tamperward 2.29.10 → 2.29.11

package/README.md

@@ -311,6 +311,8 @@ used for CI-wiring and token-permission posture. A custom verifier workflow ther
 does not get judged against an unrelated/missing generated file, and a second verifier
 workflow with a write-scoped job cannot hide behind a safe canonical workflow.
 
+For this repository, `tamperward doctor --github --repo hexrift/tamperward --branch main` also verifies the active main ruleset's Code Owner requirement, stale-review dismissal, every direct CI check named by `ci.yml`, and the absence of bypass actors. A missing setting is an authority failure, not a warning; run it with a token that can read repository rulesets.
+
 Local early-layer gaps remain posture findings rather than silently changing the
 existing generated-CI exit contract; hard CI/GitHub validation failures still exit 2.
 

package/dist/cli/index.js

@@ -17386,10 +17386,10 @@ function emitReport(opts, checks, authoritative) {
     }
   }
 }
-function evaluateGitHubProtection(snapshot2, requiredCheck = "tamperward") {
-  let hasRequiredCheck = false;
+function evaluateGitHubProtection(snapshot2, requiredCheck = "tamperward", requiredChecks = [requiredCheck]) {
   let hasCodeOwnerReview = false;
   let dismissesStaleReviews = false;
+  const presentChecks = /* @__PURE__ */ new Set();
   if (Array.isArray(snapshot2.rules)) {
     for (const raw of snapshot2.rules) {
       const rule = asMapping(raw);
@@ -17402,10 +17402,10 @@ function evaluateGitHubProtection(snapshot2, requiredCheck = "tamperward") {
       if (rule.type === "required_status_checks") {
         const checks = params.required_status_checks;
         if (Array.isArray(checks)) {
-          hasRequiredCheck ||= checks.some((rawCheck) => {
+          for (const rawCheck of checks) {
             const check2 = asMapping(rawCheck);
-            return check2?.context === requiredCheck;
-          });
+            if (typeof check2?.context === "string") presentChecks.add(check2.context);
+          }
         }
       }
     }
@@ -17418,20 +17418,26 @@ function evaluateGitHubProtection(snapshot2, requiredCheck = "tamperward") {
   if (status) {
     const contexts = status.contexts;
     if (Array.isArray(contexts)) {
-      hasRequiredCheck ||= contexts.some((x) => x === requiredCheck);
+      for (const context of contexts) if (typeof context === "string") presentChecks.add(context);
     }
     const checks = status.checks;
     if (Array.isArray(checks)) {
-      hasRequiredCheck ||= checks.some((rawCheck) => {
+      for (const rawCheck of checks) {
         const check2 = asMapping(rawCheck);
-        return check2?.context === requiredCheck;
-      });
+        if (typeof check2?.context === "string") presentChecks.add(check2.context);
+      }
     }
   }
   const findings = [];
-  if (!hasRequiredCheck) findings.push("require the tamperward status check");
+  const missing = requiredChecks.filter((check2) => !presentChecks.has(check2));
+  if (missing.length) findings.push(
+    missing.length === 1 ? "require the " + missing[0] + " status check" : "require status checks: " + missing.join(", ")
+  );
   if (!hasCodeOwnerReview) findings.push("require Code Owner review");
   if (!dismissesStaleReviews) findings.push("dismiss stale pull request approvals on new pushes");
+  if (Array.isArray(snapshot2.bypassActors) && snapshot2.bypassActors.length > 0) {
+    findings.push("remove unintended ruleset bypass actors");
+  }
   return findings;
 }
 function gitText(cwd, args) {
@@ -17510,7 +17516,32 @@ function githubAuthority(opts, cwd) {
   } catch (e) {
     rulesError = e instanceof Error ? e : new Error(String(e));
   }
-  let findings = evaluateGitHubProtection({ rules });
+  let bypassActors;
+  let rulesetInspectionError = null;
+  try {
+    const rulesets = githubApi(cwd, "repos/" + repo + "/rulesets");
+    const active = Array.isArray(rulesets) ? rulesets.find((raw) => {
+      const item = asMapping(raw);
+      return item?.name === "main" && item?.target === "branch" && item?.enforcement === "active";
+    }) : null;
+    const id = asMapping(active)?.id;
+    if (typeof id !== "number") {
+      rulesetInspectionError = new Error("no active main branch ruleset was found");
+    } else {
+      const detail = asMapping(githubApi(cwd, "repos/" + repo + "/rulesets/" + id));
+      bypassActors = detail?.bypass_actors;
+    }
+  } catch (e) {
+    rulesetInspectionError = e instanceof Error ? e : new Error(String(e));
+  }
+  let findings = evaluateGitHubProtection(
+    { rules, bypassActors },
+    "tamperward",
+    REPOSITORY_REQUIRED_CHECKS
+  );
+  if (rulesetInspectionError) {
+    findings.push("active main ruleset bypass actors could not be verified: " + rulesetInspectionError.message);
+  }
   if (findings.length === 0) return { repo, branch, findings };
   let branchProtection;
   let classicError = null;
@@ -17725,7 +17756,7 @@ function runDoctor(opts = {}) {
   emitReport(opts, outcome.checks, outcome.authoritative);
   return outcome.code;
 }
-var VERIFY_COMMAND, GITHUB_API_SCRIPT;
+var VERIFY_COMMAND, REPOSITORY_REQUIRED_CHECKS, GITHUB_API_SCRIPT;
 var init_doctor = __esm({
   "src/cli/doctor.ts"() {
     "use strict";
@@ -17741,6 +17772,25 @@ var init_doctor = __esm({
     init_narrow();
     init_repo_context();
     VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;
+    REPOSITORY_REQUIRED_CHECKS = [
+      "typecheck",
+      "test (20)",
+      "test (22)",
+      "test (24)",
+      "build",
+      "gate",
+      // platform-contract is a matrix over os: [ubuntu-latest, macos-latest, windows-latest]
+      // (see .github/workflows/ci.yml). GitHub publishes one check context per matrix cell,
+      // named "<job> (<os>)"; the bare job name is never a real context, so it must be
+      // enumerated per cell or the required-status check reports a false authority failure.
+      "platform-contract (ubuntu-latest)",
+      "platform-contract (macos-latest)",
+      "platform-contract (windows-latest)",
+      "harness-core",
+      "round4-harness",
+      "pilot-provisioning",
+      "verifier-container"
+    ];
     GITHUB_API_SCRIPT = [
       "const endpoint = process.argv[1];",
       "const token = process.env.TAMPERWARD_GITHUB_TOKEN || '';",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.10",
+  "version": "2.29.11",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",