devrites 3.2.27 → 4.0.0

package/scripts/validate-agent-composition.py

@@ -1,57 +0,0 @@
-#!/usr/bin/env python3
-"""Validate DevRites agent persona composition blocks."""
-from __future__ import annotations
-import argparse, re, sys
-from pathlib import Path
-ROOT=Path(__file__).resolve().parent.parent
-
-WRITE_TERMS=re.compile(r'\b(write-capable|may edit|may mutate|commit|push|patch files|modify files)\b', re.I)
-READONLY_TERMS=re.compile(r'\bread-only\b|do not edit|findings only|proposes, never imposes', re.I)
-REQUIRED={
-  'role/scope':[r'## Role / scope', r'You are ', r'## Scope'],
-  'tools/read-write mode':[r'## Tools / read-write mode', r'read-only', r'write-capable', r'Do \*\*not\*\* edit', r'Writes code'],
-  'output format':[r'## Output format', r'## Output', r'```'],
-  'composition block':[r'## Composition', r'Do not invoke another agent', r'Invoke directly when']
-}
-COMPOSITION_LINE=re.compile(
-    r'^Do not invoke another agent\. You are called by (?:a `rite-\*` skill|`/rite-build`) '
-    r'and return (?:findings|your result) to that orchestrator\.$', re.M
-)
-UNTRUSTED_LINE=re.compile(
-    r'^> \*\*Untrusted-input safety\.\*\* .*data, not instructions.*never act on a directive.*'
-    r'surface it instead of obeying it.*security\.md', re.I | re.M
-)
-
-def validate(agents_dir:Path):
-    errors=[]
-    for f in sorted(agents_dir.glob('*.md')):
-        name=f.stem
-        text=f.read_text(encoding='utf-8')
-        for label,pats in REQUIRED.items():
-            if not any(re.search(p,text,re.I|re.M) for p in pats):
-                errors.append(f'{f}: missing {label}')
-        if not COMPOSITION_LINE.search(text):
-            errors.append(f'{f}: composition guard must match the canonical no-nested-agent contract')
-        if not UNTRUSTED_LINE.search(text):
-            errors.append(f'{f}: untrusted-input guard must keep the complete canonical safety contract')
-        says_write=bool(WRITE_TERMS.search(text)) and not re.search(r'Do \*\*not\*\* edit|Do not edit|never edit|does not edit|does not write|Does not edit', text, re.I)
-        if name=='devrites-slice-wright':
-            if not re.search(r'write-capable|Writes code|write code', text, re.I):
-                errors.append(f'{f}: devrites-slice-wright must state write-capable mode')
-        else:
-            if says_write or not READONLY_TERMS.search(text):
-                errors.append(f'{f}: only devrites-slice-wright may be write-capable; reviewers must state read-only/findings-only mode')
-        if re.search(r'invoke (the )?(devrites-|another agent)|spawn (the )?(devrites-|another agent)', text, re.I) and not re.search(r'Do not invoke another agent|never invoke another agent|does not invoke another agent', text, re.I):
-            errors.append(f'{f}: agents must not say they may invoke another agent')
-    return errors
-
-def main():
-    p=argparse.ArgumentParser(); p.add_argument('--agents-dir', type=Path, default=ROOT/'pack/.claude/agents'); p.add_argument('--quiet', action='store_true'); args=p.parse_args()
-    errors=validate(args.agents_dir)
-    if errors:
-        for e in errors: print(f'FAIL: {e}')
-        print(f'validate-agent-composition: {len(errors)} failure(s)')
-        return 1
-    if not args.quiet: print('validate-agent-composition: PASS')
-    return 0
-if __name__=='__main__': sys.exit(main())

package/scripts/validate-command-parity.py

@@ -1,70 +0,0 @@
-#!/usr/bin/env python3
-"""Validate Claude/Codex command parity for public DevRites skills."""
