Skip to content

Commit 9bf8f8e

Browse files
Jonathan D.A. Jewellclaude
Jonathan D.A. Jewell
and
claude
committed
chore: add RSR enforcement workflows
Added standard enforcement workflows: - CodeQL security scanning - OSSF Scorecard - Code quality checks - Mirror to forges - Guix/Nix policy - Security policy - Well-known standards - Workflow linter - Secret scanner - RSR anti-pattern check - npm/bun blocker - TypeScript blocker 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent d05c0bf commit 9bf8f8e

12 files changed

Lines changed: 279 additions & 101 deletions

‎.github/workflows/codeql.yml‎

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,40 @@
1-
# SPDX-License-Identifier: MPL-2.0
2-
# CodeQL disabled - no scannable source code detected
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
32
name: CodeQL Security Analysis
43

54
on:
6-
workflow_dispatch: # Manual trigger only
5+
push:
6+
branches: [main, master]
7+
pull_request:
8+
branches: [main, master]
9+
schedule:
10+
- cron: '0 6 * * 1'
711

812
permissions: read-all
913

1014
jobs:
11-
placeholder:
15+
analyze:
1216
runs-on: ubuntu-latest
13-
if: false
17+
permissions:
18+
contents: read
19+
security-events: write
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
include:
24+
- language: actions
25+
build-mode: none
26+
1427
steps:
15-
- run: echo "Enable when source code is added"
28+
- name: Checkout
29+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
30+
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
33+
with:
34+
languages: ${{ matrix.language }}
35+
build-mode: ${{ matrix.build-mode }}
36+
37+
- name: Perform CodeQL Analysis
38+
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
39+
with:
40+
category: "/language:${{ matrix.language }}"

‎.github/workflows/guix-nix-policy.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: MPL-2.0
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
name: Guix/Nix Package Policy
33
on: [push, pull_request]
44

@@ -10,7 +10,7 @@ jobs:
1010
permissions:
1111
contents: read
1212
steps:
13-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1414
- name: Enforce Guix primary / Nix fallback
1515
run: |
1616
# Check for package manager files

‎.github/workflows/mirror.yml‎

Lines changed: 111 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,144 @@
1-
# SPDX-License-Identifier: MPL-2.0
2-
name: Mirror to GitLab and Bitbucket
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
3+
name: Mirror to Git Forges
34

45
on:
56
push:
6-
branches: [main, master]
7-
tags:
8-
- 'v*'
7+
branches: [main]
98
workflow_dispatch:
109

1110
permissions: read-all
1211

1312
jobs:
1413
mirror-gitlab:
1514
runs-on: ubuntu-latest
16-
permissions:
17-
contents: read
18-
if: ${{ vars.GITLAB_MIRROR_ENABLED == 'true' }}
19-
15+
if: vars.GITLAB_MIRROR_ENABLED == 'true'
2016
steps:
21-
- name: Checkout
22-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
17+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
2318
with:
2419
fetch-depth: 0
2520

26-
- name: Setup SSH
27-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
21+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
2822
with:
2923
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
3024

31-
- name: Add GitLab to known hosts
25+
- name: Mirror to GitLab
3226
run: |
33-
mkdir -p ~/.ssh
3427
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
35-
36-
- name: Push to GitLab
37-
env:
38-
REPO_NAME: ${{ github.event.repository.name }}
39-
run: |
40-
git remote add gitlab git@gitlab.com:hyperpolymath/${REPO_NAME}.git || true
41-
git push gitlab HEAD:main --force || git push gitlab HEAD:master --force
42-
git push gitlab --tags --force
28+
git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true
29+
git push --force gitlab main
4330
4431
mirror-bitbucket:
4532
runs-on: ubuntu-latest
46-
permissions:
47-
contents: read
48-
if: ${{ vars.BITBUCKET_MIRROR_ENABLED == 'true' }}
49-
33+
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
5034
steps:
51-
- name: Checkout
52-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
35+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
5336
with:
5437
fetch-depth: 0
5538

56-
- name: Setup SSH
57-
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
39+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
5840
with:
5941
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
6042

