coderifts 6.0.1 → 6.1.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 6.1.0
+
+### Added
+
+- **enforce --check now reads GitHub rulesets.** The evaluator existed with zero production call sites: a ruleset-governed repository reported required_check NOT_VERIFIED while its merges were gated. Rulesets are readable where classic protection is not (200 vs 401), so required_check can now reach VERIFIED on an unreadable classic response.
+
+## 6.0.2
+
+### Fixed
+
+- **init --agents wrote 8 of 9 embedded files.** The skill file joined the single source on 2026-08-25 but was never added to EXTRA_RULES_ON_ALL, a second hand-maintained list. Every release since shipped an installer that under-writes, and agent-setup --check was correctly reporting DRIFT the whole time.
+- **The strict workflow pins actions/checkout too.** It runs first and fetches the code every later step reads; the least pinned step in the strict chain was the most load-bearing.
+
 ## 6.0.1
 
 ### Changed

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "6.0.1",
+      version: "6.1.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -227483,6 +227483,25 @@ var require_gate_pin = __commonJS({
   }
 });
 
+// src/generated/action-pins.json
+var require_action_pins = __commonJS({
+  "src/generated/action-pins.json"(exports2, module2) {
+    module2.exports = {
+      actions: [
+        {
+          action: "actions/checkout",
+          sha: "11d5960a326750d5838078e36cf38b85af677262",
+          tag: "v4",
+          exact_tag: "v4.4.0",
+          resolved_from: "https://github.com/actions/checkout refs/tags/v4",
+          resolved_at: "2026-08-27T13:27:52Z"
+        }
+      ],
+      note: "STRICT template pins these third-party actions to full commit SHAs (only a full SHA is immutable). The DEFAULT template deliberately stays on moving tags. A SHA pin does not receive upstream security fixes until someone bumps it \u2014 Dependabot raises that PR, and a pin nobody bumps is worse than a tag because it rots silently. Re-run scripts/generate-action-pins.js."
+    };
+  }
+});
+
 // src/contract-gate-workflow.js
 var require_contract_gate_workflow = __commonJS({
   "src/contract-gate-workflow.js"(exports2, module2) {
@@ -227492,6 +227511,17 @@ var require_contract_gate_workflow = __commonJS({
     var WORKFLOW_REL = ".github/workflows/coderifts.yml";
     var GATE_ACTION = "coderifts/contract-gate@v0";
     var GATE_PIN = require_gate_pin();
+    var ACTION_PINS = require_action_pins();
+    function pinnedActionRef(action) {
+      const entry = (ACTION_PINS.actions || []).find((a) => a && a.action === action);
+      if (!entry || !/^[0-9a-f]{40}$/.test(String(entry.sha || ""))) {
+        throw new Error(
+          `contract-gate-workflow: no usable SHA pin for ${action} in src/generated/action-pins.json \u2014 run scripts/generate-action-pins.js. Refusing to emit an unpinned STRICT workflow.`
+        );
+      }
+      return `${action}@${entry.sha} # ${entry.exact_tag || entry.tag}`;
+    }
+    var CHECKOUT_STRICT = pinnedActionRef("actions/checkout");
     if (typeof GATE_PIN.sha !== "string" || !/^[0-9a-f]{40}$/.test(GATE_PIN.sha)) {
       throw new Error(
         "contract-gate-workflow: generated/gate-pin.json carries no valid 40-hex sha \u2014 re-run scripts/generate-gate-pin.js. Refusing to emit an unpinned STRICT workflow."
@@ -227526,6 +227556,10 @@ jobs:
   contract-gate:
     runs-on: ubuntu-latest
     steps:
+      # actions/checkout stays on the MOVING TAG @v4 here, deliberately \u2014 the same trade this
+      # template makes for the gate itself. You get upstream fixes without editing this file, and
+      # you accept that the bytes can change under you. \`coderifts init --agents --strict\` pins a
+      # full commit SHA for both. Do not "fix" this to a SHA and do not "fix" strict back to a tag.
       - uses: actions/checkout@v4
         with:
           # REQUIRED: the gate derives the change set from git diff base...head.
@@ -227582,7 +227616,14 @@ jobs:
   contract-gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # PINNED, like the gate below it. \`@v4\` is a tag GitHub moves on every release of the
+      # action, so it is not a pin \u2014 and checkout runs FIRST, fetching the code every later step
+      # reads. A strict chain whose first step can change under it is not strict.
