From f6420898a072f20d8761365e348fb4a8d504cc8a Mon Sep 17 00:00:00 2001 From: Shinrai Date: Sun, 19 Jul 2026 15:53:28 -0700 Subject: [PATCH 1/2] fix: self-reference workflow headers instead of pointing at .github's examples These 18 workflow files were bootstrapped from CLDMV/.github's example templates but never had their @Project/@Filename header stamps updated to point at this repo - they still read @cldmv/.github and the example's own examples/individual-repo-workflows// path. Correct them to self-reference @cldmv/git-embedded and this repo's actual .github/workflows/ path, matching the convention already used in fix-headers and slothlet. --- .github/workflows/branch-retention.yml | 4 ++-- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/dependabot-auto-merge.yml | 4 ++-- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/hotfix-redirector.yml | 4 ++-- .github/workflows/hotfixes-release.yml | 4 ++-- .github/workflows/labeler.yml | 4 ++-- .github/workflows/master-commit-audit.yml | 4 ++-- .github/workflows/next-release.yml | 4 ++-- .github/workflows/next-reset.yml | 4 ++-- .github/workflows/pr-title-normalizer.yml | 4 ++-- .github/workflows/publish.yml | 4 ++-- .github/workflows/stale.yml | 4 ++-- .github/workflows/tag-health.yml | 4 ++-- .github/workflows/update-major-version-tags.yml | 4 ++-- .github/workflows/v4-bootstrap.yml | 4 ++-- .github/workflows/welcome.yml | 4 ++-- 18 files changed, 36 insertions(+), 36 deletions(-) diff --git a/.github/workflows/branch-retention.yml b/.github/workflows/branch-retention.yml index 14df9e4..a461ae9 100644 --- a/.github/workflows/branch-retention.yml +++ b/.github/workflows/branch-retention.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/automation/branch-retention.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/branch-retention.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4c0de34..49dad7c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/core-cicd/ci.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/ci.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index faed0f4..69e7f17 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/security/codeql.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/codeql.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 654e8a3..d68cf6a 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/automation/dependabot-auto-merge.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/dependabot-auto-merge.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 82a55c9..b69898a 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/security/dependency-review.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/dependency-review.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/hotfix-redirector.yml b/.github/workflows/hotfix-redirector.yml index c45bdbd..79383d5 100644 --- a/.github/workflows/hotfix-redirector.yml +++ b/.github/workflows/hotfix-redirector.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfix-redirector.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/hotfix-redirector.yml # @Date: 2026-05-22 00:00:00 -07:00 (1779778800) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/hotfixes-release.yml b/.github/workflows/hotfixes-release.yml index eee6f79..d7cfeea 100644 --- a/.github/workflows/hotfixes-release.yml +++ b/.github/workflows/hotfixes-release.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfixes-release.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/hotfixes-release.yml # @Date: 2026-05-22 00:00:00 -07:00 (1779778800) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 3e8b8f0..72cbbbc 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/automation/labeler.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/labeler.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/master-commit-audit.yml b/.github/workflows/master-commit-audit.yml index 4be375f..ad6b2e8 100644 --- a/.github/workflows/master-commit-audit.yml +++ b/.github/workflows/master-commit-audit.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-companions/master-commit-audit.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/master-commit-audit.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/next-release.yml b/.github/workflows/next-release.yml index 915b5d7..bf0c701 100644 --- a/.github/workflows/next-release.yml +++ b/.github/workflows/next-release.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/next-release.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/next-release.yml # @Date: 2026-05-22 00:00:00 -07:00 (1779778800) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/next-reset.yml b/.github/workflows/next-reset.yml index d47f046..f19a665 100644 --- a/.github/workflows/next-reset.yml +++ b/.github/workflows/next-reset.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/next-reset.