@hybridlabor-api/aos 4.8.0 → 4.10.0

package/skills/global_config/github-actions-validator/examples/outdated-versions.yml

@@ -0,0 +1,76 @@
+# Example: Workflow with Outdated Action Versions
+# This workflow uses older action versions for testing version validation
+# Use for testing version checks: bash scripts/validate_workflow.sh --check-versions examples/outdated-versions.yml
+#
+# VERSION ISSUES IN THIS FILE:
+# 1. actions/checkout@v4 - OUTDATED (current: v6)
+# 2. actions/setup-node@v4 - OUTDATED (current: v6)
+# 3. actions/upload-artifact@v3 - DEPRECATED (minimum: v4)
+# 4. docker/build-push-action@v5 - OUTDATED (current: v6)
+
+name: Workflow with Outdated Versions
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build Application
+    runs-on: ubuntu-latest
+
+    steps:
+      # OUTDATED: Using v4, current is v6
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # OUTDATED: Using v4, current is v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install and build
+        run: |
+          npm ci
+          npm run build
+
+      # DEPRECATED: Using v3, minimum supported is v4
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: build-output
+          path: dist/
+
+  docker:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # OUTDATED: Using v5, current is v6
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/${{ github.repository }}:latest

package/skills/global_config/github-actions-validator/examples/valid-ci.yml

@@ -0,0 +1,79 @@
+# Example: Valid CI Workflow
+# This workflow passes all validation checks
+# Use for testing successful validation: bash scripts/validate_workflow.sh examples/valid-ci.yml
+
+name: Valid CI Pipeline
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: '20'
+
+jobs:
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Run tests
+        run: npm test
+
+      - name: Build application
+        run: npm run build
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: build-output
+          path: dist/
+          retention-days: 7
+
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    needs: build
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+
+      - name: Run security scan
+        run: |
+          echo "Running security scan..."
+          # Security scan commands here
+
+      - name: Generate summary
+        run: |
+          echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
+          echo "All checks passed!" >> $GITHUB_STEP_SUMMARY

package/skills/global_config/github-actions-validator/examples/with-errors.yml

@@ -0,0 +1,47 @@
+# Example: Workflow with Intentional Errors
+# This workflow contains common errors for testing validation
+# Use for testing error detection: bash scripts/validate_workflow.sh --lint-only examples/with-errors.yml
+#
+# ERRORS IN THIS FILE (4 total, all caught by actionlint):
+# 1. Line 18: Invalid CRON expression (day 8 doesn't exist) [events]
+# 2. Line 25: Typo in runner label (ubuntu-lastest)         [runner-label]
+# 3. Line 37: Script injection vulnerability                 [expression]
+# 4. Line 43: Undefined job dependency (biuld instead of build) [job-needs]
+
+name: Workflow with Errors
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    # ERROR: Invalid CRON - day of week 8 doesn't exist (should be 0-6)
+    - cron: '0 0 * * 8'
+  pull_request:
+
+jobs:
+  build:
+    name: Build
+    # ERROR: Typo in runner label (should be ubuntu-latest)
+    runs-on: ubuntu-lastest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build
+        run: npm run build
+
+      # ERROR: Script injection vulnerability - untrusted input directly in script
+      - name: Process issue
+        run: |
+          echo "Processing: ${{ github.event.issue.title }}"
+
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    # ERROR: Undefined job dependency (typo: biuld instead of build)
+    needs: biuld
+
+    steps:
+      - name: Deploy
+        run: echo "Deploying..."

