coderifts 6.0.1 → 6.0.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 6.0.2
+
+### Fixed
+
+- **init --agents wrote 8 of 9 embedded files.** The skill file joined the single source on 2026-08-25 but was never added to EXTRA_RULES_ON_ALL, a second hand-maintained list. Every release since shipped an installer that under-writes, and agent-setup --check was correctly reporting DRIFT the whole time.
+- **The strict workflow pins actions/checkout too.** It runs first and fetches the code every later step reads; the least pinned step in the strict chain was the most load-bearing.
+
 ## 6.0.1
 
 ### Changed

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "6.0.1",
+      version: "6.0.2",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -227483,6 +227483,25 @@ var require_gate_pin = __commonJS({
   }
 });
 
+// src/generated/action-pins.json
+var require_action_pins = __commonJS({
+  "src/generated/action-pins.json"(exports2, module2) {
+    module2.exports = {
+      actions: [
+        {
+          action: "actions/checkout",
+          sha: "11d5960a326750d5838078e36cf38b85af677262",
+          tag: "v4",
+          exact_tag: "v4.4.0",
+          resolved_from: "https://github.com/actions/checkout refs/tags/v4",
+          resolved_at: "2026-08-27T13:27:52Z"
+        }
+      ],
+      note: "STRICT template pins these third-party actions to full commit SHAs (only a full SHA is immutable). The DEFAULT template deliberately stays on moving tags. A SHA pin does not receive upstream security fixes until someone bumps it \u2014 Dependabot raises that PR, and a pin nobody bumps is worse than a tag because it rots silently. Re-run scripts/generate-action-pins.js."
+    };
+  }
+});
+
 // src/contract-gate-workflow.js
 var require_contract_gate_workflow = __commonJS({
   "src/contract-gate-workflow.js"(exports2, module2) {
@@ -227492,6 +227511,17 @@ var require_contract_gate_workflow = __commonJS({
     var WORKFLOW_REL = ".github/workflows/coderifts.yml";
     var GATE_ACTION = "coderifts/contract-gate@v0";
     var GATE_PIN = require_gate_pin();
+    var ACTION_PINS = require_action_pins();
+    function pinnedActionRef(action) {
+      const entry = (ACTION_PINS.actions || []).find((a) => a && a.action === action);
+      if (!entry || !/^[0-9a-f]{40}$/.test(String(entry.sha || ""))) {
+        throw new Error(
+          `contract-gate-workflow: no usable SHA pin for ${action} in src/generated/action-pins.json \u2014 run scripts/generate-action-pins.js. Refusing to emit an unpinned STRICT workflow.`
+        );
+      }
+      return `${action}@${entry.sha} # ${entry.exact_tag || entry.tag}`;
+    }
+    var CHECKOUT_STRICT = pinnedActionRef("actions/checkout");
     if (typeof GATE_PIN.sha !== "string" || !/^[0-9a-f]{40}$/.test(GATE_PIN.sha)) {
       throw new Error(
         "contract-gate-workflow: generated/gate-pin.json carries no valid 40-hex sha \u2014 re-run scripts/generate-gate-pin.js. Refusing to emit an unpinned STRICT workflow."
@@ -227526,6 +227556,10 @@ jobs:
   contract-gate:
     runs-on: ubuntu-latest
     steps:
+      # actions/checkout stays on the MOVING TAG @v4 here, deliberately \u2014 the same trade this
+      # template makes for the gate itself. You get upstream fixes without editing this file, and
+      # you accept that the bytes can change under you. \`coderifts init --agents --strict\` pins a
+      # full commit SHA for both. Do not "fix" this to a SHA and do not "fix" strict back to a tag.
       - uses: actions/checkout@v4
         with:
           # REQUIRED: the gate derives the change set from git diff base...head.
@@ -227582,7 +227616,14 @@ jobs:
   contract-gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # PINNED, like the gate below it. \`@v4\` is a tag GitHub moves on every release of the
+      # action, so it is not a pin \u2014 and checkout runs FIRST, fetching the code every later step
+      # reads. A strict chain whose first step can change under it is not strict.
+      # MAINTENANCE, stated because a pin has a cost: a SHA-pinned action receives no upstream
+      # fixes, security included, until someone bumps it. Dependabot understands this form and
+      # raises that PR. WITHOUT Dependabot the obligation is yours, and a pin nobody bumps is worse
+      # than a tag, because a tag rots visibly and a pin rots silently.
+      - uses: ${CHECKOUT_STRICT}
         with:
           # REQUIRED: the gate derives the change set from git diff base...head.
           fetch-depth: 0
@@ -227666,6 +227707,9 @@ jobs:
       GATE_ACTION,
       GATE_ACTION_STRICT,
       GATE_PIN,
+      ACTION_PINS,
+      CHECKOUT_STRICT,
+      pinnedActionRef,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
       workflowPresent
@@ -227722,7 +227766,8 @@ var require_init_agents = __commonJS({
     var EXTRA_RULES_ON_ALL = Object.freeze([
       ".github/copilot-instructions.md",
       "coderifts-langgraph-policy.js",
-      "openai-agent-instructions.md"
+      "openai-agent-instructions.md",
+      "skills/api-governance/SKILL.md"
     ]);
     var NEXT_MANUAL_STEP_LINES = Object.freeze([
       "  Next manual step",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "6.0.1",
+  "version": "6.0.2",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",