Hyku branch - set up github actions, CI checks

.bundler-audit.yml

@@ -0,0 +1,83 @@
+# Hyku OOB baseline: advisories present in the current Gemfile.lock.
+# Do not bump gems solely to clear these — stay aligned with hyku/main.
+# New advisories (not listed here) should still fail CI.
+ignore:
+
+  # addressable (2.8.1) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-35611
+  - GHSA-h27x-rffw-24p4
+
+  # carrierwave (1.3.4) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2023-49090
+  - CVE-2024-29034
+  - CVE-2026-44587
+  - GHSA-7g26-2qgj-chfg
+  - GHSA-gxhx-g4fq-49hj
+  - GHSA-vfmv-jfc5-pjjw
+
+  # concurrent-ruby (1.3.4) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-54904
+  - CVE-2026-54905
+  - CVE-2026-54906
+  - GHSA-6wx8-w4f5-wwcr
+  - GHSA-h8w8-99g7-qmvj
+  - GHSA-wv3x-4vxv-whpp
+
+  # crass (1.0.6) — Hyku lockfile; ignore until upstream upgrades
+  - GHSA-6jxj-px6v-747w
+  - GHSA-6wmf-3r64-vcwv
+  - GHSA-8vfg-2r28-hvhj
+  - GHSA-wwpr-jff3-395c
+
+  # excon (0.71.1) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-54171
+  - GHSA-48rx-c7pg-q66r
+
+  # json (2.19.2) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-54696
+  - GHSA-x2f5-4prf-w687
+
+  # loofah (2.25.1) — Hyku lockfile; ignore until upstream upgrades
+  - GHSA-5qhf-9phg-95m2
+  - GHSA-8whx-365g-h9vv
+  - GHSA-9wjq-cp2p-hrgf
+
+  # oauth (1.1.2) — Hyku lockfile; ignore until upstream upgrades
+  - GHSA-prq8-7wvh-44qh
+
+  # oauth2 (1.4.11) — Hyku lockfile; ignore until upstream upgrades
+  - GHSA-pp92-crg2-gfv9
+
+  # rails-html-sanitizer (1.7.0) — Hyku lockfile; ignore until upstream upgrades
+  - GHSA-cj75-f6xr-r4g7
+
+  # secure_headers (7.1.0) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-54163
+  - GHSA-rqq5-2gf9-4w4q
+
+  # sinatra (2.2.4) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2024-21510
+  - CVE-2025-61921
+  - GHSA-hxx2-7vcw-mqr3
+  - GHSA-mr3q-g2mv-mr4q
+
+  # view_component (2.74.1) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2024-21636
+  - GHSA-wf2x-8w6j-qw37
+
+  # websocket-driver (0.8.0) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-54463
+  - CVE-2026-54464
+  - CVE-2026-54465
+  - GHSA-2x63-gw47-w4mm
+  - GHSA-33ph-fccm-39pj
+  - GHSA-8j3g-f24p-4mpw
+  - GHSA-ghhp-3qvg-889p
+
+  # yard (0.9.42) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-49342
+  - GHSA-pxcc-8665-phx8
+
+  # zlib (2.1.1) — Hyku lockfile; ignore until upstream upgrades
+  - CVE-2026-27820
+  - GHSA-g857-hhfv-j68w

.cursor/rules/pr-body-format.mdc

@@ -1,5 +1,5 @@
 ---
-description: PR body requests — raw markdown in a fenced block; default base hyku-oob
+description: PR body requests — raw markdown in a fenced block; base branch by naming
 alwaysApply: true
 ---
 
@@ -22,24 +22,26 @@ Return the body as **raw Markdown inside a single fenced code block** labeled `m
 
 ## Base branch for diff, commits, and summary
 
-Use the correct **compare base** when gathering `git log` / `git diff` for the PR body:
+Use the correct **compare base** when gathering `git log` / `git diff` for the PR body (and when creating PRs). Detect from the **current branch name** unless the user names a different target.
 
