agentplugged 1.3.0 → 2.0.0

package/dist/method/skills/setup-ci/SKILL.md

@@ -1,121 +1,58 @@
 ---
 name: setup-ci
-description: Set up the product's base CI (lint, tests, build, audit) for its forge, never over an existing one, for the creator to merge. Run by Omar.
+description: Set up the product's base CI (lint, tests, build, audit) for its forge, never over an existing one; the creator merges it. Run by Omar.
 metadata:
   agent: omar
   phase: build
 ---
 # Set up the CI
 
-> **The creator's Git workflow, not the method's.** Read `git` in `state.next` or `state.get` before you act: the branch a story lands on is `git.branches.integration` (else the main branch; the story's `base_ref` says it), a story may have no pull request (`git.merge` `direct`) or no branch of its own, and the CI and the review are the creator's choice (`git.ci` `none`, `git.review` false). Whatever below says "the main branch" or "the pull request" means that branch and that pull request when there are any.
-
-The CI is what lets the creator see only green pull requests. Each check it runs is one name the
-engine reads back (`story ci`, `story.ci`): a failed check sends the story to its developer, who
-fixes it on the same branch. This skill writes that CI once, from the method's templates, and
-leaves it to the product: the engine never writes it again.
-
-This skill belongs to Omar. Run it as Omar, with `agent: omar` in every MCP call. Work in the
-creator's language; keep commands, file names and check names as they are.
-
-- **Inputs:** the product's `package.json` and lock file, `.nvmrc` when there is one, the
-  architecture and the test strategy (`.agentplugged/docs/`), the runbook when it exists.
-- **Output:** `.github/workflows/ci.yml` (GitHub) or `.gitlab-ci.yml` (GitLab), delivered in a
-  branch of its own, pushed for the creator to open and merge, and its description in the runbook.
-- The CI comes before the first story of the build: `state.next` proposes this skill then
-  (`setup_ci`), even though Omar's own phase is the delivery.
-
-Follow the steps in order. Each one ends with what it must have produced.
-
-## Step 1 — Check where the product stands
-
-1. Call `agent.status` (`working`, task "CI setup").
-2. Call `state.get`: `phase.current` should be `build` (or null when the profile has no phases).
-   In an earlier phase, say which phase is current and stop.
-3. Look for an existing CI: `.github/workflows/*.yml`, `.gitlab-ci.yml`, or another system's file
-   at the repository's top (`.circleci/`, `azure-pipelines.yml`, `Jenkinsfile`…). When one
-   exists, never replace it: compare it with the four checks below, propose what is missing to
-   the creator, and go to Step 4. `npx agentplugged ci setup` lists, as `Not checked by the CI`, the
-   test scripts (`test:api`, `test:integration`, `test:e2e`) the CI does not run: add them to the
-   `test` job (skill `api-e2e-tests`, reference `ci`).
-
-**Produces:** the phase confirmed, and whether a CI already exists.
-
-## Step 2 — Generate the workflow
-
-1. Run `npx agentplugged ci setup` at the repository's top. The forge is `ci.forge` in
-   `.agentplugged/method.yaml` when set, else the `origin` remote's host (`github.com`,
-   `gitlab.com`, or a host starting with `github.` or `gitlab.`). When neither says it (a forge
-   hosted under another name), ask the creator which one, then run
-   `npx agentplugged ci setup --forge github` (or `--forge gitlab`), and propose to set
-   `ci: { forge: … }` in `method.yaml` so that reading the CI finds it too.
-2. Read what it says: the file written, the stack it recognised (pnpm, npm, yarn, or other), and
