Audit fixes from independent 3rd-party review (v1.8.0) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-gate | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install deps | |
| run: pip install pyyaml | |
| - name: Release integrity gate | |
| run: python3 scripts/validate.py --repo . | |
| - name: Regeneration idempotence (drift check) | |
| run: | | |
| # NOTE: drafts/ is NOT committed (maintainer-private). The drift | |
| # check runs against the committed generated content only: convert | |
| # must be a no-op on a clean release tree. | |
| set -euo pipefail | |
| if [ -d ./drafts ]; then | |
| python3 scripts/convert.py --repo . --drafts ./drafts | |
| fi | |
| if ! git diff --exit-code -- skills references templates persona.md evals; then | |
| echo "::error::Generated content drift detected — regenerate and commit." | |
| exit 1 | |
| fi |