chore(agentops): onboard policy federation artifacts by KooshaPari · Pull Request #838 · KooshaPari/cliproxyapi-plusplus

KooshaPari · 2026-03-02T12:00:48Z

Scope\n- Add repository-level policy federation onboarding artifacts for AgentOps.\n- Include docs and extension policy sync metadata.\n\n## Notes\nGenerated from shared policy package.

Summary by CodeRabbit

New Features
- Added a Main Pipeline to run lint, docs, tests, and staged deploy/PR steps.
- Added a Security Guard workflow to run secret scans and pre-commit checks on PRs and pushes.
CI
- Restricted docs deploy to the main branch; minor workflow naming/guard improvements.
Chores
- Removed a large collection of internal documentation, templates, prompts, and planning/acceptance helper utilities.

Co-authored-by: Codex <noreply@openai.com>

Sync harness/task-domain policy onboarding artifacts into cliproxyapi++. Co-authored-by: Codex <noreply@openai.com>

coderabbitai · 2026-03-02T12:01:01Z

📝 Walkthrough

Walkthrough

Adds two GitHub Actions workflows and a security scan script; updates CI required-checks and minor workflow guards; and deletes a large set of spec-kitty documentation, prompt files, mission templates, ignore/config files, and multiple task/acceptance Python modules and shims.

Changes

Cohort / File(s)	Summary
Main CI Workflow `.airlock/workflows/main.yml`	Adds an Airlock-driven "Main Pipeline" GH Actions workflow (rebase, lint/fix, freeze, describe, document, test, gated push, create PR).
Security Guard Workflow & Script `.github/workflows/security-guard.yml`, `.github/scripts/security-guard.sh`	Adds "Security Guard" workflow and a Bash script to run ggshield/pre-commit scans and optional codespell checks on changed files.
CI Required Checks & Guards `.github/required-checks.txt`, `.github/workflows/pr-path-guard.yml`, `.github/workflows/docs.yml`	Updates required-checks list; adds job name to pr-path-guard; restricts Deploy Pages to main branch.
Repository Ignore / Assistant Guidance Removed `.claudeignore`, `.cursorignore`, `.github/copilot-instructions.md`	Deletes ignore/config and Copilot instruction files.
Spec-Kitty: Docs & Prompts Removed `.cursor/commands/`, `.github/prompts/spec-kitty`, `.kilocode/workflows/*`	Removes numerous spec-kitty command docs and prompt specification files (accept, analyze, checklist, clarify, plan, research, tasks, implement, merge, review, dashboard, status, etc.).
Spec-Kitty: Missions, Templates & Metadata Removed `.kittify/missions/`, `.kittify/missions//templates/*`, `.kittify/.dashboard`, `.kittify/metadata.yaml`	Deletes mission YAMLs, command templates, documentation templates, generator templates, dashboard config, and metadata.
Spec-Kitty: Script Libraries Removed `.kittify/scripts/tasks/acceptance_core.py`, `.kittify/scripts/tasks/acceptance_support.py`, `.kittify/scripts/tasks/task_helpers.py`, `.kittify/scripts/tasks/task_helpers_shared.py`, `.kittify/scripts/debug-dashboard-scan.py`	Removes Python modules providing acceptance core/support logic, task helper shared library, shim re-exports, and a debug utility — many public classes/functions deleted.
Documentation Templates Removed `.kilocode/workflows/`, `.kittify/missions/documentation/templates/`, `.kittify/missions//templates/`	Removes multiple documentation mission templates and divio-style templates (explanation, howto, reference, tutorial, plan, release, spec, tasks, prompts).

Sequence Diagram(s)

sequenceDiagram
    participant Dev as Developer (push/PR)
    participant GH as GitHub Actions
    participant Airlock as airlock/actions
    participant Repo as Repository
    participant Upstream as Upstream Remote
    participant PreCommit as pre-commit/action (ggshield/codespell)

    Note over Dev,GH: Main Pipeline (push)
    Dev->>GH: push event
    GH->>Airlock: run rebase step
    Airlock-->>Repo: apply rebase/commits
    GH->>Airlock: lint/format & generate patch
    Airlock-->>Repo: commit fixes / create patch
    GH->>Airlock: freeze/describe/document/update-docs
    GH->>GH: run tests
    GH->>Upstream: gated push (requires approval)
    GH->>Upstream: create PR

