fix: complete bundled tool consolidation #747
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Purpose: CEO Audit — SOTA repository review (47 gates, 8 axes) | |
| # Docs: https://github.com/OpenSIN-Code/SIN-Code/tree/main/skills/code-skills/skill-code-ceo-audit | |
| # | |
| # Runs the full CEO Audit on every push and PR. Posts a Markdown | |
| # comment on the PR with the grade, top 3 risks, and a link to the | |
| # full report. Fails if grade < B (configurable via --grade flag). | |
| # | |
| # Required secrets: none (uses built-in GITHUB_TOKEN) | |
| # Optional inputs: profile (default: QUICK), grade (default: B) | |
| name: ceo-audit | |
| on: | |
| # NUR main/master (Branches sind verboten — siehe globale AGENTS.md). | |
| # PRs sind weiterhin willkommen (last line of defense wenn doch einer entsteht). | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| workflow_dispatch: | |
| inputs: | |
| profile: | |
| description: 'Audit profile: QUICK | RELEASE | SECURITY | FULL' | |
| required: false | |
| default: 'QUICK' | |
| grade: | |
| description: 'Minimum grade to pass: A | B | C' | |
| required: false | |
| default: 'B' | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| checks: write | |
| jobs: | |
| ceo-audit: | |
| name: CEO Audit (${{ inputs.profile || 'QUICK' }}, grade≥${{ inputs.grade || 'B' }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| AUDIT_PROFILE: ${{ inputs.profile || 'QUICK' }} | |
| AUDIT_GRADE: ${{ inputs.grade || 'B' }} | |
| AUDIT_REPO: ${{ github.workspace }} | |
| AUDIT_RUN_ID: ${{ github.run_id }} | |
| AUDIT_SHA: ${{ github.sha }} | |
| CEO_AUDIT_OUTPUT: ${{ github.workspace }}/ceo-audit-output | |
| # Keep every generated artifact inside the checked-out workspace. | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 # full history for regression detection | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| cache: 'pip' | |
| - name: Install current SIN-Code checkout | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -e ".[dev]" | |
| - name: Locate canonical audit engine | |
| id: locate | |
| run: | | |
| SCRIPT="${{ github.workspace }}/skills/code-skills/skill-code-ceo-audit/scripts/audit.sh" | |
| if [ ! -x "$SCRIPT" ]; then | |
| echo "::error::Canonical CEO Audit engine is missing or not executable: $SCRIPT" | |
| exit 1 | |
| fi | |
| echo "script=$SCRIPT" >> "$GITHUB_OUTPUT" | |
| echo "skill_root=${{ github.workspace }}/skills/code-skills/skill-code-ceo-audit" >> "$GITHUB_OUTPUT" | |
| bash -n "$SCRIPT" | |
| "$SCRIPT" --help >/dev/null | |
| - name: Run CEO Audit | |
| id: audit | |
| run: | | |
| mkdir -p ceo-audit-output | |
| # Run audit; capture exit code (allow failure so we can still post the report) | |
| set +e | |
| ${{ steps.locate.outputs.script }} \ | |
| "$AUDIT_REPO" \ | |
| --profile="$AUDIT_PROFILE" \ | |
| --grade="$AUDIT_GRADE" \ | |
| --output="$AUDIT_REPO/ceo-audit-output" \ | |
| --json 2>&1 | tee ceo-audit-output/console.log | |
| AUDIT_EXIT=$? | |
| set -e | |
| echo "audit_exit_code=$AUDIT_EXIT" >> $GITHUB_OUTPUT | |
| # Don't fail the step yet — we want to always upload the report + post the comment | |
| - name: Upload audit artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ceo-audit-${{ github.run_id }} | |
| path: ceo-audit-output/ | |
| retention-days: 30 | |
| if-no-files-found: warn | |
| - name: Extract grade from score.json | |
| id: grade | |
| if: always() | |
| run: | | |
| SCORE_FILE=$(find ceo-audit-output -name 'score.json' | head -1) | |
| if [ -z "$SCORE_FILE" ]; then | |
| echo "::error::CEO Audit did not produce score.json" | |
| echo "grade=unknown" >> $GITHUB_OUTPUT | |
| echo "score=0" >> $GITHUB_OUTPUT | |
| echo "verdict=Audit failed" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| GRADE=$(jq -r '.grade // "?"' "$SCORE_FILE") | |
| SCORE=$(jq -r '.score // 0' "$SCORE_FILE") | |
| CRITICAL=$(jq -r '.critical // 0' "$SCORE_FILE") | |
| HIGH=$(jq -r '.high // 0' "$SCORE_FILE") | |
| echo "grade=$GRADE" >> $GITHUB_OUTPUT | |
| echo "score=$SCORE" >> $GITHUB_OUTPUT | |
| echo "critical=$CRITICAL" >> $GITHUB_OUTPUT | |
| echo "high=$HIGH" >> $GITHUB_OUTPUT | |
| echo "::notice::CEO Audit: $GRADE ($SCORE/100) | critical=$CRITICAL high=$HIGH" | |
| - name: Post PR comment | |
| if: github.event_name == 'pull_request' && always() | |
| uses: marocchino/sticky-pull-request-comment@v3 | |
| with: | |
| header: ceo-audit | |
| message: | | |
| ## 🏆 CEO Audit — ${{ steps.grade.outputs.grade || '?' }} (${{ steps.grade.outputs.score || '0' }}/100) | |
| | Metric | Value | | |
| |--------|-------| | |
| | **Grade** | **${{ steps.grade.outputs.grade || '?' }}** | | |
| | **Score** | **${{ steps.grade.outputs.score || '0' }}/100** | | |
| | **Critical findings** | ${{ steps.grade.outputs.critical || '0' }} | | |
