@codyswann/lisa 2.311.3 → 2.311.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/doctor-readiness-action-pins.d.ts +5 -2
- package/dist/cli/doctor-readiness-action-pins.d.ts.map +1 -1
- package/dist/cli/doctor-readiness-action-pins.js +36 -10
- package/dist/cli/doctor-readiness-action-pins.js.map +1 -1
- package/package.json +1 -1
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-agy/plugin.json +1 -1
- package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
|
@@ -4,9 +4,12 @@
|
|
|
4
4
|
*/
|
|
5
5
|
import type { ParsedWorkflow, ParsedWorkflowJob } from "./doctor-readiness-workflows.js";
|
|
6
6
|
/**
|
|
7
|
-
* Report mutable action references in jobs that publish release artifacts
|
|
7
|
+
* Report mutable action references in jobs that publish release artifacts or
|
|
8
|
+
* provide the validation those publishing jobs rely on.
|
|
8
9
|
* A release job has deployment authority, so an action tag such as `@v4` or
|
|
9
|
-
* `@main` is supply-chain authority handed to whoever can move that ref.
|
|
10
|
+
* `@main` is supply-chain authority handed to whoever can move that ref. The
|
|
11
|
+
* same is true for the validating ancestors in the publishing job's `needs:`
|
|
12
|
+
* closure: their output is what makes the artifact trusted.
|
|
10
13
|
* @param workflow - The workflow declaring the job
|
|
11
14
|
* @param job - The job to assess
|
|
12
15
|
* @returns B2 evidence lines for unpinned action refs
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor-readiness-action-pins.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-action-pins.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,
|
|
1
|
+
{"version":3,"file":"doctor-readiness-action-pins.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-action-pins.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAElB,MAAM,iCAAiC,CAAC;AAqEzC;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,iBAAiB,GACrB,SAAS,MAAM,EAAE,CAcnB"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { describeStep, findPublishSteps, } from "./doctor-readiness-release-path.js";
|
|
2
|
+
import { ancestorJobs } from "./doctor-readiness-reusable-callers.js";
|
|
2
3
|
const PINNED_ACTION_REF = /^[a-f0-9]{40}$/i;
|
|
3
4
|
const PINNED_DOCKER_ACTION_REF = /^docker:\/\/.+@sha256:[a-f0-9]{64}$/i;
|
|
4
5
|
/**
|
|
@@ -19,9 +20,38 @@ function isMutableActionRef(uses) {
|
|
|
19
20
|
return ref === undefined || !PINNED_ACTION_REF.test(ref);
|
|
20
21
|
}
|
|
21
22
|
/**
|
|
22
|
-
* Report mutable action references in
|
|
23
|
+
* Report mutable action references in a release-path job.
|
|
24
|
+
* @param workflow - The workflow declaring the job
|
|
25
|
+
* @param job - The job to assess
|
|
26
|
+
* @param step - The action step to report
|
|
27
|
+
* @param role - Why this job is release-path relevant
|
|
28
|
+
* @returns One B2 evidence line
|
|
29
|
+
*/
|
|
30
|
+
function mutableActionEvidence(workflow, job, step, role) {
|
|
31
|
+
return (`${workflow.file} job \`${job.id}\` step \`${describeStep(step)}\` ` +
|
|
32
|
+
`uses mutable action reference \`${step.uses}\` in ${role}; pin it to a ` +
|
|
33
|
+
"full commit SHA so the release path cannot change without a reviewed " +
|
|
34
|
+
"workflow diff");
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Report mutable action references in one job.
|
|
38
|
+
* @param workflow - The workflow declaring the job
|
|
39
|
+
* @param job - The job to assess
|
|
40
|
+
* @param role - Why this job is release-path relevant
|
|
41
|
+
* @returns B2 evidence lines for unpinned action refs
|
|
42
|
+
*/
|
|
43
|
+
function mutableActionViolations(workflow, job, role) {
|
|
44
|
+
return job.steps.flatMap(step => isMutableActionRef(step.uses)
|
|
45
|
+
? [mutableActionEvidence(workflow, job, step, role)]
|
|
46
|
+
: []);
|
|
47
|
+
}
|
|
48
|
+
/**
|
|
49
|
+
* Report mutable action references in jobs that publish release artifacts or
|
|
50
|
+
* provide the validation those publishing jobs rely on.
|
|
23
51
|
* A release job has deployment authority, so an action tag such as `@v4` or
|
|
24
|
-
* `@main` is supply-chain authority handed to whoever can move that ref.
|
|
52
|
+
* `@main` is supply-chain authority handed to whoever can move that ref. The
|
|
53
|
+
* same is true for the validating ancestors in the publishing job's `needs:`
|
|
54
|
+
* closure: their output is what makes the artifact trusted.
|
|
25
55
|
* @param workflow - The workflow declaring the job
|
|
26
56
|
* @param job - The job to assess
|
|
27
57
|
* @returns B2 evidence lines for unpinned action refs
|
|
@@ -30,13 +60,9 @@ export function unpinnedPublishingActionViolations(workflow, job) {
|
|
|
30
60
|
if (findPublishSteps(job).length === 0) {
|
|
31
61
|
return [];
|
|
32
62
|
}
|
|
33
|
-
return
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
"job; pin it to a full commit SHA so the release path cannot change " +
|
|
38
|
-
"without a reviewed workflow diff",
|
|
39
|
-
]
|
|
40
|
-
: []);
|
|
63
|
+
return [
|
|
64
|
+
...mutableActionViolations(workflow, job, "a publishing job"),
|
|
65
|
+
...ancestorJobs(workflow, job).flatMap(ancestor => mutableActionViolations(workflow, ancestor, "a validating ancestor of a publishing job")),
|
|
66
|
+
];
|
|
41
67
|
}
|
|
42
68
|
//# sourceMappingURL=doctor-readiness-action-pins.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor-readiness-action-pins.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-action-pins.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"doctor-readiness-action-pins.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-action-pins.ts"],"names":[],"mappings":"AASA,OAAO,EACL,YAAY,EACZ,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAEtE,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;AAExE;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAC5B,QAAwB,EACxB,GAAsB,EACtB,IAAwB,EACxB,IAAY;IAEZ,OAAO,CACL,GAAG,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,aAAa,YAAY,CAAC,IAAI,CAAC,KAAK;QACpE,mCAAmC,IAAI,CAAC,IAAI,SAAS,IAAI,gBAAgB;QACzE,uEAAuE;QACvE,eAAe,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAC9B,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC9B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAwB,EACxB,GAAsB;IAEtB,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,uBAAuB,CAAC,QAAQ,EAAE,GAAG,EAAE,kBAAkB,CAAC;QAC7D,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAChD,uBAAuB,CACrB,QAAQ,EACR,QAAQ,EACR,2CAA2C,CAC5C,CACF;KACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -115,7 +115,7 @@
|
|
|
115
115
|
"brace-expansion": ">=5.0.8"
|
|
116
116
|
},
|
|
117
117
|
"name": "@codyswann/lisa",
|
|
118
|
-
"version": "2.311.
|
|
118
|
+
"version": "2.311.4",
|
|
119
119
|
"description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
|
|
120
120
|
"main": "dist/index.js",
|
|
121
121
|
"exports": {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.311.
|
|
3
|
+
"version": "2.311.4",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.311.
|
|
3
|
+
"version": "2.311.4",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.311.
|
|
3
|
+
"version": "2.311.4",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.311.
|
|
3
|
+
"version": "2.311.4",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.311.
|
|
3
|
+
"version": "2.311.4",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|