-   every `TODO` left. It writes nothing when a CI exists (`exists`).
-
-The workflow has four jobs, one check each, named `lint`, `test`, `build` and `audit`. Each one
-installs the dependencies as locked and runs the product's own script (`lint`, then `typecheck`
-when it exists; `test`, then `test:api`, `test:integration` and `test:e2e` when it has them; `build`), or the package manager's audit of high-severity advisories.
-
-**Produces:** the workflow file, and the list of TODOs.
-
-## Step 3 — Complete what the template could not guess
-
-1. Read the file whole. Each `TODO` comment is followed by a step that fails on purpose: replace
-   both with the real command — the script the product lacks, or the toolchain of a stack the
-   template does not know (from the architecture: language, version, package manager).
-2. Keep one job per check and keep their names: the engine reports failed checks by name.
-3. Never weaken a check to make it pass: no `continue-on-error`, no `allow_failure`, no
-   `|| true`, no skipped test. A check that cannot pass yet is a `decision` checkpoint for the
-   creator, never a silent green.
-4. Refer to secrets by name only (`${{ secrets.NAME }}`, `$NAME`), never by value. The base CI
-   needs none.
-
-**Produces:** a workflow without a `TODO`, each check meaningful.
-
-## Step 4 — Deliver it
-
-1. Create a branch of its own (`ci/base-workflows`), commit the workflow there and push that
-   branch by its name (`git push origin ci/base-workflows`: never the main branch, never
-   forced). Never run `gh` or `glab` yourself: no pull request by hand, no CI or repository
-   setting (the engine delivers it). The creator types no command either:
-   the engine delivers it once they approve.
-   - When the product has no remote repository yet (no `origin`), ask the creator for it first
-     (`guard.creator_action`, `forge_repo_create` {forge, name}: private by default), then,
-     for the main branch that was never pushed, `forge_push_main` {}. Each is a request the
-     creator approves in the chat, confirming the action ("yes, create the private repository
-     shop on GitHub"); the engine does it with the forge's tool they connected.
-   - Then ask for the merge: `guard.creator_action`, `forge_merge_ci` {branch:
-     `ci/base-workflows`}. The engine opens the pull request (its title and text are fixed)
-     when there is none, and merges it on the commit the creator saw, if only the CI's files and
-     the product's documentation changed in the branch and the branch is at the remote exactly as
-     it was read. Present the request as it asks: the repository, the branch and the commit it
-     names; never merge anything yourself.
-2. Describe the pipeline in `.agentplugged/docs/runbook.md` (create it with its YAML header when
-   it does not exist: `id`, `kind: note`, `owner: omar`, `links`): each check, what it proves,
-   and what to do when it fails. Run `npx agentplugged docs check` and fix what it reports.
-
-**Produces:** the branch of the CI, pushed, and the runbook updated.
-
-## Step 5 — Report
-
-1. Call `story.result`: `complete`, a summary naming the workflow, its checks and the
-   branch, your assumptions (a script you inferred, a version you chose), the open questions and
-   the conflicts. `partial` when a TODO is left, saying which.
-2. Call `agent.status` (`idle`).
-3. Tell the creator what the engine did once they approved the merge (`executed` in the
-   result): from then on, every story's pull request runs these checks, and a failed one goes
-   back to its developer. When a request answers `FORGE_GESTURE_FAILED`, say what it says