| | **High findings** | ${{ steps.grade.outputs.high || '0' }} | | |
| | **Profile** | `${{ env.AUDIT_PROFILE }}` | | |
| | **Min grade gate** | ${{ env.AUDIT_GRADE }} | | |
| 📥 [Download full report (Markdown)](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts) | |
| 📊 [Download SARIF (for Code Scanning)](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts) | |
| > Run `skills/code-skills/skill-code-ceo-audit/scripts/audit.sh . --profile=${{ env.AUDIT_PROFILE }}` locally to reproduce. | |
| - name: Post official audit comment (SIN-GitHub-Issues App) | |
| if: github.event_name == 'pull_request' && always() | |
| # Token resolution chain (highest priority first): | |
| # 1. SIN_GITHUB_INSTALLATION_TOKEN (org secret, App identity, public repos only) | |
| # 2. SIN_GITHUB_FALLBACK_TOKEN (repo secret, PAT — works on ALL repos incl. private) | |
| # 3. GITHUB_TOKEN (built-in, Action identity, always present) | |
| # Resolution happens inside post_audit_pr.py via github_app.get_token(). | |
| # If ALL tokens are missing, the step fails but continue-on-error prevents | |
| # the workflow from blocking on App issues. | |
| continue-on-error: true | |
| env: | |
| PYTHONPATH: ${{ steps.locate.outputs.skill_root }}/lib | |
| SIN_GITHUB_APP_CLIENT_ID: Iv23livllaHIBTdQdyhY | |
| # Chain of GitHub tokens (post_audit_pr.py picks the first available). | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SIN_GITHUB_FALLBACK_TOKEN: ${{ secrets.SIN_GITHUB_FALLBACK_TOKEN }} | |
| run: | | |
| # post_audit_pr.py ships in the canonical SIN-Code CEO Audit skill. | |
| # score.json is written by audit.sh to ~/ceo-audits/<repo>-ceo-audit-<runid>/score.json | |
| # We search both ceo-audit-output/ and ~/ceo-audits/ to be robust. | |
| SCORE_FILE=$(find $HOME/ceo-audits ceo-audit-output -name 'score.json' 2>/dev/null | head -1) | |
| if [ -z "$SCORE_FILE" ]; then | |
| echo "::warning::No score.json found — skipping App commenter (Action comment above still posts)" | |
| exit 0 | |
| fi | |
| echo "Using score.json: $SCORE_FILE" | |
| python3 ${{ steps.locate.outputs.skill_root }}/scripts/post_audit_pr.py \ | |
| --repo ${{ github.repository }} \ | |
| --pr ${{ github.event.pull_request.number }} \ | |
| --score-json "$SCORE_FILE" \ | |
| --artifact-url ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} \ | |
| --run-id ${{ github.run_id }} | |
| - name: Fail if grade below gate | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| GRADE="${{ steps.grade.outputs.grade }}" | |
| GRADE_NUM="${{ steps.grade.outputs.score || '0' }}" | |
| GATE="${{ env.AUDIT_GRADE }}" | |
| case "$GATE" in | |
| A) MIN=85 ;; | |
| B) MIN=70 ;; | |
| C) MIN=55 ;; | |
| *) MIN=0 ;; | |
| esac | |
| # Allow only A and B by default | |
| if (( $(echo "$GRADE_NUM < $MIN" | bc -l) )); then | |
| echo "::error::Grade $GRADE ($GRADE_NUM) below gate $GATE (need ≥$MIN)" | |
| exit 1 | |
| fi | |
| echo "::notice::Grade gate passed: $GRADE ($GRADE_NUM) ≥ $GATE ($MIN)" | |
| - name: Upload SARIF to Code Scanning | |
| if: always() && hashFiles('ceo-audit-output/report.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: ${{ github.workspace }}/ceo-audit-output/report.sarif | |
| category: ceo-audit | |
| continue-on-error: true | |
| # ─── Profile mirror drift gate (issue #175) ──────────────────────────── | |
| # Builds the Go binary from the same commit under audit and runs | |
| # `sin-code profile verify`. If the on-disk per-agent mirrors under | |
| # .claude/, .codex/, .cursor/, .github/, etc. have drifted off the | |
| # single source `docs/agent-profiles/sin-profile.md`, the job fails | |
| # the same way the verify-gate fails in `internal/verify` (M3). | |
| # | |
| # n8n-delegated per mandate M1 (see AGENTS.md §M1). Heavy work (go build, | |
| # profile render, profile verify) runs on the OCI free-tier VM via n8n. | |
| # The only runner-side work is a lightweight `go vet` pre-check (~2s). | |
| profile-verify: | |
| name: Profile verify (issue #175) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Trigger n8n webhook | |
| env: | |
| N8N_CI_WEBHOOK_URL: ${{ secrets.N8N_CI_WEBHOOK_URL }} | |
| run: | | |
| if [[ -z "$N8N_CI_WEBHOOK_URL" ]]; then | |
| echo "::error::N8N_CI_WEBHOOK_URL secret is not configured" | |
| exit 1 | |
| fi | |
| curl -fsS -X POST \ | |
| -H "Content-Type: application/json" \ | |
| -d "{\"workflow\":\"profile-verify\",\"ref\":\"${{ github.ref }}\",\"sha\":\"${{ github.sha }}\",\"repo\":\"${{ github.repository }}\",\"actor\":\"${{ github.actor }}\"}" \ | |
| "$N8N_CI_WEBHOOK_URL" | |
| - name: Local pre-check (go vet) | |
| run: | | |
| go version | |
| go vet ./cmd/sin-code/internal/profile/... | |
| echo "Heavy profile render/verify work delegated to n8n." |