    Note over Dev,PreCommit: Security Guard (pull_request / push)
    Dev->>GH: pull_request / push event
    GH->>PreCommit: checkout + run pre-commit hooks
    PreCommit-->>GH: report failures/diffs

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

ci: fix merge-conflict markers in CI guard files #610 — updates CI required-checks and related guard configurations (strong overlap with required-checks and pr-path-guard changes).
ci: fix workflow required-check names for feat/cliproxy-service-runtime-worktree #513 — adjusts CI workflow job naming and required-check entries (related CI/job-naming changes).
feat(deps): migrate auth imports from phenotype-go-kit to phenotype-go-auth #827 — similar Airlock main pipeline additions (overlap in CI workflow design and steps).

Poem

🐰 I hopped through branches, sniffed the trees,
Found workflows new and old docs eased,
Guards awake to scan for secrets tight,
Old templates vanished into night,
I thumped my foot — CI hums just right.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title describes onboarding policy federation artifacts for AgentOps, but the changeset consists primarily of deletions (file removals) with only minimal additions to workflow files, representing a massive cleanup of spec-kitty and kittify infrastructure rather than policy federation onboarding.	Clarify whether this PR focuses on policy federation onboarding (as the title suggests) or infrastructure cleanup/removal. If cleanup-focused, retitle to 'chore: remove spec-kitty and kittify infrastructure' or similar. If policy-federation-focused, separate the infrastructure removals into a distinct PR.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings (stacked PR)
📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch agentops/policy-federation-onboard

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-03-02T12:01:13Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the repository's development infrastructure by introducing automated CI/CD workflows and robust security checks. It streamlines the integration of new code, ensures adherence to quality standards, and proactively identifies potential security vulnerabilities, thereby improving overall code health and operational efficiency.

Highlights

AgentOps Policy Federation: Onboarded repository-level policy federation artifacts specifically for AgentOps, enhancing compliance and management.
CI/CD Workflow Integration: Integrated a new Airlock workflow (.airlock/workflows/main.yml) to automate linting, testing, documentation updates, and deployment processes.
Security and Code Quality Checks: Added a security-guard.sh script to perform secret scanning using ggshield and optional spell checking with codespell on changed files.

Changelog

.airlock/workflows/main.yml
- Added a new Airlock workflow definition for continuous integration and deployment, including steps for rebase, linting, freezing, describing, documenting, testing, pushing, and creating pull requests.
.github/scripts/security-guard.sh
- Introduced a new shell script to automate security scanning for secrets using ggshield and provide optional spell checking for various file types using codespell.

Ignored Files

Ignored by pattern: .github/workflows/** (1)
- .github/workflows/security-guard.yml

Activity

No specific activity has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds new configuration files for an Airlock workflow and a security guard script. While no vulnerabilities meeting the required severity threshold were identified, it's important to address a security risk in the Airlock workflow where GitHub Actions are using the main branch; it's recommended to pin them to specific commit SHAs. Additionally, a bug was found in the security-guard.sh script where filenames with spaces are not handled correctly, and a more robust implementation is suggested.

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+    steps:
+      # Rebase onto upstream to handle drift
+      - name: rebase
+        uses: airlock-hq/airlock/defaults/rebase@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/rebase@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+
+      # Run linters and formatters, auto-fix issues
+      - name: lint
+        uses: airlock-hq/airlock/defaults/lint@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/lint@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+
+      # Generate PR title and description from the diff
+      - name: describe
+        uses: airlock-hq/airlock/defaults/describe@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/describe@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+
+      # Update documentation to reflect changes
+      - name: document
+        uses: airlock-hq/airlock/defaults/document@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/document@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+
+      # Run tests
+      - name: test
+        uses: airlock-hq/airlock/defaults/test@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/test@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+
+      # Push changes to upstream (pauses for user approval first)
+      - name: push
+        uses: airlock-hq/airlock/defaults/push@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/push@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.airlock/workflows/main.yml

+
+      # Create pull/merge request
+      - name: create-pr
+        uses: airlock-hq/airlock/defaults/create-pr@main