package/skills/global_config/github-actions-validator/references/act_usage.md

@@ -0,0 +1,233 @@
+# Act (nektos/act) - Usage Reference
+
+Act is a tool that allows you to run your GitHub Actions locally, providing fast feedback and acting as a local task runner.
+
+## Installation
+
+```bash
+# Install act using the official script
+curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/nektos/act/master/install.sh | bash
+
+# Or use the skill's installation script
+bash scripts/install_tools.sh
+```
+
+## Core Commands
+
+### List Workflows
+
+List all available workflows in the repository:
+
+```bash
+act -l
+```
+
+List workflows for a specific event:
+
+```bash
+act -l pull_request
+act -l push
+act -l workflow_dispatch
+```
+
+### Dry Run (No Execution)
+
+Validate workflows without executing them, useful for inspection and validation:
+
+```bash
+act -n
+# or (long form)
+act --dryrun
+```
+
+This performs a dry run that:
+- Parses all workflow files
+- Validates syntax
+- Shows what would be executed
+- Does NOT actually run any jobs
+- Returns exit code 0 on success, non-zero on errors
+
+**Important for Validation:** The dry-run mode is perfect for validating workflow syntax before pushing to GitHub.
+
+### Run Workflows
+
+Run the default workflow:
+
+```bash
+act
+```
+
+Run workflows for a specific event:
+
+```bash
+act push
+act pull_request
+act workflow_dispatch
+```
+
+Run a specific job:
+
+```bash
+act -j <job-id>
+```
+
+Run a specific workflow file:
+
+```bash
+act -W .github/workflows/ci.yml
+```
+
+## Common Use Cases
+
+### 1. Validate Workflow Syntax
+
+Use dry run to check if workflows parse correctly:
+
+```bash
+act -n
+```
+
+If there are syntax errors, act will report them immediately.
+
+### 2. Test Workflows Locally
+
+Before pushing to GitHub, test workflows locally:
+
+```bash
+# Test push event workflows
+act push
+
+# Test pull request workflows
+act pull_request
+```
+
+### 3. Debug Workflow Issues
+
+Run workflows with verbose output:
+
+```bash
+act -v
+```
+
+### 4. List Available Events
+
+See which events have workflows configured:
+
+```bash
+act -l
+```
+
+Output format:
+```
+Stage  Job ID  Job name  Workflow name  Workflow file  Events
+0      build   build     CI             ci.yml         push,pull_request
+0      test    test      CI             ci.yml         push,pull_request
+```
+
+## Advanced Options
+
+### Container Architecture
+
+Ensure consistent platform behavior across different machines:
+
+```bash
+act --container-architecture linux/amd64
+```
+
+This is especially important on ARM-based Macs (M1/M2/M3) to ensure workflows run in the same environment as GitHub's x64 runners.
+
+### Using Specific Docker Images
+
+Act uses Docker containers to run jobs. Specify custom images:
+
+```bash
+act -P ubuntu-latest=node:16-buster
+```
+
+### Configuration File
+
+Create `.actrc` file in your project or home directory to set default options:
+
+```bash
+# .actrc
+--container-architecture=linux/amd64
+--action-offline-mode
+```
+
+Options are loaded in this order:
+1. XDG spec `.actrc`
+2. HOME directory `.actrc`
+3. Current directory `.actrc`
+4. CLI arguments
+
+### Passing Secrets
+
+Provide secrets for testing:
+
+```bash
+act -s GITHUB_TOKEN=ghp_xxx
+```
+
+Or use a secrets file:
+
+```bash
+act --secret-file .secrets
+```
+
+### Environment Variables
+
+Set environment variables:
+
+```bash
+act --env MY_VAR=value
+```
+
+### Input Variables (for workflow_dispatch)
+
+Pass input variables:
+
+```bash
+act workflow_dispatch --input myInput=myValue
+```
+
+## Limitations
+
+Be aware of act's limitations:
+
+1. **Not 100% Compatible**: Some GitHub Actions features may not work exactly as on GitHub
+2. **Docker Required**: act requires Docker to be installed and running
+3. **Network Actions**: Some actions that interact with GitHub's API may fail
+4. **Runner Images**: Default runner images may differ from GitHub's hosted runners
+5. **Secrets**: Local testing requires manually providing secrets
+
+## Exit Codes
+
+- `0`: Success - all jobs passed
+- `1`: Failure - at least one job failed
+- `2`: Error - workflow parsing or execution error
+
+## Best Practices for Validation
+
+1. **Always run dry-run first**: `act -n` to catch syntax errors
+2. **Test specific events**: Don't run all workflows, target the event you care about
+3. **Use verbose mode for debugging**: `act -v` when troubleshooting
+4. **Check Docker availability**: Ensure Docker is running before using act
+5. **Consider limitations**: Not all features work locally - use for syntax and basic logic validation
+
+## Troubleshooting
+
+### Issue: "Cannot connect to Docker daemon"
+
+**Solution**: Start Docker Desktop or Docker daemon
+
+### Issue: "Workflow file not found"
+
+**Solution**: Ensure you're in the repository root or use `-W` to specify the workflow file path
+
+### Issue: "Action not found"
+
+**Solution**: Some actions may not be available locally. Use `-P` to specify alternative Docker images or skip the problematic action for validation purposes
+
+### Issue: "Out of disk space"
+
+**Solution**: Clean up Docker images: `docker system prune -a`

package/skills/global_config/github-actions-validator/references/action_versions.md

