Repository navigation
1.16.1: triage #128 — fail-closed CI scaffold, deny list, live-sync check - #129
Merged
Merged
Conversation
…mmit) Separate commit, as the refreshed standard asks for settings edits: adds the loop's MCP PR/CI tools, the test runner and web lookups to `allow`, and the new `deny` list (force-push, push to main, tag pushes, gh release create, admin merge, workflow disable). Written by bootstrap-repo.sh --portka-standard --scope project; append-only, nothing removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015M7QWFzt9NnWmSmNQXj1mM
…heck
repo-bootstrap 1.16.1:
- Scaffolded validate.yml / portka-standard.yml fail CLOSED (plain
`bash tests/run-tests.sh`), `permissions: contents: read`, checkout@v7 with
persist-credentials: false, setup-node@v7, workflow_dispatch.
- --portka-standard allowlist matches the loop it pre-authorizes (test runner,
GitHub MCP PR/CI/issue tools, WebSearch/WebFetch) and writes an append-only
`permissions.deny` for what the standard forbids; `:*` word-boundary keeps
--force-with-lease allowed. Prints a main-ruleset hint, the primary-repo
settings caveat, and a private-vulnerability-reporting hint when relevant.
- SessionStart hook: absolute, copy-pasteable heal command + "ask once";
new read-only job flags stale CI scaffolds' specific gaps.
- Managed block (stamp 1.16.1): fail-closed + strict checks, holding a push,
Pages dot-path/include-hidden-files guidance, --force-with-lease as the normal
push when branches survive merges, settings.json primary-directory note.
- hooks.json quotes ${CLAUDE_PLUGIN_ROOT} (strict validate rejects unquoted).
app-website-evaluator 1.16.1: --dir warns when the repo's Pages workflow
uploads without include-hidden-files (security.txt in tree != on site).
video-bug-analyzer 1.16.1: hooks.json quoting only.
Repo: version-bump-guard treats a plugin version as released when ANY v* tag
carries it (repo-bootstrap 1.15.1 shipped in v1.16.0 untagged by its own
number); scripts/verify-live.sh post-merge live-sync check (raw files, clean
install in a throwaway HOME, community catalog status) + RELEASING step;
own workflows on checkout v7 / read-only token; submission manifest synced
and suite-enforced; HANDOFF/IMPROVEMENTS refreshed; tests for all of it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015M7QWFzt9NnWmSmNQXj1mM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Triage of #128 (the report plus both follow-up comments) and a general fine-tune pass. PATCH 1.16.1: repo-bootstrap, app-website-evaluator and video-bug-analyzer move to 1.16.1; tab-chord-formatter is unchanged.
repo-bootstrap
tests/run-tests.shnow turns CI red instead of echoing "nothing to validate".permissions: contents: read,checkout@v7withpersist-credentials: false,setup-node@v7(Node 24; I checked the tags) andworkflow_dispatch.gh apiand interpreters stay out.permissions.denyblocks force-push, pushes tomain, tag pushes,gh release create,gh pr merge --adminandgh workflow disable.:*matches at a word boundary, so--force-with-leaseis still allowed (tested).mainruleset hint; the caveat that settings load only from the session's primary repo; and a private-vulnerability-reporting hint when the security contact links toadvisories/new.include-hidden-files, staged_site/, action majors, job-scoped perms) and network allowance for third-party hosts;--force-with-leaseis the normal push when branches survive merges; settings edits go in their own commit.${CLAUDE_PLUGIN_ROOT}. The currentclaude plugin validate --strictrejects the unquoted form. This also affects video-bug-analyzer, and that is its only change.app-website-evaluator. In
--dirmode, when the repo's Pages workflow uploads withoutinclude-hidden-files: true, the evaluator warns that/.well-known/is not published instead of creditingsecurity.txt.Repo
v*tag's tree carries it. Tags are repo releases, so repo-bootstrap 1.15.1 had shipped in v1.16.0 while reading as unreleased.scripts/verify-live.sh(new step 6 in RELEASING §1) checks:claude plugin installof every plugin in a throwaway HOME: version, byte-identical files, scripts run;--pagesspec,--refresh-ci, browser-test scaffold, network-host hint, tracker-blocked forms.Closes #128 (deferred parts recorded in IMPROVEMENTS.md).
Release checklist
versionin.claude-plugin/plugin.jsonfor each plugin whose files changed: repo-bootstrap, app-website-evaluator and video-bug-analyzer → 1.16.1. AlsoVBA_VERSIONand the submission manifest.## [1.16.1]entry toCHANGELOG.md, plus the footer link.bash tests/run-tests.shlocally: 324 passed, 0 failed, 1 skipped. shellcheck is clean, andclaude plugin validate --strictpasses for the marketplace and all four plugins.🤖 Generated with Claude Code
https://claude.ai/code/session_015M7QWFzt9NnWmSmNQXj1mM
Generated by Claude Code