Skip to content

ci: add pnpm audit gates, fix SHA drift, update docs to match NA-03 v1.6 #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bryanfawcett wants to merge 1 commit into from
Closed

ci: add pnpm audit gates, fix SHA drift, update docs to match NA-03 v1.6 #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/PULL_REQUEST_TEMPLATE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,9 +91,9 @@ Closes #
- [ ] **Schema.org compliance** — new database tables, columns, or API fields
map to Schema.org types, or the PR description justifies any deviation.
- [ ] **Locked counts respected** — no change to the platform's locked counts
(17 mini-apps · 7 Enterprise products · 7 data layers · 7 covenants ·
40 interest categories · 12 manifesto sections · 3 sources of truth)
without Founder approval documented in the PR description.
(17 mini-apps · 7 data layers · 7 covenants · 40 interest categories ·
12 manifesto sections · 3 sources of truth) without Founder approval
documented in the PR description.
- [ ] **Frontier defaults** — for user-facing or infrastructure work:
offline / local-first behaviour has been considered; any new
cryptographic primitive has a documented post-quantum migration path;
Expand Down
38 changes: 29 additions & 9 deletions .github/workflows/reusable-ci-typescript-lib.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,13 +50,33 @@ permissions:
contents: read

jobs:
audit:
name: pnpm audit
runs-on: ubuntu-latest
defaults:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ${{ inputs.node-version-file }}
cache: pnpm
- run: pnpm install --frozen-lockfile
- name: pnpm audit
shell: bash
run: |
set -euo pipefail
pnpm audit --audit-level=moderate

changes:
name: detect changes
runs-on: ubuntu-latest
outputs:
typescript: ${{ steps.filter.outputs.typescript }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
with:
fetch-depth: 0
- id: filter
Expand Down Expand Up @@ -84,8 +104,8 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ${{ inputs.node-version-file }}
Expand All @@ -102,8 +122,8 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ${{ inputs.node-version-file }}
Expand All @@ -120,8 +140,8 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ${{ inputs.node-version-file }}
Expand All @@ -138,8 +158,8 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ${{ inputs.node-version-file }}
Expand Down
17 changes: 17 additions & 0 deletions .github/workflows/reusable-ci-typescript.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,23 @@ permissions:
contents: read

jobs:
audit:
name: pnpm audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ${{ inputs.node-version-file }}
cache: pnpm
- run: pnpm install --frozen-lockfile
- name: pnpm audit
shell: bash
run: |
set -euo pipefail
pnpm audit --audit-level=moderate

typecheck:
name: tsc
runs-on: ubuntu-latest
Expand Down
22 changes: 12 additions & 10 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,12 @@ contexts:

## Model selection

| Task | Model |
| ---------------------------------------------------------- | ----------------------------- |
| Routine edits, bug fixes, refactoring | `claude-sonnet-4-6` (default) |
| Architecture, security review, complex multi-step planning | `claude-opus-4-8` |
| Quick lookups, summaries, simple one-liners | `claude-haiku-4-5-20251001` |
| Task | Model |
| -------------------------------------------------------------------------- | ----------------------------- |
| Routine edits, bug fixes, refactoring | `claude-sonnet-4-6` (default) |
| Architecture, security review, complex multi-step planning | `claude-opus-4-8` |
| Maximum-depth analysis: novel attack surfaces, cross-repo audit sweeps | `claude-fable-5` |
| Quick lookups, summaries, simple one-liners | `claude-haiku-4-5-20251001` |

Sub-agents inherit the parent model unless there is a specific reason to
override.
Expand All @@ -79,8 +80,8 @@ Honour a repo's declared check commands over these defaults:

| Stack | Install | Full check |
| -------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| TypeScript / Next.js | `pnpm install` | `pnpm lint && pnpm typecheck && pnpm test && pnpm build` |
| TypeScript library | `pnpm install` | `pnpm typecheck && pnpm lint && pnpm test` |
| TypeScript / Next.js | `pnpm install` | `pnpm audit --audit-level=moderate && pnpm lint && pnpm typecheck && pnpm test && pnpm build` |
| TypeScript library | `pnpm install` | `pnpm audit --audit-level=moderate && pnpm typecheck && pnpm lint && pnpm test` |
| Rust | (Cargo workspace) | `cargo fmt --check && cargo clippy --workspace --all-targets --all-features -- -D warnings && cargo nextest run --workspace --all-features && cargo test --workspace --doc` |
| Python (uv) | `uv sync` | `uv run ruff check . && uv run ruff format --check . && uv run mypy packages && uv run pytest` |
| Solidity (Foundry) | `forge install` | `forge fmt --check && forge build --sizes && forge test -vvv` |
Expand Down Expand Up @@ -141,9 +142,10 @@ that would change them.
- **No prohibited dependencies:** no Flutter, no Couchbase.
- **Post-quantum migration path required** for every new cryptographic
primitive adopted by the platform.
- **Locked counts:** 17 Mukoko mini-apps, 7 data layers, 40 interest
categories. Do not mutate via PR. **Nyuchi Enterprise products are
not a locked count** — that line grows; do not treat it as fixed.
- **Locked counts:** 17 Mukoko mini-apps · 7 data layers · 7 covenants ·
40 interest categories · 12 manifesto sections · 3 sources of truth.
Do not mutate via PR. **Nyuchi Enterprise products are not a locked
count** — that line grows; do not treat it as fixed.

---

Expand Down
Loading