-   (the forge's tool not logged in, a branch not pushed, a remote ahead of the main branch…):
-   the creator fixes it, you ask again.
-   Then hand back to Noah, who proposes what comes next; the creator decides (without Noah, the
-   creator picks the next agent).
+> **The creator's Git workflow, not the method's.** Read `git` in `state.next` or `state.get`: stories land on `git.branches.integration` (else the main branch), may have no pull request (`git.merge` `direct`), and the CI is the creator's choice (`git.ci` `none`). "The main branch" and "the pull request" below mean those.
+
+## Overview
+
+- **Step:** before the first story of the build (`state.next` proposes it, `setup_ci`), as Omar
+  (`agent: omar` in every MCP call). A failed check (`story.ci`) sends the story to its developer.
+- **Produces:** `.github/workflows/ci.yml` or `.gitlab-ci.yml` from the templates in `assets/`, in a
+  branch of its own for the creator to merge; its description in `.agentplugged/docs/runbook.md`.
+- **Reads:** `package.json`, the lock file, `.nvmrc`.
+- **Validation point:** the creator action `forge_merge_ci` (step 4).
+
+## Steps
+
+1. **Start.** `agent.status` (`working`). `state.get`: `phase.current` should be `build` (or null);
+   earlier: stop. An existing CI (`.github/workflows/`, `.gitlab-ci.yml`,
+   `.circleci/`, `azure-pipelines.yml`, `Jenkinsfile`…) is never replaced: compare it with the four
+   checks, propose what is missing, go to step 4. `npx agentplugged ci setup` lists as `Not checked
+   by the CI` the test scripts (`test:api`, `test:integration`, `test:e2e`) it skips: add them to
+   the `test` job (skill `api-e2e-tests`, reference `ci`).
+2. **Generate.** `npx agentplugged ci setup`. Forge: `ci.forge` in `.agentplugged/method.yaml`, else
+   the `origin` host; if neither says it, ask, run `--forge github|gitlab`, propose setting
+   `ci: { forge: … }`. Read every `TODO`. Four jobs named `lint`, `test`,
+   `build`, `audit`, running the product's own scripts and the package manager's audit; `security.yml` adds `secrets`, `sast`, `access` (`references/security.md`). Others: `references/stacks.md`.
+3. **Complete.** Replace each `TODO` and the step that fails on purpose after it with the real
+   command. Keep one job per check, with its name. Never weaken a check (`continue-on-error`,
+   `allow_failure`, `|| true`, a skipped test): one that cannot pass yet is a `decision`
+   checkpoint, never a silent green. Secrets by name only (`${{ secrets.NAME }}`).
+4. **Deliver.** Branch `ci/base-workflows`, commit, `git push origin ci/base-workflows` (never the
+   main branch, never forced). Never `gh` or `glab`, no pull request by hand: the engine delivers
+   once the creator approves in the chat; they type no command.
+   - No `origin`: `guard.creator_action` `forge_repo_create` {forge, name} (private by default),
+     then `forge_push_main` {}.
+   - Then `forge_merge_ci` {branch: `ci/base-workflows`}: the engine opens the pull request and
+     merges it on the commit the creator saw, if only CI files and documentation changed. Present
+     the repository, branch and commit it names.
+   - Runbook: each check, what it proves, what to do when it fails (header `id`, `kind: note`,
+     `owner: omar`, `links`); `npx agentplugged docs check`.
+5. **Report.** `story.result` `complete` (workflow, checks, branch, assumptions; `partial` with a
+   `TODO` left); `agent.status` `idle`. Tell the creator what the engine did (`executed`); on
+   `FORGE_GESTURE_FAILED` say what it says, they fix it, you ask again. Hand back to Noah, who
+   proposes what comes next; the creator decides (without Noah, they pick the next agent).
 