61-
- name: Add Bitbucket to known hosts
43+
- name: Mirror to Bitbucket
6244
run: |
63-
mkdir -p ~/.ssh
6445
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
46+
git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true
47+
git push --force bitbucket main
48+
49+
mirror-codeberg:
50+
runs-on: ubuntu-latest
51+
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
52+
steps:
53+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
54+
with:
55+
fetch-depth: 0
56+
57+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
58+
with:
59+
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
60+
61+
- name: Mirror to Codeberg
62+
run: |
63+
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
64+
git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true
65+
git push --force codeberg main
66+
67+
mirror-sourcehut:
68+
runs-on: ubuntu-latest
69+
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
70+
steps:
71+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
72+
with:
73+
fetch-depth: 0
74+
75+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
76+
with:
77+
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
78+
79+
- name: Mirror to SourceHut
80+
run: |
81+
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
82+
git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true
83+
git push --force sourcehut main
84+
85+
mirror-disroot:
86+
runs-on: ubuntu-latest
87+
if: vars.DISROOT_MIRROR_ENABLED == 'true'
88+
steps:
89+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
90+
with:
91+
fetch-depth: 0
92+
93+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
94+
with:
95+
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
96+
97+
- name: Mirror to Disroot
98+
run: |
99+
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
100+
git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true
101+
git push --force disroot main
102+
103+
mirror-gitea:
104+
runs-on: ubuntu-latest
105+
if: vars.GITEA_MIRROR_ENABLED == 'true'
106+
steps:
107+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
108+
with:
109+
fetch-depth: 0
110+
111+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
112+
with:
113+
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
114+
115+
- name: Mirror to Gitea
116+
run: |
117+
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
118+
git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true
119+
git push --force gitea main
120+
121+
mirror-radicle:
122+
runs-on: ubuntu-latest
123+
if: vars.RADICLE_MIRROR_ENABLED == 'true'
124+
steps:
125+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
126+
with:
127+
fetch-depth: 0
128+
129+
- name: Setup Rust
130+
uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # stable
131+
with:
132+
toolchain: stable
133+
134+
- name: Install Radicle
135+
run: |
136+
# Install via cargo (safer than curl|sh)
137+
cargo install radicle-cli --locked
138+
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
65139
66-
- name: Push to Bitbucket
67-
env:
68-
REPO_NAME: ${{ github.event.repository.name }}
140+
- name: Mirror to Radicle
69141
run: |
70-
git remote add bitbucket git@bitbucket.org:hyperpolymath/${REPO_NAME}.git || true
71-
git push bitbucket HEAD:main --force || git push bitbucket HEAD:master --force
72-
git push bitbucket --tags --force
142+
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
143+
chmod 600 ~/.radicle/keys/radicle
144+
rad sync --announce || echo "Radicle sync attempted"

‎.github/workflows/npm-bun-blocker.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
2+
name: NPM/Bun Blocker
3+
on: [push, pull_request]
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
steps:
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
14+
- name: Block npm/bun
15+
run: |
16+
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
17+
echo "❌ npm/bun artifacts detected. Use Deno instead."
18+
exit 1
19+
fi
20+
echo "✅ No npm/bun violations"

‎.github/workflows/quality.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1-
# SPDX-License-Identifier: MPL-2.0
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
name: Code Quality
33
on: [push, pull_request]
44

5+
56
permissions: read-all
67

78
jobs:
@@ -10,14 +11,14 @@ jobs:
1011
permissions:
1112
contents: read
1213
steps:
13-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
14+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1415

1516
- name: Check file permissions
1617
run: |
1718
find . -type f -perm /111 -name "*.sh" | head -10 || true
1819
1920
- name: Check for secrets
20-
uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.88.3
21+
uses: trufflesecurity/trufflehog@05cccb53bc9e13bc6d17997db5a6bcc3df44bf2f # v3.92.3
2122
with:
2223
path: ./
2324
base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -34,15 +35,15 @@ jobs:
3435
find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
3536
3637
- name: EditorConfig check
37-
uses: editorconfig-checker/action-editorconfig-checker@main
38+
uses: editorconfig-checker/action-editorconfig-checker@8c9b118d446fce7e6410b6c0a3ce2f83bd04e97a # v2.1.0
3839
continue-on-error: true
3940

4041
docs:
4142
runs-on: ubuntu-latest
4243
permissions:
4344
contents: read
4445
steps:
45-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4647
- name: Check documentation
4748
run: |
4849
MISSING=""

0 commit comments

Comments
 (0)