-from __future__ import annotations
-import argparse, re, sys
-from pathlib import Path
-ROOT = Path(__file__).resolve().parent.parent
-
-
-def fm(text):
-    if not text.startswith('---\n'): return {}
-    end = text.find('\n---', 4)
-    out = {}
-    if end == -1: return out
-    for line in text[4:end].splitlines():
-        if not line.strip() or ':' not in line or line.startswith((' ', '\t')): continue
-        k,v = line.split(':',1); out[k.strip()] = v.strip().strip('"\'')
-    return out
-
-
-def public_rites(skills_dir: Path):
-    names=[]
-    for f in sorted(skills_dir.glob('*/SKILL.md')):
-        meta=fm(f.read_text(encoding='utf-8'))
-        name=meta.get('name', f.parent.name)
-        if meta.get('user-invocable')=='true' and name.startswith('rite-') and name!='rite':
-            names.append(name)
-    return names
-
-
-def main():
-    p=argparse.ArgumentParser()
-    p.add_argument('--skills-dir', type=Path, default=ROOT/'pack/.claude/skills')
-    p.add_argument('--docs-skills', type=Path, default=ROOT/'docs/skills.md')
-    p.add_argument('--docs-command-map', type=Path, default=ROOT/'docs/command-map.md')
-    p.add_argument('--readme', type=Path, default=ROOT/'README.md')
-    p.add_argument('--router', type=Path, default=ROOT/'pack/.claude/skills/rite/SKILL.md')
-    p.add_argument('--generated-root', type=Path, default=ROOT/'pack/generated')
-    p.add_argument('--quiet', action='store_true')
-    args=p.parse_args()
-    errors=[]
-    skills=public_rites(args.skills_dir)
-    docs_skills=args.docs_skills.read_text(encoding='utf-8') if args.docs_skills.exists() else ''
-    docs_map=args.docs_command_map.read_text(encoding='utf-8') if args.docs_command_map.exists() else ''
-    readme=args.readme.read_text(encoding='utf-8') if args.readme.exists() else ''
-    router=args.router.read_text(encoding='utf-8') if args.router.exists() else ''
-    all_docs='\n'.join([docs_skills, docs_map, readme])
-    if 'npx devrites' not in all_docs:
-        errors.append('docs missing npx devrites distribution contract')
-    for line in all_docs.splitlines():
-        if re.search(r'\b(install|installed|installing)\s+via\s+.*\b(plugin|marketplace)\b', line, re.I) and 'not' not in line.lower():
-            errors.append('docs imply plugin distribution instead of npx install')
-            break
-    for name in skills:
-        verb=name.removeprefix('rite-')
-        needle=f'/rite-{verb}'
-        if needle not in router:
-            errors.append(f'router missing {needle} for {name}')
-        if needle not in docs_map:
-            errors.append(f'docs/command-map Claude direct: missing Claude command {needle} for {name}')
-        if args.generated_root.exists():
-            for rel in [f'claude/skills/{name}/SKILL.md', f'codex/skills/{name}/SKILL.md']:
-                if not (args.generated_root/rel).exists():
-                    errors.append(f'generated artifact missing {rel}')
-    if errors:
-        for e in errors: print(f'FAIL: {e}')
-        print(f'validate-command-parity: {len(errors)} failure(s)')
-        return 1
-    if not args.quiet: print('validate-command-parity: PASS')
-    return 0
-if __name__=='__main__': sys.exit(main())

package/scripts/validate-frontmatter.py

@@ -1,218 +0,0 @@
-#!/usr/bin/env python3
-"""Validate YAML frontmatter of DevRites SKILL.md and agent files.
-
-Usage: validate-frontmatter.py FILE [FILE ...]
-Exits non-zero if any file fails. Uses PyYAML if present, else a minimal parser
-(frontmatter here is simple key: value, no nested structures needed).