@@ -0,0 +1,122 @@
+# Action Version Validation Reference
+
+This reference provides current recommended action versions and validation procedures for GitHub Actions workflows.
+
+## Current Recommended Versions (December 2025)
+
+| Action | Current Version | Minimum Supported | Notes |
+|--------|----------------|-------------------|-------|
+| `actions/checkout` | **v6** | v4 | v6 stores credentials in $RUNNER_TEMP |
+| `actions/setup-node` | **v6** | v4 | v6 adds Node 24 support |
+| `actions/setup-python` | **v5** | v4 | v5 adds Python 3.13 support |
+| `actions/setup-java` | **v4** | v4 | Current latest |
+| `actions/setup-go` | **v5** | v4 | v5 adds Go 1.23 support |
+| `actions/cache` | **v4** | v4 | v4.2.0+ required as of Feb 2025 |
+| `actions/upload-artifact` | **v4** | v4 | v3 deprecated |
+| `actions/download-artifact` | **v4** | v4 | v3 deprecated |
+| `docker/setup-buildx-action` | **v3** | v3 | Current latest |
+| `docker/login-action` | **v3** | v3 | Current latest |
+| `docker/build-push-action` | **v6** | v5 | v6 adds provenance attestation |
+| `docker/metadata-action` | **v5** | v5 | Current latest |
+| `aws-actions/configure-aws-credentials` | **v4** | v4 | OIDC support improved |
+
+## Version Validation Process
+
+### Step 1: Extract Action References
+
+For each `uses:` statement in the workflow, extract:
+- Action name (e.g., `actions/checkout`)
+- Version (e.g., `v4`, `v4.1.1`, or SHA like `b4ffde65f46...`)
+
+### Step 2: Compare Against Recommended Versions
+
+For each action found:
+1. Look up the action in the table above
+2. Compare the workflow version against the **Current Version**
+3. Flag if using a version older than **Minimum Supported**
+
+### Step 3: Report Findings
+
+Generate warnings for:
+- **OUTDATED**: Action using older major version (e.g., checkout@v4 when v6 is current)
+- **DEPRECATED**: Action using version below minimum supported
+- **UP-TO-DATE**: Action using current or acceptable version
+
+## Example Version Validation Output
+
+```
+=== Action Version Check ===
+
+actions/checkout@v6.0.0 - UP-TO-DATE (current: v6)
+actions/setup-java@v4.2.1 - UP-TO-DATE (current: v4)
+docker/build-push-action@v5.3.0 - OUTDATED (current: v6, using: v5)
+actions/upload-artifact@v3 - DEPRECATED (minimum: v4, using: v3)
+
+Recommendation: Update docker/build-push-action to v6 for provenance attestation support
+Recommendation: Update actions/upload-artifact to v4 (v3 is deprecated)
+```
+
+## Using the Version Check Flag
+
+```bash
+# Check action versions in workflow
+bash scripts/validate_workflow.sh --check-versions .github/workflows/ci.yml
+
+# Full validation including version check
+bash scripts/validate_workflow.sh .github/workflows/ci.yml
+```
+
+## Node.js Runtime Deprecation Timeline
+
+GitHub Actions runtime requirements:
+- **Node.js 12**: EOL April 2022 - Actions using this are deprecated
+- **Node.js 16**: EOL September 2023 - Actions using this are deprecated
+- **Node.js 20**: EOL April 2026 - Current runtime for most actions
+- **Node.js 22/24**: Current LTS - Newer actions support these
+
+## SHA Pinning Best Practice
+
+For security, pin actions to specific commit SHAs:
+
+```yaml
+# Recommended: SHA pinning with version comment
+- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+- uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903  # v6.0.0
+
+# Acceptable: Major version tag
+- uses: actions/checkout@v6
+
+# Not recommended: Branch reference
+- uses: actions/checkout@main
+```
+
+## Cache Storage Updates (November 2025)
+
+GitHub Actions cache storage expanded beyond the 10 GB limit:
+
+**New Features:**
+- **Pay-as-you-go model**: Repositories can store more than 10 GB of cache data
+- **Free tier**: All repositories continue to receive 10 GB at no additional cost
+- **New management policies**:
+  - Cache size eviction limit (GB): Control maximum cache size
+  - Cache retention limit (days): Set how long caches are retained
+
+**Pricing:**
+- First 10 GB per repository: **FREE**
+- Additional storage: Comparable to Git LFS and Codespaces storage
+- Requires Pro, Team, or Enterprise account to exceed 10 GB limit
+
+**Cache best practices:**
+- Monitor cache usage in repository settings
+- Configure eviction limits to control costs
+- Use appropriate retention periods for your workflow
+- Clean up old caches regularly
+- Consider cache key strategies to avoid cache bloat
+
+## Validation Checklist
+
+When validating workflows, ALWAYS:
+1. Run the validation script
+2. Manually review `uses:` statements against the version table
+3. Warn about any outdated or deprecated versions
+4. Suggest specific upgrade paths with SHA pinning