+      # MAINTENANCE, stated because a pin has a cost: a SHA-pinned action receives no upstream
+      # fixes, security included, until someone bumps it. Dependabot understands this form and
+      # raises that PR. WITHOUT Dependabot the obligation is yours, and a pin nobody bumps is worse
+      # than a tag, because a tag rots visibly and a pin rots silently.
+      - uses: ${CHECKOUT_STRICT}
         with:
           # REQUIRED: the gate derives the change set from git diff base...head.
           fetch-depth: 0
@@ -227666,6 +227707,9 @@ jobs:
       GATE_ACTION,
       GATE_ACTION_STRICT,
       GATE_PIN,
+      ACTION_PINS,
+      CHECKOUT_STRICT,
+      pinnedActionRef,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
       workflowPresent
@@ -227722,7 +227766,8 @@ var require_init_agents = __commonJS({
     var EXTRA_RULES_ON_ALL = Object.freeze([
       ".github/copilot-instructions.md",
       "coderifts-langgraph-policy.js",
-      "openai-agent-instructions.md"
+      "openai-agent-instructions.md",
+      "skills/api-governance/SKILL.md"
     ]);
     var NEXT_MANUAL_STEP_LINES = Object.freeze([
       "  Next manual step",
@@ -254151,7 +254196,9 @@ var require_github_enforcement = __commonJS({
     });
     function verifiedRequiresBinding(layer2) {
       if (!layer2 || layer2.status !== STATUS.VERIFIED) return true;
-      if (layer2.id === "required_check") return layer2.reason_code === REASON.ISSUER_BOUND;
+      if (layer2.id === "required_check") {
+        return layer2.reason_code === REASON.ISSUER_BOUND || layer2.reason_code === REASON.RULESET_ISSUER_BOUND;
+      }
       if (layer2.id === "workflow_contract_gate" || layer2.id === "workflow_deploy_gate") {
         return layer2.reason_code === REASON.ACTIVE_JOB;
       }
@@ -254603,15 +254650,48 @@ var require_github_enforcement = __commonJS({
       environmentRead,
       environmentName,
       local,
-      auth
+      auth,
+      rulesetsRead = null,
+      branch = null
     } = {}) {
       const layers = [];
       const localFiles = local || { contractGateFiles: [], deployGateFiles: [] };
+      const rulesetVerdict = evaluateRuleset(rulesetsRead, branch);
+      const rulesetUpgrade = (classicLayerFields) => {
+        if (rulesetVerdict.status !== STATUS.VERIFIED) return null;
+        return {
+          status: STATUS.VERIFIED,
+          reason: `${rulesetVerdict.reason} Classic branch protection did not establish this: ${classicLayerFields.reason}`,
+          reason_code: rulesetVerdict.reason_code,
+          endpoint: "GET /repos/{owner}/{repo}/rulesets",
+          app_id: rulesetVerdict.app_id,
+          ruleset_names: rulesetVerdict.ruleset_names,
+          surfaces_inspected: ["classic_branch_protection", "rulesets"]
+        };
+      };
+      const pushRequiredCheck = (classicFields) => {
+        const up = rulesetUpgrade(classicFields);
+        layers.push(layer("required_check", up ? up.status : classicFields.status, {
+          ...up || classicFields,
+          ruleset_status: rulesetVerdict.status,
+          ruleset_reason_code: rulesetVerdict.reason_code,
+          surfaces_inspected: [
+            "classic_branch_protection",
+            rulesetsRead == null ? "rulesets:unread" : "rulesets"
+          ]
+        }));
+      };
       const noAuth = !auth || auth.source === "none" || !auth.ok;
       const prot = protectionRead || null;
       if (noAuth && !prot) {
         const why = auth && auth.reason || NO_TOKEN_INSTRUCTION;
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({
+          status: STATUS.UNVERIFIABLE,
+          reason: why,
+          endpoint: null,
+          missing_scope: APP_INSTALLATION.missing_scope
+        });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, {
             reason: why,
             endpoint: null,
@@ -254620,13 +254700,21 @@ var require_github_enforcement = __commonJS({
         }
       } else if (!prot) {
         const why = "branch protection was not queried";
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({ status: STATUS.UNVERIFIABLE, reason: why, endpoint: null });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, { reason: why, endpoint: null }));
         }
       } else if (prot.status === 403) {
         const why = "GitHub HTTP 403 \u2014 missing scope administration:read (branch protection). Grant Administration: Read on the token, or use a repo-admin token.";
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({
+          status: STATUS.UNVERIFIABLE,
+          reason: why,
+          endpoint,
+          missing_scope: "administration:read",
+          http_status: 403
+        });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, {
             reason: why,
             endpoint,
@@ -254636,11 +254724,12 @@ var require_github_enforcement = __commonJS({
         }
       } else if (prot.status === 404) {
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        layers.push(layer("required_check", STATUS.NOT_VERIFIED, {
+        pushRequiredCheck({