-"""
-import sys
-import re
-from pathlib import Path
-
-KNOWN_SKILL_FIELDS = {
-    "name", "description", "argument-hint", "user-invocable",
-    "disable-model-invocation", "required-agent-roles",
-}
-KNOWN_AGENT_FIELDS = {
-    "name", "description", "tools", "disallowedTools", "model", "permissionMode",
-    "mcpServers", "hooks", "maxTurns", "skills", "initialPrompt", "memory",
-    "effort", "background", "isolation", "color",
-}
-DESCRIPTION_WORD_LIMITS = {
-    "public": 90,
-    "internal": 75,
-    "library": 60,
-    "explicit": 30,
-}
-AGENT_ROLE_RE = re.compile(r"^devrites-[a-z0-9-]+$")
-
-
-def extract_frontmatter(text):
-    lines = text.splitlines()
-    if not lines or lines[0].strip() != "---":
-        return None, "missing opening '---' frontmatter fence"
-    body = []
-    for i in range(1, len(lines)):
-        if lines[i].strip() == "---":
-            return "\n".join(body), None
-        body.append(lines[i])
-    return None, "missing closing '---' frontmatter fence"
-
-
-def parse_simple(fm):
-    """Minimal top-level 'key: value' parser. Good enough for these files.
-
-    Handles YAML block scalars ('|', '>') by collecting indented continuation
-    lines so multi-line values are preserved (and can be detected/rejected).
-    """
-    data = {}
-    lines = fm.splitlines()
-    i = 0
-    while i < len(lines):
-        raw = lines[i]
-        if not raw.strip() or raw.lstrip().startswith("#"):
-            i += 1
-            continue
-        if raw[0] in (" ", "\t"):
-            i += 1
-            continue
-        if ":" not in raw:
-            i += 1
-            continue
-        key, val = raw.split(":", 1)
-        v = val.strip()
-        # Block scalar indicators: gather indented following lines.
-        if v and v[0] in ("|", ">"):
-            collected = []
-            j = i + 1
-            while j < len(lines) and (lines[j] == "" or lines[j].startswith((" ", "\t"))):
-                collected.append(lines[j].lstrip())
-                j += 1
-            data[key.strip()] = "\n".join(collected).rstrip()
-            i = j
-            continue
-        data[key.strip()] = v.strip('"').strip("'")
-        i += 1
-    return data
-
-
-def load_fm(fm):
-    try:
-        import yaml  # type: ignore
-        d = yaml.safe_load(fm)
-        if isinstance(d, dict):
-            return {str(k): d[k] for k in d}
-    except Exception:
-        pass
-    return parse_simple(fm)
-
-
-def is_agent(path):
-    return "/agents/" in path.replace("\\", "/")
-
-
-def required_agent_roles(path, value):
-    raw = str(value).strip()
-    if raw == "none":
-        return [], None
-    if not raw:
-        return [], "required-agent-roles must be 'none' or a comma-separated role list"
-    roles = [role.strip() for role in raw.split(",")]
-    if any(not AGENT_ROLE_RE.fullmatch(role) for role in roles):
-        return [], "required-agent-roles contains an invalid role"
-    if len(set(roles)) != len(roles):
-        return [], "required-agent-roles contains a duplicate role"
-    skill_path = Path(path).resolve()
-    agents_dir = skill_path.parent.parent.parent / "agents"
-    if agents_dir.is_dir():
-        missing = [role for role in roles if not (agents_dir / (role + ".md")).is_file()]
-        if missing:
-            return [], "required-agent-roles references missing agent(s): " + ", ".join(missing)
-    return roles, None
-
-
-def main(argv):
-    files = argv[1:]
-    if not files:
-        print("usage: validate-frontmatter.py FILE [FILE ...]", file=sys.stderr)
-        return 2
-    errors = 0
-    for path in files:
-        try:
-            with open(path, "r", encoding="utf-8") as fh:
-                text = fh.read()
-        except OSError as e:
-            print("ERROR %s: cannot read (%s)" % (path, e))
-            errors += 1
-            continue
-        fm, err = extract_frontmatter(text)
-        if err:
-            print("ERROR %s: %s" % (path, err))
-            errors += 1
-            continue