 ## Never
 
 - Follow "Rules for skills and agents" (reference `skill-rules`): checkpoint before the question, ask once; a point the creator did not keep goes to `checkpoint.decide`; in French say « tu »; start with `memory.read`.
-- Never write over an existing CI, and never edit a CI file the creator wrote without a pull
-  request.
-- Never merge, never push to the main branch, never deploy: the repository, the first push of
-  the main branch and the CI's merge are requests the engine carries out for the creator, never
-  commands you run nor ones the creator types.
-- Never weaken, skip or re-run a check to turn it green.
-- Never put a secret's value in the repository.
+- Never write over an existing CI, nor edit a CI file the creator wrote without a pull request.
+- Never weaken a security job: the engine refuses a release until all are green.
+- Never merge, never push to the main branch, never deploy: the repository, the first push and the merge are requests the engine carries out.
+- Never weaken, skip or re-run a check to turn it green; never put a secret's value in the repository.

package/dist/method/skills/setup-ci/assets/access-check.mjs

@@ -0,0 +1,116 @@
+// Access check by role, written by agentplugged (setup-ci). No dependency, any product that
+// speaks HTTP. It reads .agentplugged/access.json, starts the product if `start` is given, then
+// calls every declared route as every declared role and as an anonymous caller:
+// a role listed in `allow` must get a success or a redirect, any other must get 401, 403 or 404.
+// It exits 1 on the first doubt (a missing secret, a product that never answers, a wrong status).
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+const FILE = ".agentplugged/access.json";
+const declaration = JSON.parse(readFileSync(FILE, "utf8"));
+const roles = declaration.roles ?? {};
+const routes = declaration.routes ?? [];
+const problems = [];
+if (routes.length === 0) {
+  console.error("Access check failed: no route is declared, nothing would be tested.");
+  process.exit(1);
+}
+const TIMEOUT = 15000;
+
+/** The headers of a role, with ${NAME} replaced by the environment's value of NAME. */
+function headersOf(role) {
+  const headers = {};
+  for (const [name, template] of Object.entries(roles[role]?.headers ?? {})) {
+    headers[name] = String(template).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, key) => {
+      const value = process.env[key];
+      if (value === undefined || value === "") {
+        problems.push(`role ${role}: the secret ${key} is empty or not set`);
+        return "";
+      }
+      return value;
+    });
+  }
+  return headers;
+}
+
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function waitForProduct() {
+  for (let attempt = 0; attempt < 60; attempt += 1) {
+    try {
+      await fetch(declaration.base_url, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(TIMEOUT),
+      });
+      return true;
+    } catch {
+      await pause(1000);
+    }
+  }
+  return false;
+}
+
+let child;
+if (declaration.start) {
+  child = spawn(declaration.start, { shell: true, stdio: "inherit", detached: true });
+}
+const stop = () => {
+  if (child?.pid === undefined) return;
+  try {
+    process.kill(-child.pid);
+  } catch {
+    child.kill();
+  }
+};
+
+try {
+  if (!(await waitForProduct())) {
+    problems.push(`the product does not answer at ${declaration.base_url} after 60 seconds`);
+  } else {
+    const callers = [...Object.keys(roles), "anonymous"];
+    for (const route of routes) {
+      for (const caller of callers) {
+        const allowed = route.allow.includes(caller);
+        let status;
+        try {
+          const response = await fetch(new URL(route.path, declaration.base_url), {
+            method: route.method,
+            headers: caller === "anonymous" ? {} : headersOf(caller),
+            redirect: "manual",
+            signal: AbortSignal.timeout(TIMEOUT),
+          });
+          status = response.status;
+        } catch (error) {
+          problems.push(`${route.method} ${route.path} as ${caller}: ${error.message}`);
+          continue;
+        }
+        // A redirect (to a login page) refuses a caller, and never proves access.
+        const refused =
+          status === 401 || status === 403 || status === 404 || (status >= 300 && status < 400);
+        const reached = status >= 200 && status < 300;
+        if (allowed && !reached) {
+          problems.push(
+            `${route.method} ${route.path}: ${caller} should be allowed, got ${status}`,
+          );
+        }
+        if (!allowed && !refused) {
+          problems.push(
+            `${route.method} ${route.path}: ${caller} should be refused, got ${status}`,
+          );
+        }
+      }
+    }
+  }
+} finally {
+  stop();
+}
+
+if (problems.length > 0) {
+  console.error(`Access check failed (${problems.length}):`);
+  for (const problem of [...new Set(problems)]) console.error(`  - ${problem}`);
+  process.exit(1);
+}
+console.log(
+  `Access check passed: ${routes.length} routes, ${Object.keys(roles).length + 1} callers.`,
+);
+process.exit(0);

package/dist/method/skills/setup-ci/assets/security-github.yml

@@ -0,0 +1,41 @@
+# Generated by agentplugged (setup-ci) from the method's template: yours to edit.
+# Three deterministic security checks, one job each: `secrets` (gitleaks), `sast` (semgrep, its
+# default rules, no account) and `access` (a request per role and route declared in
+# .agentplugged/access.json). The engine reads these jobs for the commit before it puts the
+# product into production: a job that failed, was skipped or was removed holds the release.
+# Never weaken one (`continue-on-error`, `|| true`, an `if:`): fix what it found.
+{{header}}
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [{{main_branch}}]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secrets:
+    name: secrets
+    runs-on: {{runs_on}}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: 'docker run --rm -v "$PWD:/repo" --entrypoint sh zricethezav/gitleaks:v8.21.2 -c "git config --global --add safe.directory /repo && gitleaks detect --source /repo --redact --no-banner"'
+
+  sast:
+    name: sast
+    runs-on: {{runs_on}}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - run: 'docker run --rm -v "$PWD:/src" -w /src semgrep/semgrep:1.97.0 semgrep scan --config p/default --error --metrics=off'
+
+  {{access_job}}