For security and stability, it's recommended to pin GitHub Actions to a specific commit SHA instead of a branch like main. Using a branch means the action can change without notice, potentially breaking your workflow or introducing malicious code. Please replace @main with a full-length commit SHA.

uses: airlock-hq/airlock/defaults/create-pr@<commit-sha>

gemini-code-assist · 2026-03-02T12:03:25Z

.github/scripts/security-guard.sh

+  changed_files=$(git diff --cached --name-only --diff-filter=ACM || true)
+  if [ -z "${changed_files}" ]; then
+    changed_files=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true)
+  fi
+
+  if [ -n "${changed_files}" ]; then
+    echo "[security-guard] Running optional codespell fast pass"
+    echo "${changed_files}" |       grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' |       xargs -r codespell -q 2 -L "hte,teh" || true
+  fi


The current method of piping filenames to xargs is not robust as it will fail for filenames containing spaces. It's better to read the files into an array and then pass them to codespell. This ensures that filenames are handled correctly.

Suggested change

changed_files=$(git diff --cached --name-only --diff-filter=ACM || true)

if [ -z "${changed_files}" ]; then

changed_files=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true)

fi

if [ -n "${changed_files}" ]; then

echo "[security-guard] Running optional codespell fast pass"

echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | xargs -r codespell -q 2 -L "hte,teh" || true

fi

changed_files_list=$(git diff --cached --name-only --diff-filter=ACM || true)

if [ -z "${changed_files_list}" ]; then

changed_files_list=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true)

fi

if [ -n "${changed_files_list}" ]; then

echo "[security-guard] Running optional codespell fast pass"

files_to_check=()

while IFS= read -r file; do

case "$file" in

*.md|*.txt|*.py|*.ts|*.tsx|*.js|*.go|*.rs|*.kt|*.java|*.yaml|*.yml)

files_to_check+=("$file")

;;

esac

done <<< "${changed_files_list}"

if [ ${#files_to_check[@]} -gt 0 ]; then

codespell -q 2 -L "hte,teh" "${files_to_check[@]}" || true

fi

fi

Copilot

Pull request overview

Adds repository-level automation artifacts intended for AgentOps onboarding by introducing security guard CI checks and an Airlock pipeline configuration, while removing a large set of previously committed Spec Kitty/Kittify mission templates, prompts, and editor workflow files.

Changes:

Add a GitHub Actions “Security Guard” workflow to run pre-commit checks on PRs and pushes.
Add a security-guard.sh helper script for secret scanning (ggshield) and optional codespell.
Remove various .kittify/, .kilocode/, .cursor/, and .github/prompts/ mission templates and workflow prompt artifacts.