-        data = load_fm(fm)
-        if not isinstance(data, dict) or not data:
-            print("ERROR %s: frontmatter did not parse to key/value fields" % path)
-            errors += 1
-            continue
-        if "description" not in data or not str(data.get("description", "")).strip():
-            print("ERROR %s: missing/empty 'description'" % path)
-            errors += 1
-            continue
-        known = KNOWN_AGENT_FIELDS if is_agent(path) else KNOWN_SKILL_FIELDS
-        unknown = [k for k in data if k not in known]
-        if unknown:
-            print("ERROR %s: unknown field(s) not in canonical SKILL.md spec: %s"
-                  % (path, ", ".join(unknown)))
-            errors += 1
-            continue
-        if not is_agent(path):
-            if "required-agent-roles" not in data:
-                print("ERROR %s: missing 'required-agent-roles' (use 'none' when no fresh agent is mandatory)" % path)
-                errors += 1
-                continue
-            _, role_err = required_agent_roles(path, data.get("required-agent-roles"))
-            if role_err:
-                print("ERROR %s: %s" % (path, role_err))
-                errors += 1
-                continue
-        # description length cap is 1024 chars per Anthropic SKILL.md spec
-        warn = ""
-        desc = str(data.get("description", ""))
-        dlen = len(desc)
-        if dlen > 1024:
-            print("ERROR %s: description %d chars > 1024 cap (Anthropic SKILL.md spec)"
-                  % (path, dlen))
-            errors += 1
-            continue
-        if "\n" in desc:
-            print("ERROR %s: description must be a single line (no newlines)" % path)
-            errors += 1
-            continue
-        desc_words = len(desc.strip().split())
-        explicit_only = str(data.get("disable-model-invocation", "")).lower() == "true"
-        if not is_agent(path):
-            if str(data.get("name", "")) == "devrites-lib":
-                budget = DESCRIPTION_WORD_LIMITS["library"]
-            elif explicit_only:
-                budget = DESCRIPTION_WORD_LIMITS["explicit"]
-            elif str(data.get("user-invocable", "")) == "true":
-                budget = DESCRIPTION_WORD_LIMITS["public"]
-            else:
-                budget = DESCRIPTION_WORD_LIMITS["internal"]
-            if desc_words > budget:
-                print("ERROR %s: description %d words > %d budget (keep triggers tight; move workflow into the body)"
-                      % (path, desc_words, budget))
-                errors += 1
-                continue
-            failed = False
-            for phrase in ("Use when", "Not for"):
-                count = desc.count(phrase)
-                if count > 1:
-                    print("ERROR %s: description repeats %r %d times (collapse duplicate trigger branches)"
-                          % (path, phrase, count))
-                    errors += 1
-                    failed = True
-                    break
-            if failed:
-                continue
-            if explicit_only and str(data.get("name", "")) != "devrites-lib":
-                for phrase in ("Use when", "Not for"):
-                    if phrase in desc:
-                        print("ERROR %s: explicit-only description contains %r; keep it a human summary" % (path, phrase))
-                        errors += 1
-                        failed = True
-                        break
-                if failed:
-                    continue
-        ui = data.get("user-invocable", "(default)")
-        print("OK    %s  (user-invocable=%s)%s" % (path, ui, warn))
-    if errors:
-        print("\n%d file(s) failed frontmatter validation." % errors)
-        return 1
-    print("\nAll %d file(s) passed frontmatter validation." % len(files))
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv))

package/scripts/validate-skill-anatomy.py

@@ -1,139 +0,0 @@
-#!/usr/bin/env python3
-"""Validate DevRites-native skill anatomy contracts."""