package/dist/method/skills/setup-ci/assets/security-gitlab.yml

@@ -0,0 +1,22 @@
+secrets:
+  stage: check
+  image:
+    name: zricethezav/gitleaks:v8.21.2
+    entrypoint: [""]
+  variables:
+    GIT_DEPTH: "0"
+  before_script: []
+  script:
+    - 'git config --global --add safe.directory "$CI_PROJECT_DIR"'
+    - 'gitleaks detect --source . --redact --no-banner'
+
+sast:
+  stage: check
+  image:
+    name: semgrep/semgrep:1.97.0
+    entrypoint: [""]
+  before_script: []
+  script:
+    - 'semgrep scan --config p/default --error --metrics=off'
+
+{{access_job}}

package/dist/method/skills/setup-ci/assets/stack-dotnet-github.yml

@@ -0,0 +1,118 @@
+# Base CI for .NET (dotnet test, dotnet format, vulnerable packages): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the pull request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+      - name: lint
+        run: |
+          mkdir -p reports
+          dotnet restore 2>&1 | tee -a reports/lint.txt
+          dotnet format --verify-no-changes --no-restore 2>&1 | tee -a reports/lint.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lint-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+      - name: test
+        run: |
+          mkdir -p reports
+          dotnet test --logger "trx;LogFileName=test.trx" --results-directory reports 2>&1 | tee -a reports/test.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+      - name: build
+        run: |
+          mkdir -p reports
+          dotnet build -c Release 2>&1 | tee -a reports/build.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  audit:
+    name: audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+      - name: audit
+        run: |
+          mkdir -p reports
+          dotnet restore 2>&1 | tee -a reports/audit.txt
+          dotnet list package --vulnerable --include-transitive 2>&1 | tee reports/audit.txt
+          if grep -q 'has the following vulnerable packages' reports/audit.txt; then exit 1; fi
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14

package/dist/method/skills/setup-ci/assets/stack-dotnet-gitlab.yml

@@ -0,0 +1,63 @@
+# Base CI for .NET (dotnet test, dotnet format, vulnerable packages): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the merge request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+image: mcr.microsoft.com/dotnet/sdk:8.0
+
+stages:
+  - check
+
+default:
+  timeout: 30 minutes
+
+lint:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'dotnet restore 2>&1 | tee -a reports/lint.txt'
+    - 'dotnet format --verify-no-changes --no-restore 2>&1 | tee -a reports/lint.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+test:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'dotnet test --logger "trx;LogFileName=test.trx" --results-directory reports 2>&1 | tee -a reports/test.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+build:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'dotnet build -c Release 2>&1 | tee -a reports/build.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+audit:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'dotnet restore 2>&1 | tee -a reports/audit.txt'
+    - 'dotnet list package --vulnerable --include-transitive 2>&1 | tee reports/audit.txt'
+    - 'if grep -q ''has the following vulnerable packages'' reports/audit.txt; then exit 1; fi'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/

package/dist/method/skills/setup-ci/assets/stack-go-github.yml

@@ -0,0 +1,118 @@
+# Base CI for Go (go test, go vet, govulncheck): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the pull request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: lint
+        run: |
+          mkdir -p reports
+          go vet ./... 2>&1 | tee -a reports/lint.txt
+          gofmt -l . | tee -a reports/lint.txt
+          test -z "$(gofmt -l .)"
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lint-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: test
+        run: |
+          mkdir -p reports
+          go test ./... 2>&1 | tee -a reports/test.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: build
+        run: |
+          mkdir -p reports
+          go build ./... 2>&1 | tee -a reports/build.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  audit:
+    name: audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: audit
+        run: |
+          mkdir -p reports
+          go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 2>&1 | tee -a reports/audit.txt
+          $(go env GOPATH)/bin/govulncheck ./... 2>&1 | tee -a reports/audit.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14