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/next-reset.yml # @Date: 2026-05-22 00:00:00 -07:00 (1779778800) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/pr-title-normalizer.yml b/.github/workflows/pr-title-normalizer.yml index 25c8d85..f7dd668 100644 --- a/.github/workflows/pr-title-normalizer.yml +++ b/.github/workflows/pr-title-normalizer.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/pr-title-normalizer.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/pr-title-normalizer.yml # @Date: 2026-05-22 00:00:00 -07:00 (1779778800) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a214219..9914a0b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/core-cicd/publish.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/publish.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index bdcabbd..989998e 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/automation/stale.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/stale.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/tag-health.yml b/.github/workflows/tag-health.yml index 80701a5..cccf512 100644 --- a/.github/workflows/tag-health.yml +++ b/.github/workflows/tag-health.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-companions/tag-health.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/tag-health.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/update-major-version-tags.yml b/.github/workflows/update-major-version-tags.yml index cabcb26..aa0b7bc 100644 --- a/.github/workflows/update-major-version-tags.yml +++ b/.github/workflows/update-major-version-tags.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/core-cicd/update-major-version-tags.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/update-major-version-tags.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/v4-bootstrap.yml b/.github/workflows/v4-bootstrap.yml index d8c86c2..095200d 100644 --- a/.github/workflows/v4-bootstrap.yml +++ b/.github/workflows/v4-bootstrap.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/v4-bootstrap.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/v4-bootstrap.yml # @Date: 2026-05-26 00:00:00 -07:00 (1780124400) # @Author: Nate Corcoran # @Email: diff --git a/.github/workflows/welcome.yml b/.github/workflows/welcome.yml index b414467..e45d095 100644 --- a/.github/workflows/welcome.yml +++ b/.github/workflows/welcome.yml @@ -1,6 +1,6 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/automation/welcome.yml +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/welcome.yml # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) # @Author: Nate Corcoran # @Email: From 6e8d89f7c8c3cbbab4ba5f4d5cc405c949714412 Mon Sep 17 00:00:00 2001 From: Shinrai Date: Sun, 19 Jul 2026 15:53:33 -0700 Subject: [PATCH 2/2] ci: add cla, release-notify, and scorecard workflows This repo publishes to npm the same as fix-headers and slothlet, but was missing three workflows both of those have: CLA signing, release-announcement webhooks, and OpenSSF Scorecard. Add all three, matching the current templates - scorecard.yml already carries the job-scoped permissions fix (workflow-level permissions trip scorecard-action's own publish-time verification). --- .github/workflows/cla.yml | 60 +++++++++++++++++++++++++++ .github/workflows/release-notify.yml | 37 +++++++++++++++++ .github/workflows/scorecard.yml | 61 ++++++++++++++++++++++++++++ 3 files changed, 158 insertions(+) create mode 100644 .github/workflows/cla.yml create mode 100644 .github/workflows/release-notify.yml create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml new file mode 100644 index 0000000..8ea1b5a --- /dev/null +++ b/.github/workflows/cla.yml @@ -0,0 +1,60 @@ +# +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/cla.yml +# @Date: 2026-07-19 00:00:00 -07:00 (1784523600) +# @Author: Nate Corcoran +# @Email: +# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. +# + +# Individual repo: .github/workflows/cla.yml +# +# Per-CLA-version signing with per-repo override support. Each commit author +# must either: +# - Be in the org (silent pass via /orgs/CLDMV/members lookup) +# - Be in the exempt-bots list +# - Already have a signature record at the active (scope, version) in the +# central ledger repo (default: CLDMV/.cla-signatures) +# - Reply on this PR with the exact required text +# +# Default vs. override scope: +# - DEFAULT (this repo has NO root-level CLA.md): the bot uses the org-wide +# CLA at cla-versions/v.md in the ledger. Signing once covers every +# CLDMV repo that uses the default until the major.minor is bumped. +# - OVERRIDE (this repo HAS a root-level CLA.md): the bot enforces the +# consumer-repo text and reads the version from its header. Signatures +# live under signatures//overrides///v/ and +# are scoped to this repo only. +# +# Required setup: +# - Bot App must have `Organization permissions → Members: read` for the +# org-member exemption. +# - Bot App must have `Repository contents: write` on the ledger repo. +# - Optional `CLDMV_CLA_BOT_APP_CLIENT_ID` / `CLDMV_CLA_BOT_APP_PRIVATE_KEY` +# org