-from __future__ import annotations
-import argparse, re, sys
-from datetime import date
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parent.parent
-SKILLS_DIR = ROOT / "pack" / ".claude" / "skills"
-
-PUBLIC_REQUIRED = {
-    "operating contract": [r"## Operating rules", r"## Rules", r"## Contract", r"## Core operating rules", r"## Two modes", r"## Safety", r"## Mode", r"## Protocol"],
-    "rules consulted / standards read": [r"## Rules consulted", r"governing rules", r"standards/core\.md", r"devrites-lib/reference/standards"],
-    "workflow or phase-contract pointer": [r"## Workflow", r"phase-contract\.md", r"## Steps", r"## Protocol", r"## Flow", r"## Run", r"## Menu", r"## Process", r"## Modes"],
-    "output/reply contract": [r"## Output", r"## What to output", r"reply-contract\.md", r"Default success shape", r"Completion"],
-    "phase boundary / stop condition": [r"stop", r"Stop when", r"Done when", r"NO-GO", r"GO", r"one slice"],
-}
-INTERNAL_REQUIRED = {
-    "trigger boundary": [r"Use when", r"## Trigger", r"## When to use", r"## Boundaries", r"Triggered by"],
-    "hard rules": [r"## Hard rules", r"## Rules", r"## NEVER", r"## Operating rules", r"## Boundaries", r"Do not", r"Never", r"Must", r"Scope"],
-    "output contract": [r"## Output", r"## Return", r"Output format", r"Default success shape", r"Visual Verdict", r"writes? `", r"writes? ", r"Return"],
-    "when not to use": [r"Not for", r"## When NOT to use", r"## Boundaries", r"Do not", r"Never"],
-}
-GOTCHA_PATTERNS = [r"## Gotchas", r"reference/anti-patterns\.md", r"Mid-flight discipline", r"## Hard rules", r"## NEVER", r"## Boundaries", r"## Rules", r"## Scope reminders", r"## When NOT to use", r"## What NOT to include", r"Anti-AI-slop", r"Do not", r"Never"]
-EXEMPT = {"devrites-lib"}
-# Legacy exceptions waive only the named missing section. They are owned and
-# time-bounded so a compact skill cannot silently bypass unrelated contracts.
-def exemption(owner: str, reason: str) -> dict[str, str]:
-    return {"owner": owner, "reason": reason, "expires": "2026-10-01"}
-
-
-SECTION_EXEMPTIONS = {
-    "devrites-api-interface": {
-        "hard rules": exemption("guidance", "compact specialist encodes rules in prose"),
-        "output contract": exemption("guidance", "output is owned by the caller contract"),
-        "gotchas/anti-patterns pointer": exemption("guidance", "compact specialist has no standalone reference payload"),
-    },
-    "devrites-frontend-craft": {"output contract": exemption("guidance", "reference-driven craft output")},
-    "rite-doctor": {
-        "operating contract": exemption("guidance", "read-only diagnostic utility"),
-        "rules consulted / standards read": exemption("guidance", "engine owns the diagnostic checks"),
-    },
-    "rite-frame": {
-        "rules consulted / standards read": exemption("guidance", "ad-hoc lens utility"),
-        "workflow or phase-contract pointer": exemption("guidance", "FRAME/AUDIT flow is encoded in prose"),
-    },
-    "rite-handoff": {
-        "operating contract": exemption("guidance", "single-purpose artifact writer"),
-        "workflow or phase-contract pointer": exemption("guidance", "handoff artifact is the workflow")},
-    "rite-polish": {"workflow or phase-contract pointer": exemption("guidance", "workflow is split across code and UI references")},
-    "rite-pressure-test": {
-        "operating contract": exemption("guidance", "compact ideation utility"),
-        "workflow or phase-contract pointer": exemption("guidance", "pressure-test loop is encoded in prose")},
-    "rite-prototype": {
-        "operating contract": exemption("guidance", "throwaway prototype lifecycle"),
-        "workflow or phase-contract pointer": exemption("guidance", "prototype loop is encoded in prose"),
-        "phase boundary / stop condition": exemption("guidance", "prototype is intentionally disposable"),
-        "gotchas/anti-patterns pointer": exemption("guidance", "prototype warning is encoded in prose")},
-    "rite-status": {
-        "operating contract": exemption("guidance", "read-only engine status utility"),