-### Default (Hyku upgrade work)
+| Current branch name | Compare / PR base | Notes |
+|---------------------|-------------------|--------|
+| Starts with `hyku` (e.g. `hyku-test-branch`, `hyku-oob-…`) | **`hyku-oob`** | Hyku upgrade / OOB work |
+| Anything else | **`develop`** | Scholar@UC feature work |
 
-- **Base branch:** `hyku-oob`
-- Use `hyku-oob...HEAD` (or `git log hyku-oob..HEAD`) unless the user specifies otherwise.
+Examples:
 
-### Other situations
+- `hyku-test-branch` → `git log hyku-oob..HEAD` / PR into `hyku-oob`
+- `fix-deposit-wizard` → `git log develop..HEAD` / PR into `develop`
 
-| Situation | Compare base | Typical PR target |
-|-----------|----------------|-------------------|
-| Feature branch cut from `hyku-oob` | `hyku-oob` | `hyku-oob` |
-| User says PR targets another branch | **That named branch** | As user specifies |
-| Work against `develop` / `main` | Ask once if unclear | As user specifies |
+### Overrides
 
-**Detecting base:** Prefer what the user states for this ticket. Optionally check `git rev-parse --abbrev-ref HEAD@{upstream}`.
+- If the user explicitly names a PR target or compare base, **use that**.
+- Optionally confirm with an open PR: `gh pr view --json baseRefName`.
 
 ### Do not assume
 
-- Do not use `main` or `develop` as the PR base for `hyku-oob` feature work unless the user says so.
+- **Do not** use `qa` — this app has no `qa` branch (unlike treatment_database).
+- **Do not** use `main` or `develop` as the base for branches whose names start with `hyku`.
+- **Do not** use `hyku-oob` as the base for branches that do **not** start with `hyku`.
 - Do not invent branch naming conventions — use the branch the user created.

.github/workflows/build-test-lint.yaml

@@ -1,5 +1,7 @@
 name: "build-test-lint"
 run-name: Build of ${{ github.ref_name }} by @${{ github.actor }}
+# Scholar@UC: this workflow publishes to ghcr.io/samvera/hyku. Only run on the
+# upstream Samvera repo — feature work on uclibs/ucrate uses .github/workflows/ci.yml.
 on:
   push:
     branches:
@@ -33,6 +35,7 @@ env:
 
 jobs:
   build:
+    if: github.repository == 'samvera/hyku'
     strategy:
       matrix:
         component: ["solr", "web", "worker"]
@@ -88,6 +91,7 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.component }}:${{ env.TAG }}-${{ env.PLATFORM_TAG }}
   push:
+    if: github.repository == 'samvera/hyku'
     needs: build
     runs-on: ubuntu-latest
     permissions: write-all
@@ -122,6 +126,7 @@ jobs:
           done
 
   lint:
+    if: github.repository == 'samvera/hyku'
     needs: push
     uses: notch8/actions/.github/workflows/lint.yaml@v1.0.6
     with:
@@ -130,13 +135,15 @@ jobs:
       rubocop_cmd: "bundle exec rubocop --parallel --format progress"
 
   test:
+    if: github.repository == 'samvera/hyku'
     needs: push
     uses: notch8/actions/.github/workflows/test.yaml@v1.0.6
     with:
       confdir: "/app/samvera/hyrax-webapp/solr/conf"
       rspec_cmd: "gem install semaphore_test_boosters && bundle && rspec_booster --job $CI_NODE_INDEX/$CI_NODE_TOTAL"
 
   single-tenant-test:
+    if: github.repository == 'samvera/hyku'
     needs: push
     runs-on: ubuntu-latest
     defaults:
@@ -234,6 +241,7 @@ jobs:
         run: docker compose -f docker-compose.single.yml down -v --remove-orphans
 
   env-file-lint:
+    if: github.repository == 'samvera/hyku'
     # Guard against a regression class: `${VAR}` shell interpolation of any
     # form placed inside `.env`. It is not reliably expanded through env_file:
     # the `${VAR:-default}` form is only handled on newer Compose (>= ~2.24),
@@ -263,6 +271,6 @@ jobs:
           echo "No \${...} interpolation found in .env"
 
   reports:
-    if: always()
+    if: always() && github.repository == 'samvera/hyku'
     needs: [test, lint, single-tenant-test]
     uses: notch8/actions/.github/workflows/report.yaml@v1.0.6