Reviewed changes

Copilot reviewed 104 out of 117 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
.kittify/scripts/tasks/task_helpers.py	Removed legacy Spec Kitty helper re-export module.
.kittify/scripts/tasks/acceptance_support.py	Removed legacy acceptance support script wrapper.
.kittify/scripts/debug-dashboard-scan.py	Removed standalone dashboard scan debug script.
.kittify/missions/software-dev/templates/tasks-template.md	Removed software-dev tasks template.
.kittify/missions/software-dev/templates/task-prompt-template.md	Removed software-dev task prompt template.
.kittify/missions/software-dev/templates/spec-template.md	Removed software-dev spec template.
.kittify/missions/software-dev/templates/plan-template.md	Removed software-dev plan template.
.kittify/missions/software-dev/mission.yaml	Removed software-dev mission definition.
.kittify/missions/software-dev/command-templates/review.md	Removed software-dev review command template.
.kittify/missions/software-dev/command-templates/plan.md	Removed software-dev plan command template.
.kittify/missions/software-dev/command-templates/implement.md	Removed software-dev implement command template.
.kittify/missions/software-dev/command-templates/dashboard.md	Removed software-dev dashboard command template.
.kittify/missions/software-dev/command-templates/clarify.md	Removed software-dev clarify command template.
.kittify/missions/software-dev/command-templates/analyze.md	Removed software-dev analyze command template.
.kittify/missions/software-dev/command-templates/accept.md	Removed software-dev accept command template.
.kittify/missions/research/templates/tasks-template.md	Removed research tasks template.
.kittify/missions/research/templates/task-prompt-template.md	Removed research task prompt template.
.kittify/missions/research/templates/spec-template.md	Removed research spec template.
.kittify/missions/research/templates/research/source-register.csv	Removed research source-register template CSV.
.kittify/missions/research/templates/research/evidence-log.csv	Removed research evidence-log template CSV.
.kittify/missions/research/templates/research-template.md	Removed research decision-log template.
.kittify/missions/research/templates/plan-template.md	Removed research plan template.
.kittify/missions/research/templates/data-model-template.md	Removed research data-model template.
.kittify/missions/research/mission.yaml	Removed research mission definition.
.kittify/missions/research/command-templates/tasks.md	Removed research tasks command template.
.kittify/missions/research/command-templates/specify.md	Removed research specify command template.
.kittify/missions/research/command-templates/review.md	Removed research review command template.
.kittify/missions/research/command-templates/plan.md	Removed research plan command template.
.kittify/missions/research/command-templates/implement.md	Removed research implement command template.
.kittify/missions/documentation/templates/tasks-template.md	Removed documentation tasks template.
.kittify/missions/documentation/templates/task-prompt-template.md	Removed documentation task prompt template.
.kittify/missions/documentation/templates/spec-template.md	Removed documentation spec template.
.kittify/missions/documentation/templates/release-template.md	Removed documentation release template.
.kittify/missions/documentation/templates/generators/sphinx-conf.py.template	Removed Sphinx generator template.
.kittify/missions/documentation/templates/generators/jsdoc.json.template	Removed JSDoc generator template.
.kittify/missions/documentation/templates/divio/tutorial-template.md	Removed Divio tutorial template.
.kittify/missions/documentation/templates/divio/reference-template.md	Removed Divio reference template.
.kittify/missions/documentation/templates/divio/howto-template.md	Removed Divio how-to template.
.kittify/missions/documentation/templates/divio/explanation-template.md	Removed Divio explanation template.
.kittify/missions/documentation/mission.yaml	Removed documentation mission definition.
.kittify/missions/documentation/command-templates/tasks.md	Removed documentation tasks command template.
.kittify/missions/documentation/command-templates/specify.md	Removed documentation specify command template.
.kittify/metadata.yaml	Removed Spec Kitty metadata file.
.kittify/.dashboard	Removed local dashboard state file.
.kilocode/workflows/spec-kitty.status.md	Removed kilocode status workflow prompt.
.kilocode/workflows/spec-kitty.review.md	Removed kilocode review workflow prompt.
.kilocode/workflows/spec-kitty.research.md	Removed kilocode research workflow prompt.
.kilocode/workflows/spec-kitty.plan.md	Removed kilocode plan workflow prompt.
.kilocode/workflows/spec-kitty.implement.md	Removed kilocode implement workflow prompt.
.kilocode/workflows/spec-kitty.dashboard.md	Removed kilocode dashboard workflow prompt.
.kilocode/workflows/spec-kitty.clarify.md	Removed kilocode clarify workflow prompt.
.kilocode/workflows/spec-kitty.analyze.md	Removed kilocode analyze workflow prompt.
.kilocode/workflows/spec-kitty.accept.md	Removed kilocode accept workflow prompt.
.github/workflows/security-guard.yml	Added CI workflow to run pre-commit guard checks.
.github/scripts/security-guard.sh	Added helper script for ggshield scan + optional codespell.
.github/prompts/spec-kitty.status.prompt.md	Removed GitHub prompt artifact for spec-kitty status.
.github/prompts/spec-kitty.review.prompt.md	Removed GitHub prompt artifact for spec-kitty review.
.github/prompts/spec-kitty.research.prompt.md	Removed GitHub prompt artifact for spec-kitty research.
.github/prompts/spec-kitty.plan.prompt.md	Removed GitHub prompt artifact for spec-kitty plan.
.github/prompts/spec-kitty.implement.prompt.md	Removed GitHub prompt artifact for spec-kitty implement.
.github/prompts/spec-kitty.dashboard.prompt.md	Removed GitHub prompt artifact for spec-kitty dashboard.
.github/prompts/spec-kitty.clarify.prompt.md	Removed GitHub prompt artifact for spec-kitty clarify.
.github/prompts/spec-kitty.analyze.prompt.md	Removed GitHub prompt artifact for spec-kitty analyze.
.github/prompts/spec-kitty.accept.prompt.md	Removed GitHub prompt artifact for spec-kitty accept.
.github/copilot-instructions.md	Removed repository Copilot instruction file.
.cursorignore	Removed Cursor ignore rules file.
.cursor/commands/spec-kitty.status.md	Removed Cursor command file for spec-kitty status.
.cursor/commands/spec-kitty.review.md	Removed Cursor command file for spec-kitty review.
.cursor/commands/spec-kitty.research.md	Removed Cursor command file for spec-kitty research.
.cursor/commands/spec-kitty.plan.md	Removed Cursor command file for spec-kitty plan.
.cursor/commands/spec-kitty.implement.md	Removed Cursor command file for spec-kitty implement.
.cursor/commands/spec-kitty.dashboard.md	Removed Cursor command file for spec-kitty dashboard.
.cursor/commands/spec-kitty.clarify.md	Removed Cursor command file for spec-kitty clarify.
.cursor/commands/spec-kitty.analyze.md	Removed Cursor command file for spec-kitty analyze.
.cursor/commands/spec-kitty.accept.md	Removed Cursor command file for spec-kitty accept.
.claudeignore	Removed Claude ignore rules file.
.airlock/workflows/main.yml	Added Airlock workflow configuration.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T12:03:36Z

