feat(ci): SARIF output and a GitHub Action that gates trust, cost, and drift

[singhharsh1708]

What

Everything Kitbash checks was previously something one maintainer ran locally and everyone else took on trust. This makes it a required check on the pull request.

kitbash lint --sarif <file> — writes findings as SARIF 2.1.0, so results land in the Security tab and as inline PR annotations instead of scrolling past in a log.

• Hard-fail safety lints (remote-exec, visible-text, dynamic-context, secrets) → error
• Heuristics and budget/standing overruns → warning
• Passing checks are not emitted — a clean run produces a valid empty report, not noise
• Locations are repo-relative with forward slashes, so the same report works on any runner
• Written even when the lint fails (that's the run whose findings must reach the Security tab), and never outside the project (exit 2)

A composite GitHub Action — singhharsh1708/kitbash@v0.18.0, one step, three checks:

Check	Fails when
Trust	A skill trips a hard safety lint
Cost	A skill exceeds the token budget or standing limit it declares
Drift	kitbash compile changes the working tree

Drift is the one competitors don't have. A skill compiles to eleven targets; nothing stops someone hand-editing a generated .cursor/rules/*.mdc, or changing the source and forgetting to recompile — then each agent reads something different and nobody finds out. Competing scanners emit SARIF for skill content; none also measures token cost or catches source-vs-output drift.

Two bugs caught while writing it

• GitHub runs shell: bash with -e, so a bare [ test ] && args+=(...) returns 1 when the test is false and fails the step instead of skipping the flag. Both conditionals are now full if blocks, and the array expands as ${args[@]+"${args[@]}"} so an empty array is safe.
• git diff --exit-code misses newly created untracked files, so a target compiled for the first time would pass silently. Drift now checks git status --porcelain.

Verification

• 16 new tests (SARIF shape, severity mapping, empty-report case, path-traversal refusal, forward-slash locations, exit codes). Full suite green.
• Both shell paths simulated under bash -e, including the empty-array case.
• Both YAML files parse; the exact CI command runs clean against our own example skill (0 findings, exit 0).
• CI dogfoods the SARIF path with the locally built CLI — npm hasn't seen this version at PR time.

Ships as 0.18.0.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kitbash	Ready	Preview	Aug 9, 2026 6:51pm

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.