cache: npm
|
|
cache-dependency-path: neode-ui/package-lock.json
|
|
|
|
- name: Install
|
|
run: npm ci
|
|
|
|
- name: Type check
|
|
run: npm run type-check
|
|
|
|
- name: Test
|
|
run: npm test
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
manifests:
|
|
name: App Manifests
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Validate manifests
|
|
run: |
|
|
for manifest in apps/*/manifest.yml; do
|
|
./scripts/validate-app-manifest.sh --repo-audit "$manifest"
|
|
done
|