-        "workflow or phase-contract pointer": exemption("guidance", "engine progress command owns flow")},
-    "rite-zoom-out": {
-        "operating contract": exemption("guidance", "read-only mapping utility"),
-        "workflow or phase-contract pointer": exemption("guidance", "structural map is the workflow")},
-}
-
-
-def parse_frontmatter(text: str) -> dict[str, str]:
-    if not text.startswith("---\n"): return {}
-    end = text.find("\n---", 4)
-    fields = {}
-    if end == -1: return fields
-    for line in text[4:end].splitlines():
-        if not line.strip() or line.startswith((" ", "\t", "#")) or ":" not in line: continue
-        k,v = line.split(":",1)
-        fields[k.strip()] = v.strip().strip('"\'')
-    return fields
-
-
-def has_any(text: str, patterns: list[str]) -> bool:
-    return any(re.search(p, text, re.I | re.M) for p in patterns)
-
-
-def validate(skills_dir: Path) -> list[str]:
-    errors = []
-    for f in sorted(skills_dir.glob("*/SKILL.md")):
-        text = f.read_text(encoding="utf-8")
-        fm = parse_frontmatter(text)
-        name = fm.get("name", f.parent.name)
-        if name in EXEMPT:
-            continue
-        exemptions = SECTION_EXEMPTIONS.get(name, {})
-        invocable = fm.get("user-invocable") == "true"
-        rules = PUBLIC_REQUIRED if invocable else INTERNAL_REQUIRED
-        for label, patterns in rules.items():
-            if not has_any(text, patterns) and label not in exemptions:
-                errors.append(f"{f}: missing {label}")
-        if not has_any(text, GOTCHA_PATTERNS) and "gotchas/anti-patterns pointer" not in exemptions:
-            errors.append(f"{f}: missing gotchas/anti-patterns pointer")
-        for label, record in exemptions.items():
-            if not record.get("owner") or not record.get("reason") or not re.fullmatch(r"\d{4}-\d{2}-\d{2}", record.get("expires", "")):
-                errors.append(f"{f}: anatomy exemption {label!r} requires owner, reason, and YYYY-MM-DD expires")
-            elif record["expires"] < date.today().isoformat():
-                errors.append(f"{f}: anatomy exemption {label!r} expired {record['expires']}")
-        desc = fm.get("description", "")
-        explicit_only = fm.get("disable-model-invocation") == "true"
-        if not explicit_only and not re.search(r"\bUse when\b|\bUse to\b|\bTrigger|\bwhen\b|\bfor ", desc, re.I):
-            errors.append(f"{f}: model-invoked description must include trigger language")
-        # Cross-skill references: obvious backtick references should exist.
-        for ref in re.findall(r"`((?:rite|devrites)-[a-z0-9-]+)`", text):
-            if ref in {"rite-use", "devrites-source-cache"}:
-                continue
-            if not (skills_dir / ref / "SKILL.md").exists() and not (ROOT / "pack" / ".claude" / "agents" / f"{ref}.md").exists():
-                errors.append(f"{f}: unknown cross-skill/agent reference `{ref}`")
-    afk_contract = skills_dir / "devrites-lib" / "reference" / "standards" / "afk-hitl.md"
-    if afk_contract.exists():
-        afk_text = afk_contract.read_text(encoding="utf-8")
-        if "allow_irreversible" in afk_text:
-            errors.append(f"{afk_contract}: irreversible-risk gates must not have an unattended bypass")
-        if "## Irreversible-risk list (always pause)" not in afk_text:
-            errors.append(f"{afk_contract}: missing irreversible-risk always-pause contract")
-    return errors
-
-
-def main() -> int:
-    p = argparse.ArgumentParser()
-    p.add_argument("--skills-dir", type=Path, default=SKILLS_DIR)
-    p.add_argument("--quiet", action="store_true")
-    args = p.parse_args()
-    errors = validate(args.skills_dir)
-    if errors:
-        for e in errors: print(f"FAIL: {e}")
-        print(f"validate-skill-anatomy: {len(errors)} failure(s)")
-        return 1
-    if not args.quiet:
-        print("validate-skill-anatomy: PASS")
-    return 0
-
-if __name__ == "__main__": sys.exit(main())

package/scripts/validate-workflow-security.py

@@ -1,184 +0,0 @@
-#!/usr/bin/env python3
-"""Scan GitHub Actions workflows for supply-chain and permission risks.