+          status: STATUS.NOT_VERIFIED,
           reason: `classic branch protection is absent \u2014 required check "${CHECK_NAME}" is not required`,
           endpoint,
           http_status: 404
-        }));
+        });
         layers.push(layer("enforce_admins", STATUS.NOT_VERIFIED, {
           reason: "classic branch protection is absent \u2014 administrators are unrestricted",
           endpoint,
@@ -254654,7 +254743,13 @@ var require_github_enforcement = __commonJS({
       } else if (prot.status >= 400 || prot.status === 0) {
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
         const why = `GitHub HTTP ${prot.status || 0} reading branch protection \u2014 cannot verify`;
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({
+          status: STATUS.UNVERIFIABLE,
+          reason: redactSecrets(why),
+          endpoint,
+          http_status: prot.status
+        });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, {
             reason: redactSecrets(why),
             endpoint,
@@ -254665,14 +254760,15 @@ var require_github_enforcement = __commonJS({
         const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
         const required = evaluateRequiredCheck(protection);
-        layers.push(layer("required_check", required.status, {
+        pushRequiredCheck({
+          status: required.status,
           reason: required.reason,
           reason_code: required.reason_code,
           endpoint,
           required_contexts: required.required_contexts,
           app_id: required.app_id,
           ...required.expected_app_id != null ? { expected_app_id: required.expected_app_id } : {}
-        }));
+        });
         const admins = enforceAdminsEnabled(protection);
         layers.push(layer("enforce_admins", admins ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
           reason: admins ? "enforce_admins.enabled is true \u2014 administrators cannot bypass required checks" : "enforce_admins.enabled is false \u2014 repository administrators can bypass required checks",
@@ -254840,11 +254936,27 @@ var require_github_enforcement = __commonJS({
       const protPath = resolvedBranch ? `repos/${owner}/${repo}/branches/${encodeURIComponent(resolvedBranch)}/protection` : protectionPath;
       const protectionRead = client && protPath ? await client.get(protPath) : null;
       const environmentRead = client && envPath ? await client.get(envPath) : null;
+      let rulesetsRead = null;
+      if (client) {
+        const list = await client.get(`repos/${owner}/${repo}/rulesets`);
+        if (list && list.status === 200 && Array.isArray(list.body)) {
+          const detailed = [];
+          let anyDetailFailed = false;
+          for (const rs of list.body) {
+            if (!rs || rs.id == null) continue;
+            const one = await client.get(`repos/${owner}/${repo}/rulesets/${rs.id}`);
+            if (one && one.status === 200 && one.body) detailed.push(one.body);
+            else anyDetailFailed = true;
+          }
+          rulesetsRead = anyDetailFailed ? null : detailed;
+        }
+      }
       return {
         branch: resolvedBranch,
         repoRead,
         protectionRead,
-        environmentRead
+        environmentRead,
+        rulesetsRead
       };
     }
     module2.exports = {
@@ -255808,6 +255920,7 @@ var require_enforce_check = __commonJS({
       let branch = options.branch ? String(options.branch).trim() : null;
       let protectionRead = null;
       let environmentRead = null;
+      let rulesetsRead = null;
       if (auth.ok) {
         const client = deps.githubClient || createGitHubHttpClient({
           token: auth.token,
@@ -255823,13 +255936,18 @@ var require_enforce_check = __commonJS({
         branch = queried.branch || branch;
         protectionRead = queried.protectionRead;
         environmentRead = queried.environmentRead;
+        rulesetsRead = queried.rulesetsRead;
       }
       const evaluated = evaluateLayers({
         protectionRead,
         environmentRead,
         environmentName,
         local,
-        auth
+        auth,
+        // roadmap 1052a — the ruleset surface, which reads without a credential and can establish
+        // required_check where classic branch protection is unreadable.
+        rulesetsRead,
+        branch
       });
       const report = {
         command: "enforce --check",
@@ -255849,7 +255967,9 @@ var require_enforce_check = __commonJS({
         // response or to our grading of it.
         responses: {
           protection: responseDigest(protectionRead),
-          environment: responseDigest(environmentRead)
+          environment: responseDigest(environmentRead),
+          // null here means NOT READ, which is different from an empty ruleset list.
+          rulesets: rulesetsRead == null ? null : { count: rulesetsRead.length }
         },
         ...evaluated
       };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "6.0.1",
+  "version": "6.1.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",