secrets override the general bot identity for CLA actions only. +name: 📜 CLA + +on: + pull_request_target: + types: [opened, synchronize, reopened, ready_for_review] + issue_comment: + types: [created] + +permissions: + contents: read + pull-requests: write + statuses: write + issues: write + +jobs: + cla: + uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4 + with: + cla_version: "1.0" + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} + CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }} + CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }} + TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }} + TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }} diff --git a/.github/workflows/release-notify.yml b/.github/workflows/release-notify.yml new file mode 100644 index 0000000..8956a1e --- /dev/null +++ b/.github/workflows/release-notify.yml @@ -0,0 +1,37 @@ +# +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/release-notify.yml +# @Date: 2026-07-19 00:00:00 -07:00 (1784523600) +# @Author: Nate Corcoran +# @Email: +# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. +# + +# Individual repo: .github/workflows/release-notify.yml +# +# Fires on `release: published` and dispatches the release announcement to +# any enabled webhook. No config file — each channel is just a secret: +# +# DISCORD_RELEASES_PUBLIC_WEBHOOK / DISCORD_RELEASES_PRIVATE_WEBHOOK +# SLACK_RELEASES_PUBLIC_WEBHOOK / SLACK_RELEASES_PRIVATE_WEBHOOK +# GENERIC_RELEASES_PUBLIC_WEBHOOK / GENERIC_RELEASES_PRIVATE_WEBHOOK +# +# Visibility is determined automatically from the repo: GitHub `public` → +# PUBLIC, `private` or `internal` → PRIVATE. Set the org-level secret in +# CLDMV for the default URL; set a repo-level secret with the same name to +# override (or to an empty string to mute that channel for this repo). +name: 📣 Release Notify + +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + notify: + # Defensive: skip untagged releases (mirrors Batch 1.2's filter) + if: github.event.release.tag_name != '' + uses: CLDMV/.github/.github/workflows/reusable-release-notifier.yml@v4 + secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..cb99eaf --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,61 @@ +# +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/scorecard.yml +# @Date: 2026-07-19 00:00:00 -07:00 (1784523600) +# @Author: Nate Corcoran +# @Email: +# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. +# + +# Individual repo: .github/workflows/scorecard.yml +# +# OpenSSF Scorecard — scans the repo against ~18 security best-practice checks +# and produces a 0-10 score. Thin caller: the steps and the SHA-pinned +# scorecard-action version live in reusable-scorecard.yml@v4, so the action +# version can't drift in this copy (it just calls the org reusable). Triggers +# stay here, per OpenSSF's recommended setup. +# +# NOTE: this MUST stay a thin caller. OSSF Scorecard's publish step verifies +# the analysis job and allows only a fixed set of steps; the inline form used +# our checkout-code composite, which trips "job has unallowed step" -> publish +# HTTP 400. The reusable uses actions/checkout directly, which passes. +name: 🔬 OpenSSF Scorecard + +on: + branch_protection_rule: + schedule: + - cron: "32 7 * * 1" # weekly Monday 07:32 UTC + push: + branches: [master, main] + workflow_dispatch: + +# Caller must grant what the reusable needs — notably id-token: write for the +# OpenSSF transparency-log publish. +# +# No workflow-level `permissions:` here — grant on the `analyze` job below +# instead. scorecard-action's publish step verifies that write permissions +# were granted JOB-scoped, not workflow-wide (matching OSSF's own example: +# https://github.com/ossf/scorecard-action#example-workflow). A workflow-level +# grant satisfies GitHub's own reusable-workflow permission rules fine, but +# still trips scorecard-action's own check — the rejection ("workflow +# verification failed: global perm is set to write: permission for X is set +# to write") means "granted globally," not "forbidden." +# +# Do NOT add security-events: write here while publish_results: true below. +# scorecard-action's publish step rejects submissions from a workflow whose +# token has security-events write access (it verifies the caller can't have +# tampered with results before they hit the public transparency log). That +# trade-off means the reusable's own SARIF-to-Security-tab upload step has no +# permission to run in this configuration; the public OpenSSF badge is the +# thing actually enabled here, so this repo takes that trade-off. Only add +# security-events: write back (job-scoped) if publish_results is set to false +# instead. +jobs: + analyze: + permissions: + id-token: write + contents: read + actions: read + uses: CLDMV/.github/.github/workflows/reusable-scorecard.yml@v4 + with: + publish_results: true # set false for private repos / to skip the public badge