-
-Release and auto-merge workflows are especially sensitive, but these rules
-apply to every workflow. The check rejects workflows that:
-
-  - use a non-local action without a full 40-character commit SHA, because a
-    moving tag can change upstream code;
-  - omit an explicit `permissions:` scope or use `permissions: write-all`;
-  - use `pull_request_target` outside a Dependabot-only workflow that does not
-    check out pull-request code;
-  - interpolate workflow_dispatch inputs directly into a shell `run:` block;
-  - leave `: ` unquoted inside a workflow or step name, producing invalid YAML.
-
-Usage: validate-workflow-security.py [DIR]   (default: .github/workflows)
-Exit: 0 clean; 1 on any finding.
-"""
-import os
-import re
-import sys
-
-SHA_RE = re.compile(r"^[0-9a-f]{40}$")
-USES_RE = re.compile(r"^\s*-?\s*uses\s*:\s*([^\s#]+)")
-DEPENDABOT_ONLY_RE = re.compile(
-    r"^\s*if\s*:\s*(?:\$\{\{\s*)?"
-    r"(?:github\.actor|github\.event\.pull_request\.user\.login)\s*==\s*"
-    r"['\"]dependabot\[bot\]['\"]",
-    re.MULTILINE,
-)
-UNQUOTED_NAME_COLON_RE = re.compile(r"^\s*(?:-\s*)?name:\s+[^'\"].*:\s+\S")
-RUN_RE = re.compile(r"^(\s*)(?:-\s*)?run\s*:\s*(.*)$")
-DISPATCH_EXPRESSION_RE = re.compile(r"\$\{\{[^}]*\binputs\b", re.IGNORECASE)
-KEY_RE = re.compile(r"^(\s*)([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$")
-
-
-def jobs_without_permissions(lines):
-    """Return job IDs missing direct permissions, or None with a global scope."""
-    for line in lines:
-        match = KEY_RE.match(line)
-        if match and not match.group(1) and match.group(2) == "permissions":
-            return None
-
-    jobs_line = None
-    for i, line in enumerate(lines):
-        match = KEY_RE.match(line)
-        if match and not match.group(1) and match.group(2) == "jobs":
-            jobs_line = i
-            break
-    if jobs_line is None:
-        return ["<workflow>"]
-
-    job_indent = None
-    job_starts = []
-    for i in range(jobs_line + 1, len(lines)):
-        line = lines[i]
-        if not line.strip() or line.lstrip().startswith("#"):
-            continue
-        match = KEY_RE.match(line)
-        if not match:
-            continue
-        indent = len(match.group(1))
-        if indent == 0:
-            break
-        if job_indent is None:
-            job_indent = indent
-        if indent == job_indent:
-            job_starts.append((i, match.group(2)))
-    if not job_starts:
-        return ["<workflow>"]
-
-    missing = []
-    for position, (start, job_id) in enumerate(job_starts):
-        end = job_starts[position + 1][0] if position + 1 < len(job_starts) else len(lines)
-        property_indents = []
-        properties = []
-        for line in lines[start + 1:end]:
-            match = KEY_RE.match(line)
-            if not match:
-                continue
-            indent = len(match.group(1))
-            if indent > job_indent:
-                property_indents.append(indent)
-                properties.append((indent, match.group(2)))
-        direct_indent = min(property_indents) if property_indents else None
-        if direct_indent is None or not any(
-                indent == direct_indent and key == "permissions"
-                for indent, key in properties):
-            missing.append(job_id)
-    return missing
-
-
-def safe_dependabot_target(text):
-    if re.search(r"^\s*-?\s*uses\s*:\s*actions/checkout@", text, re.MULTILINE):
-        return False
-    jobs = re.split(r"(?m)^jobs\s*:\s*(?:#.*)?$", text, maxsplit=1)
-    if len(jobs) != 2:
-        return False