.github/scripts/security-guard.sh

+
+  if [ -n "${changed_files}" ]; then
+    echo "[security-guard] Running optional codespell fast pass"
+    echo "${changed_files}" |       grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' |       xargs -r codespell -q 2 -L "hte,teh" || true


xargs -r is not supported by BSD xargs (default on macOS), so this script will fail for contributors running it locally on macOS. To keep it portable, remove -r and instead guard the codespell invocation by checking for at least one matching file before calling xargs (or use a POSIX-compatible alternative).

Suggested change

echo "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | xargs -r codespell -q 2 -L "hte,teh" || true

spell_files=$(printf '%s\n' "${changed_files}" | grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' || true)

if [ -n "${spell_files}" ]; then

printf '%s\n' "${spell_files}" | xargs codespell -q 2 -L "hte,teh" || true

fi

Copilot · 2026-03-02T12:03:36Z

.github/workflows/security-guard.yml

+    branches:
+      - "**"


The push trigger already runs on all branches by default; setting branches: [\"**\"] is redundant and can be confusing. Consider removing the branches filter entirely, or narrowing it to the branches you actually want guarded (e.g., main/release branches) to reduce noisy/duplicative CI runs.

Suggested change

branches:

- "**"

Copilot · 2026-03-02T12:03:37Z

.github/workflows/security-guard.yml

+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run pre-commit guard checks
+        uses: pre-commit/action@v3.0.1


For supply-chain hardening, GitHub recommends pinning third-party actions to a full commit SHA rather than a mutable tag (even version tags). Consider pinning both actions/checkout and pre-commit/action to specific SHAs (optionally with a comment noting the corresponding version) to reduce the risk of compromised upstream tags.

Suggested change

uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Run pre-commit guard checks

uses: pre-commit/action@v3.0.1

uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

with:

fetch-depth: 0

- name: Run pre-commit guard checks

uses: pre-commit/action@78975d1f3bc84d3494a7653960a6c4a88c507d4c # v3.0.1

Copilot · 2026-03-02T12:03:37Z

.github/workflows/security-guard.yml

+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run pre-commit guard checks
+        uses: pre-commit/action@v3.0.1


For supply-chain hardening, GitHub recommends pinning third-party actions to a full commit SHA rather than a mutable tag (even version tags). Consider pinning both actions/checkout and pre-commit/action to specific SHAs (optionally with a comment noting the corresponding version) to reduce the risk of compromised upstream tags.

Suggested change

uses: actions/checkout@v4

with:

fetch-depth: 0

- name: Run pre-commit guard checks

uses: pre-commit/action@v3.0.1

uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

with:

fetch-depth: 0

- name: Run pre-commit guard checks

uses: pre-commit/action@2c2c18c48066f0f5eeb1c6fba5880a0c44c12a2f # v3.0.1

Copilot · 2026-03-02T12:03:37Z

.airlock/workflows/main.yml

+    steps:
+      # Rebase onto upstream to handle drift
+      - name: rebase
+        uses: airlock-hq/airlock/defaults/rebase@main