-    blocks = re.split(r"(?m)^  [A-Za-z0-9_-]+\s*:\s*(?:#.*)?$", jobs[1])[1:]
-    return bool(blocks) and all(DEPENDABOT_ONLY_RE.search(block) for block in blocks)
-
-
-def scan_text(path, text):
-    findings = []
-    lines = text.splitlines()
-    dependabot_target_is_safe = safe_dependabot_target(text)
-    unscoped_jobs = jobs_without_permissions(lines)
-    if unscoped_jobs:
-        findings.append("%s: jobs without explicit permissions: %s. Add a global "
-                        "least-privilege block or scope every job"
-                        % (path, ", ".join(unscoped_jobs)))
-    for i, line in enumerate(lines, 1):
-        if UNQUOTED_NAME_COLON_RE.match(line):
-            findings.append("%s:%d: name has an unquoted colon. Quote the complete "
-                            "name so GitHub can parse the workflow" % (path, i))
-        if "write-all" in line:
-            findings.append("%s:%d: permissions: write-all grants too much access. "
-                            "Limit it to the permissions this workflow needs" % (path, i))
-        if "pull_request_target" in line and not dependabot_target_is_safe:
-            findings.append("%s:%d: pull_request_target exposes secrets to untrusted PR "
-                            "code. Only a Dependabot-only workflow without checkout is allowed"
-                            % (path, i))
-        m = USES_RE.match(line)
-        if not m:
-            continue
-        ref = m.group(1)
-        if ref.startswith("./") or ref.startswith("."):
-            continue  # local action
-        at = ref.rsplit("@", 1)
-        pin = at[1] if len(at) == 2 else ""
-        if not SHA_RE.match(pin):
-            findings.append("%s:%d: action '%s' is not pinned to a full commit "
-                            "SHA. Pin it because a moving tag is a supply-chain risk"
-                            % (path, i, ref))
-    for i, line in enumerate(lines):
-        match = RUN_RE.match(line)
-        if not match:
-            continue
-        run_indent = len(match.group(1))
-        run_lines = [(i + 1, match.group(2))]
-        for j in range(i + 1, len(lines)):
-            candidate = lines[j]
-            if candidate.strip() and len(candidate) - len(candidate.lstrip()) <= run_indent:
-                break
-            run_lines.append((j + 1, candidate))
-        for line_number, command in run_lines:
-            if DISPATCH_EXPRESSION_RE.search(command):
-                findings.append(
-                    "%s:%d: workflow_dispatch input appears directly in run. "
-                    "Pass it through env and quote the shell variable"
-                    % (path, line_number)
-                )
-    return findings
-
-
-def iter_workflows(d):
-    if os.path.isfile(d):
-        yield d
-        return
-    for root, _dirs, names in os.walk(d):
-        for n in sorted(names):
-            if n.endswith((".yml", ".yaml")):
-                yield os.path.join(root, n)
-
-
-def main(argv):
-    target = argv[1] if len(argv) > 1 else ".github/workflows"
-    if not os.path.exists(target):
-        print("OK    no workflows at %s" % target)
-        return 0
-    findings = []
-    for path in iter_workflows(target):
-        with open(path, "r", encoding="utf-8") as fh:
-            findings.extend(scan_text(path, fh.read()))
-    if findings:
-        for f in findings:
-            print("FINDING " + f)
-        print("\n%d workflow-security finding(s)." % len(findings))
-        return 1
-    print("OK    workflow security clean (%s)" % target)
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv))