vouchington-tooling 0.3.4 → 0.3.6

package/README.md

@@ -7,7 +7,7 @@ npm install vouchington-tooling
 # optional, only if you import vouchington-tooling/sql-ast
 npm install @libpg-query/parser
 # optional, only for vouchington-tooling/agent-blackboard and agent-blackboard CLI commands
-npm install agent-blackboard@^0.3.1
+npm install agent-blackboard@^0.5.0
 ```
 
 ## CLI
@@ -88,7 +88,7 @@ GitHub reports a merged PR whose `baseRefName` is `main`; a merged PR into anoth
 as not merged to main, and a missing base is unavailable.
 
 Agent Blackboard support is optional: only the `agent-blackboard` subpath and its CLI commands
-need `agent-blackboard@^0.3.1`. Snapshot cleanup accepts only package-generated temporary paths.
+need `agent-blackboard@^0.5.0`. Snapshot cleanup accepts only package-generated temporary paths.
 Programmatic callers launched from a different workspace directory pass their own module URL as
 `dependencies: { resolveFrom: import.meta.url }`; the CLI defaults to the current package context.
 It captures a target under a private tombstone, validates partition names, permissions, JSONL,
@@ -154,7 +154,8 @@ import { parseCsvRows, streamCsvRows } from 'vouchington-tooling/csv'
 import { readResponseBody } from 'vouchington-tooling/http-body'
 import { runAstGrepRule } from 'vouchington-tooling/ast-grep-rule'
 import { parseReviewPayload, remapReviewComments } from 'vouchington-tooling/gha-review-payload'
-import { runPostReview } from 'vouchington-tooling/gha-post-review'
+import { postReviewWithTokenFromEnv, runPostReview } from 'vouchington-tooling/gha-post-review'
+import { postClaudeReviewFromEnv } from 'vouchington-tooling/gha-claude-post-review'
 import { nextPageUrlFromLinkHeader } from 'vouchington-tooling/http-link-pagination'
 import {
   cmdUpload,
@@ -168,6 +169,7 @@ import { runCiLocal } from 'vouchington-tooling/ci-local'
 import { rateLimitDelay } from 'vouchington-tooling/gha-rate-limit'
 import { parseCheckpoint } from 'vouchington-tooling/gha-pr-checkpoint'
 import { checkWorkspaceGatesPolicy } from 'vouchington-tooling/workspace-gates'
+import { checkGhaWorkspacePolicy } from 'vouchington-tooling/gha-workspace-policy'
 import { validateNugetUpdate } from 'vouchington-tooling/nuget-central-version'
 import { normalizeSwiftSource } from 'vouchington-tooling/swift-semantic-equal'
 import { parseUniqueSwiftBinaryTargetChecksum } from 'vouchington-tooling/swift-source-offset'
@@ -211,8 +213,9 @@ touch. Recording and report log reads are synchronous: on contention they block
 event loop for up to one second before failing explicitly. Avoid these APIs on hot request paths.
 
 The artifact, review-payload, HTTP body, and pagination APIs validate untrusted inputs at their
-boundaries. Review posting lives in `gha-post-review` and talks to GitHub only through caller-supplied
-credentials (job token or a minted Claude GitHub App token).
+boundaries. Neutral review posting lives in `gha-post-review` and requires a caller-supplied GitHub
+token. Claude App OIDC is an explicitly selected `gha-claude-post-review` adapter; the legacy
+token-source router remains deprecated for one release line.
 
 `vitest-diagnostics` reads Node diagnostic report JSON from a caller-selected directory. It sorts
 filenames, tolerates partial files, returns only a bounded field allowlist, and never emits raw

package/dist/gha-claude-post-review/index.d.mts

@@ -0,0 +1,3 @@
+export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from '../gha-post-review/claude-token.mts';
+export type { ClaudeTokenIo, FetchLike } from '../gha-post-review/claude-token.mts';
+export { postClaudeReviewFromEnv } from '../gha-post-review/github.mts';

package/dist/gha-claude-post-review/index.mjs

@@ -0,0 +1,2 @@
+export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from '../gha-post-review/claude-token.mjs';
+export { postClaudeReviewFromEnv } from '../gha-post-review/github.mjs';

package/dist/gha-post-review/github.d.mts

@@ -17,6 +17,13 @@ export declare function createGhPostReviewIo(options: {
     expectedHeadSha?: string;
     expectedBaseSha?: string;
 }): PostReviewIo;
+/** @deprecated Use postReviewWithTokenFromEnv or postClaudeReviewFromEnv explicitly. */
 export declare function postReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<{
     posted: boolean;
 }>;
+export declare function postReviewWithTokenFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, token?: string | undefined): {
+    posted: boolean;
+};
+export declare function postClaudeReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<{
+    posted: boolean;
+}>;

package/dist/gha-post-review/github.mjs

@@ -103,12 +103,19 @@ export function createGhPostReviewIo(options) {
         },
     };
 }
+/** @deprecated Use postReviewWithTokenFromEnv or postClaudeReviewFromEnv explicitly. */
 export async function postReviewFromEnv(env = process.env, exec = createGhExec(), claudeIo = createActionsClaudeTokenIo(env)) {
+    const token = resolveReviewPostToken(env);
+    if (token.source === 'github-token')
+        return postReviewWithTokenFromEnv(env, exec, token.token);
+    return await postClaudeReviewFromEnv(env, exec, claudeIo);
+}
+function createPostWithToken(env, exec) {
     const repository = requireEnv('GITHUB_REPOSITORY', env);
     const prNumber = requireEnv('PR_NUMBER', env);
     const payloadPath = requireEnv('CODE_REVIEW_PAYLOAD_PATH', env);
     const payloadBytes = readRegularReviewPayload(payloadPath, 'required');
-    const postWithToken = (token) => runPostReview(payloadPath, createGhPostReviewIo({
+    return (token) => runPostReview(payloadPath, createGhPostReviewIo({
         repository,
         prNumber,
         payloadPath,
@@ -118,8 +125,16 @@ export async function postReviewFromEnv(env = process.env, exec = createGhExec()
         expectedHeadSha: env.EXPECTED_HEAD_SHA ?? '',
         expectedBaseSha: env.EXPECTED_BASE_SHA ?? '',
     }));
-    const token = resolveReviewPostToken(env);
-    if (token.source === 'github-token')
-        return postWithToken(token.token);
-    return await withClaudeAppToken(claudeIo, postWithToken);
+}
+function withTokenEnv(exec, env, token) {
+    const tokenEnv = { ...env, GH_TOKEN: token, GITHUB_TOKEN: token };
+    return (args, options) => exec(args, { ...options, env: { ...options?.env, ...tokenEnv } });
+}
+export function postReviewWithTokenFromEnv(env = process.env, exec = createGhExec(), token = env.GH_TOKEN || env.GITHUB_TOKEN) {
+    if (!token)
+        throw new ReviewPayloadError('GH_TOKEN or GITHUB_TOKEN is required.');
+    return createPostWithToken(env, withTokenEnv(exec, env, token))(token);
+}
+export async function postClaudeReviewFromEnv(env = process.env, exec = createGhExec(), claudeIo = createActionsClaudeTokenIo(env)) {
+    return await withClaudeAppToken(claudeIo, (token) => createPostWithToken(env, withTokenEnv(exec, env, token))(token));
 }

package/dist/gha-post-review/index.d.mts

@@ -2,8 +2,12 @@ export { MAX_COMMENTS, MAX_PAYLOAD_BYTES, PostReviewError, runPostReview } from
 export type { PostResult, PostReviewIo, PullFile, ReviewComment, SanitizedReview } from './post.mts';
 export { requireEnv, resolveReviewPostToken } from './token.mts';
 export type { ReviewPostToken } from './token.mts';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
 export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from './claude-token.mts';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
 export type { ClaudeTokenIo, FetchLike } from './claude-token.mts';
-export { createGhExec, createGhPostReviewIo, postReviewFromEnv, postWithGh, writePostedOutput, } from './github.mts';
+export { createGhExec, createGhPostReviewIo, postReviewWithTokenFromEnv, postWithGh, writePostedOutput, } from './github.mts';
+/** @deprecated Select an explicit posting adapter. */
+export { postClaudeReviewFromEnv, postReviewFromEnv } from './github.mts';
 export type { GhExec } from './github.mts';
 export { runPostReviewCli } from './cli.mts';

package/dist/gha-post-review/index.mjs

@@ -1,5 +1,8 @@
 export { MAX_COMMENTS, MAX_PAYLOAD_BYTES, PostReviewError, runPostReview } from './post.mjs';
 export { requireEnv, resolveReviewPostToken } from './token.mjs';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
 export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from './claude-token.mjs';
-export { createGhExec, createGhPostReviewIo, postReviewFromEnv, postWithGh, writePostedOutput, } from './github.mjs';
+export { createGhExec, createGhPostReviewIo, postReviewWithTokenFromEnv, postWithGh, writePostedOutput, } from './github.mjs';
+/** @deprecated Select an explicit posting adapter. */
+export { postClaudeReviewFromEnv, postReviewFromEnv } from './github.mjs';
 export { runPostReviewCli } from './cli.mjs';

package/dist/gha-post-review/token.d.mts

@@ -4,5 +4,6 @@ export type ReviewPostToken = {
 } | {
     source: 'claude-app';
 };
+/** @deprecated Select an explicit posting adapter instead of the legacy token-source router. */
 export declare function resolveReviewPostToken(env?: NodeJS.ProcessEnv): ReviewPostToken;
 export declare function requireEnv(name: string, env?: NodeJS.ProcessEnv): string;

package/dist/gha-post-review/token.mjs

@@ -1,4 +1,5 @@
 import { ReviewPayloadError } from '../gha-review-payload/index.mjs';
+/** @deprecated Select an explicit posting adapter instead of the legacy token-source router. */
 export function resolveReviewPostToken(env = process.env) {
     const source = env.CODE_REVIEW_TOKEN_SOURCE || 'claude-app';
     if (source === 'github-token') {

package/dist/gha-workspace-policy/docker-workspace-user.d.mts

@@ -0,0 +1,2 @@
+import { type GhaFileKind } from './shared.mts';
+export declare function checkDockerWorkspaceUserDocument(file: string, document: unknown, kind: GhaFileKind, errors: string[]): void;

package/dist/gha-workspace-policy/docker-workspace-user.mjs

@@ -0,0 +1,208 @@
+import { visitRunSteps } from './shared.mjs';
+const WORKSPACE_RE = /(?:\$\{?GITHUB_WORKSPACE\}?|\$\{\{\s*github\.workspace\s*\}\})/iu;
+const DOCKER_GLOBAL_FLAG_OPTIONS = new Set(['--debug', '-D', '--help', '--tls', '--tlsverify']);
+const DOCKER_GLOBAL_VALUE_OPTIONS = new Set([
+    '--config',
+    '--context',
+    '-c',
+    '--host',
+    '-H',
+    '--log-level',
+    '-l',
+    '--tlscacert',
+    '--tlscert',
+    '--tlskey',
+]);
+const FLAG_OPTIONS = new Set([
+    '--detach',
+    '-d',
+    '--init',
+    '--interactive',
+    '-i',
+    '--privileged',
+    '--publish-all',
+    '-P',
+    '--read-only',
+    '--rm',
+    '--tty',
+    '-t',
+]);
+export function checkDockerWorkspaceUserDocument(file, document, kind, errors) {
+    visitRunSteps(document, kind === 'action', (scope, index, step) => {
+        if (typeof step.run !== 'string')
+            return;
+        for (const block of dockerRunBlocks(step.run)) {
+            const options = dockerOptions(block);
+            if (!options)
+                continue;
+            const writable = options.volumes.filter((volume) => WORKSPACE_RE.test(volume) && !isReadOnlyVolume(volume));
+            if (writable.length === 0 || hasHostUserMapping(options.user))
+                continue;
+            errors.push(`::error file=${file}::${file}: ${scope} step ${index} runs Docker with a writable ` +
+                `GITHUB_WORKSPACE mount (${writable.join(', ')}) but no --user host UID:GID mapping. ` +
+                'Use --user "$(id -u):$(id -g)" or make the workspace mount read-only.');
+        }
+    });
+}
+function shellTokens(input) {
+    const tokens = [];
+    let token = '';
+    let quote = '';
+    let substitutionDepth = 0;
+    let githubExpression = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const character = input[index];
+        if (githubExpression) {
+            token += character;
+            if (character === '}' && input[index + 1] === '}') {
+                token += '}';
+                index += 1;
+                githubExpression = false;
+            }
+            continue;
+        }
+        if (substitutionDepth > 0) {
+            token += character;
+            if (character === '(')
+                substitutionDepth += 1;
+            if (character === ')')
+                substitutionDepth -= 1;
+            continue;
+        }
+        if (character === '$' && input[index + 1] === '{' && input[index + 2] === '{') {
+            token += '${{';
+            index += 2;
+            githubExpression = true;
+            continue;
+        }
+        if (character === '$' && input[index + 1] === '(') {
+            token += '$(';
+            substitutionDepth = 1;
+            index += 1;
+            continue;
+        }
+        if (quote) {
+            if (character === '\\' && input[index + 1] !== undefined)
+                token += input[++index];
+            else if (character === quote)
+                quote = '';
+            else
+                token += character;
+            continue;
+        }
+        if (character === '"' || character === "'") {
+            quote = character;
+            continue;
+        }
+        if (/\s/u.test(character)) {
+            if (token)
+                tokens.push(token);
+            token = '';
+            continue;
+        }
+        if (character === '#' && !token)
+            break;
+        if (character === ';' || character === '|' || character === '&') {
+            if (token)
+                tokens.push(token);
+            token = '';
+            if ((character === '&' || character === '|') && input[index + 1] === character)
+                index += 1;
+            tokens.push(character);
+            continue;
+        }
+        if (character === '\\' && input[index + 1] !== undefined)
+            token += input[++index];
+        else
+            token += character;
+    }
+    if (token)
+        tokens.push(token);
+    return tokens;
+}
+function dockerRunBlocks(run) {
+    const blocks = [];
+    const lines = run.split('\n');
+    for (let index = 0; index < lines.length; index += 1) {
+        if (!/\bdocker\b/u.test(lines[index]))
+            continue;
+        let block = lines[index];
+        while (block.trimEnd().endsWith('\\') && index + 1 < lines.length) {
+            index += 1;
+            block = `${block.trimEnd().slice(0, -1)} ${lines[index]}`;
+        }
+        blocks.push(block);
+    }
+    return blocks;
+}
+function findDockerCommand(tokens) {
+    let commandStart = true;
+    for (const [index, token] of tokens.entries()) {
+        if (token === ';' || token === '|' || token === '&') {
+            commandStart = true;
+            continue;
+        }
+        if (!commandStart)
+            continue;
+        if (/^[A-Za-z_][A-Za-z0-9_]*=.*/u.test(token))
+            continue;
+        if (token === 'docker')
+            return index;
+        commandStart = false;
+    }
+    return -1;
+}
+function dockerOptions(block) {
+    const tokens = shellTokens(block);
+    const dockerIndex = findDockerCommand(tokens);
+    if (dockerIndex < 0)
+        return undefined;
+    let start = dockerIndex + 1;
+    while (start < tokens.length && tokens[start].startsWith('-')) {
+        const option = tokens[start];
+        const name = option.includes('=') ? option.slice(0, option.indexOf('=')) : option;
+        if (DOCKER_GLOBAL_FLAG_OPTIONS.has(name) || option.includes('='))
+            start += 1;
+        else if (DOCKER_GLOBAL_VALUE_OPTIONS.has(name))
+            start += 2;
+        else
+            return undefined;
+    }
+    if (tokens[start] === 'container')
+        start += 1;
+    if (tokens[start] !== 'run')
+        return undefined;
+    start += 1;
+    const volumes = [];
+    let user;
+    for (let index = start; index < tokens.length; index += 1) {
+        const option = tokens[index];
+        if (!option.startsWith('-'))
+            break;
+        const equals = option.indexOf('=');
+        const compact = option.startsWith('-v') || option.startsWith('-u');
+        const name = equals > 0
+            ? option.slice(0, equals)
+            : compact && option.length > 2
+                ? option.slice(0, 2)
+                : option;
+        const inlineValue = equals > 0
+            ? option.slice(equals + 1)
+            : compact && option.length > 2
+                ? option.slice(2)
+                : undefined;
+        const bundledFlags = /^-[diPt]{2,}$/u.test(option);
+        const value = inlineValue ?? (FLAG_OPTIONS.has(name) || bundledFlags ? undefined : tokens[++index]);
+        if ((name === '-v' || name === '--volume' || name === '--mount') && value !== undefined)
+            volumes.push(value);
+        if ((name === '-u' || name === '--user') && value !== undefined)
+            user = value;
+    }
+    return { user, volumes };
+}
+function hasHostUserMapping(value) {
+    return value !== undefined && /^\$\(\s*id\s+-u\s*\):\$\(\s*id\s+-g\s*\)$/u.test(value);
+}
+function isReadOnlyVolume(value) {
+    return /(?:^|:)ro(?:$|,)/u.test(value) || /(?:^|,)readonly(?:$|,)/u.test(value);
+}

package/dist/gha-workspace-policy/index.d.mts

@@ -0,0 +1,8 @@
+import type { SharedContext } from '../shared-context/index.mts';
+export interface GhaWorkspacePolicyOptions {
+    workflowDirectories?: readonly string[];
+    actionDirectories?: readonly string[];
+}
+export declare function checkGhaWorkspacePolicy(ctx: SharedContext, options?: GhaWorkspacePolicyOptions): Promise<{
+    errors: string[];
+}>;

package/dist/gha-workspace-policy/index.mjs

@@ -0,0 +1,17 @@
+import { checkDockerWorkspaceUserDocument } from './docker-workspace-user.mjs';
+import { ghaFileKind, loadWorkflowDocument } from './shared.mjs';
+import { checkNoSparseCheckoutDocument } from './sparse-checkout.mjs';
+export async function checkGhaWorkspacePolicy(ctx, options = {}) {
+    const errors = [];
+    if (!ctx.isInsideGitRepo)
+        return { errors };
+    for (const file of ctx.trackedFiles) {
+        const kind = ghaFileKind(file, options);
+        if (!kind)
+            continue;
+        const document = loadWorkflowDocument(ctx, file, errors);
+        checkNoSparseCheckoutDocument(file, document, kind, errors);
+        checkDockerWorkspaceUserDocument(file, document, kind, errors);
+    }
+    return { errors };
+}

package/dist/gha-workspace-policy/shared.d.mts

@@ -0,0 +1,6 @@
+import type { SharedContext } from '../shared-context/index.mts';
+import type { GhaWorkspacePolicyOptions } from './index.mts';
+export type GhaFileKind = 'workflow' | 'action';
+export declare function ghaFileKind(file: string, options: GhaWorkspacePolicyOptions): GhaFileKind | undefined;
+export declare function loadWorkflowDocument(ctx: SharedContext, file: string, errors: string[]): unknown;
+export declare function visitRunSteps(document: unknown, isAction: boolean, visitor: (scope: string, index: number, step: Record<string, unknown>) => void): void;

package/dist/gha-workspace-policy/shared.mjs

@@ -0,0 +1,54 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as load } from 'yaml';
+export function ghaFileKind(file, options) {
+    const workflowDirectories = options.workflowDirectories ?? ['.github/workflows'];
+    const actionDirectories = options.actionDirectories ?? ['.github/actions'];
+    if (workflowDirectories.some((directory) => file.startsWith(`${directory.replace(/\/$/u, '')}/`)) &&
+        /\.ya?ml$/u.test(file))
+        return 'workflow';
+    if (actionDirectories.some((directory) => file.startsWith(`${directory.replace(/\/$/u, '')}/`)) &&
+        /\/action\.ya?ml$/u.test(file))
+        return 'action';
+    return undefined;
+}
+export function loadWorkflowDocument(ctx, file, errors) {
+    try {
+        const content = ctx.readTrackedFile?.(file) ?? readFileSync(join(ctx.repoRoot, file), 'utf8');
+        return load(content);
+    }
+    catch (error) {
+        errors.push(`::error file=${file}::${file}: invalid YAML (${error.message})`);
+        return undefined;
+    }
+}
+export function visitRunSteps(document, isAction, visitor) {
+    if (!document || typeof document !== 'object')
+        return;
+    if (isAction) {
+        const runs = document.runs;
+        if (!runs || typeof runs !== 'object')
+            return;
+        visitSteps('action', runs.steps, visitor);
+        return;
+    }
+    const jobs = document.jobs;
+    if (!jobs || typeof jobs !== 'object')
+        return;
+    for (const [jobId, value] of Object.entries(jobs)) {
+        if (!value || typeof value !== 'object')
+            continue;
+        const job = value;
+        if (typeof job.uses === 'string')
+            continue;
+        visitSteps(`job "${jobId}"`, job.steps, visitor);
+    }
+}
+function visitSteps(scope, value, visitor) {
+    if (!Array.isArray(value))
+        return;
+    value.forEach((step, index) => {
+        if (step && typeof step === 'object')
+            visitor(scope, index, step);
+    });
+}

package/dist/gha-workspace-policy/sparse-checkout.d.mts

@@ -0,0 +1,2 @@
+import { type GhaFileKind } from './shared.mts';
+export declare function checkNoSparseCheckoutDocument(file: string, document: unknown, kind: GhaFileKind, errors: string[]): void;

package/dist/gha-workspace-policy/sparse-checkout.mjs

@@ -0,0 +1,28 @@
+import { visitRunSteps } from './shared.mjs';
+const SPARSE_CHECKOUT_KEYS = ['sparse-checkout', 'sparse-checkout-cone-mode'];
+const SPARSE_CHECKOUT_COMMANDS = [
+    /\bgit\b[^\n;&|]*\bsparse-checkout\s+(?:init|set|add|reapply)\b/iu,
+    /\bgit\b[^\n;&|]*\bconfig\b[^\n;&|]*\bcore\.sparseCheckout(?:Cone)?(?:\s*=\s*|\s+)(?:"|')?(?:true|yes|on|1)(?:"|')?(?=\s|;|$)/iu,
+];
+export function checkNoSparseCheckoutDocument(file, document, kind, errors) {
+    visitRunSteps(document, kind === 'action', (scope, index, step) => {
+        const run = step.run;
+        const normalizedRun = typeof run === 'string' ? run.replace(/\\\r?\n\s*/gu, ' ') : '';
+        if (SPARSE_CHECKOUT_COMMANDS.some((pattern) => pattern.test(normalizedRun))) {
+            errors.push(`::error file=${file}::${file}: ${scope} step ${index} enables sparse checkout. ` +
+                'Use a full checkout; commands that disable or unset sparse-checkout state remain allowed.');
+        }
+        if (typeof step.uses !== 'string' || !step.uses.startsWith('actions/checkout@'))
+            return;
+        const withValue = step.with;
+        if (!withValue || typeof withValue !== 'object')
+            return;
+        for (const key of SPARSE_CHECKOUT_KEYS) {
+            if (!(key in withValue))
+                continue;
+            errors.push(`::error file=${file}::${file}: ${scope} step ${index} passes "${key}" to ` +
+                'actions/checkout. Persistent runners reuse workspace directories, so leaked ' +
+                'sparse-checkout state can silently narrow a later checkout. Check out the full tree.');
+        }
+    });
+}

package/dist/index.d.mts

@@ -15,6 +15,8 @@ export type { ForeignKey, SqlCreateIndexMetadata, SqlCreateTableColumn, SqlCreat
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mts';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mts';
 export type { GhApiExecutor, RuntimeAuditOptions, RuntimeAuditResult, RuntimeAuditWorkflowFilter, RuntimeJobResult, RuntimeSample, } from './gha-runtime-audit/index.mts';
+export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mts';
+export type { GhaWorkspacePolicyOptions } from './gha-workspace-policy/index.mts';
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mts';
 export type { InspectedVitestBlobBundle, VitestBlobIdentity, VitestBlobManifest, VitestReportAttempt, VitestReportAttemptIdentity, } from './vitest-blob-manifest/index.mts';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mts';
@@ -45,8 +47,12 @@ export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mts'
 export type { AstGrepRuleInvocation, RunAstGrepRuleOptions } from './ast-grep-rule/index.mts';
 export { indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mts';
 export type { CommentableIndex, CommentableLine, LineKind, PayloadRequirement, ReviewComment, ReviewFile, ReviewSide, SanitizedReview, } from './gha-review-payload/index.mts';
-export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, PostReviewError, requireEnv, resolveReviewPostToken, revokeClaudeAppToken, runPostReview, runPostReviewCli, withClaudeAppToken, } from './gha-post-review/index.mts';
-export type { ClaudeTokenIo, PostResult, PostReviewIo, PullFile, ReviewPostToken, } from './gha-post-review/index.mts';
+export { PostReviewError, requireEnv, runPostReview, runPostReviewCli, postReviewWithTokenFromEnv, } from './gha-post-review/index.mts';
+export type { PostResult, PostReviewIo, PullFile } from './gha-post-review/index.mts';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
+export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, resolveReviewPostToken, revokeClaudeAppToken, withClaudeAppToken, } from './gha-post-review/index.mts';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
+export type { ClaudeTokenIo, ReviewPostToken } from './gha-post-review/index.mts';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mts';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mts';
 export type { ExpectedTransportIdentity, ObjectSigner, PresignIdentity, TransportControl, } from './coverage-transport/index.mts';

package/dist/index.mjs

@@ -8,6 +8,7 @@ export { EphemeralListenerAttemptsExhaustedError, isRunnerReservedPort, listenOn
 export { extractAlterTableAddColumnLocations, extractCreateIndexMetadata, extractCreateTableMetadata, extractDefaultFunction, extractDropIndexMetadata, extractFuncCallArgColumnNames, extractMigrationConstraintMetadata, initSqlAst, lineOfUtf8ByteOffset, MissingSqlAstParserError, parseSql, } from './sql-ast/index.mjs';
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mjs';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mjs';
+export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mjs';
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mjs';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mjs';
 export { findWorkspaceLinkMismatches, formatReleaseAgeFailure, INSTALL_TERMINATION_FAILED, isReleaseAgeViolation, parseInstallOptions, parseReleaseAgeViolations, runInstallLifecycle, } from './pnpm-install/index.mjs';
@@ -25,7 +26,9 @@ export { escapeSpreadsheetFormula, parseCsvRows, streamCsvRows, stripCsvBom } fr
 export { MissingResponseBodyError, readResponseBody, readResponseBodyAsBuffer, ResponseBodyTooLargeError, } from './http-body/index.mjs';
 export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mjs';
 export { indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mjs';
-export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, PostReviewError, requireEnv, resolveReviewPostToken, revokeClaudeAppToken, runPostReview, runPostReviewCli, withClaudeAppToken, } from './gha-post-review/index.mjs';
+export { PostReviewError, requireEnv, runPostReview, runPostReviewCli, postReviewWithTokenFromEnv, } from './gha-post-review/index.mjs';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
+export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, resolveReviewPostToken, revokeClaudeAppToken, withClaudeAppToken, } from './gha-post-review/index.mjs';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mjs';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mjs';
 export { EPOCH_PRUNED_AT, normalizeDeployedLayer, pruneDeployedRuntimeDeps, restoreDeployedWorkspacePackages, } from './pnpm-deploy/index.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -76,6 +76,11 @@
       "import": "./dist/gha-runtime-audit/index.mjs",
       "default": "./dist/gha-runtime-audit/index.mjs"
     },
+    "./gha-workspace-policy": {
+      "types": "./dist/gha-workspace-policy/index.d.mts",
+      "import": "./dist/gha-workspace-policy/index.mjs",
+      "default": "./dist/gha-workspace-policy/index.mjs"
+    },
     "./vitest-blob-manifest": {
       "types": "./dist/vitest-blob-manifest/index.d.mts",
       "import": "./dist/vitest-blob-manifest/index.mjs",
@@ -161,6 +166,11 @@
       "import": "./dist/gha-post-review/index.mjs",
       "default": "./dist/gha-post-review/index.mjs"
     },
+    "./gha-claude-post-review": {
+      "types": "./dist/gha-claude-post-review/index.d.mts",
+      "import": "./dist/gha-claude-post-review/index.mjs",
+      "default": "./dist/gha-claude-post-review/index.mjs"
+    },
     "./http-link-pagination": {
       "types": "./dist/http-link-pagination/index.d.mts",
       "import": "./dist/http-link-pagination/index.mjs",
@@ -250,7 +260,7 @@
   },
   "devDependencies": {
     "@types/picomatch": "^4.0.3",
-    "agent-blackboard": "^0.3.1"
+    "agent-blackboard": "^0.5.0"
   },
   "optionalDependencies": {
     "@libpg-query/parser": "^18.0.0"

package/scripts/gha/clean-workspace.sh

@@ -65,11 +65,53 @@ workspace_sentinel_key() {
   shasum -a 256 | awk '{print $1}'
 }
 
-if ! git reset --hard HEAD; then
+clear_sparse_checkout_state() {
+  "${full_checkout_git[@]}" sparse-checkout disable >/dev/null 2>&1 || true
+  local key
+  for key in core.sparseCheckout core.sparseCheckoutCone; do
+    git config --worktree --unset-all "${key}" || true
+    git config --local --unset-all "${key}" || true
+    if git config --worktree --get "${key}" >/dev/null 2>&1 ||
+      git config --local --get "${key}" >/dev/null 2>&1; then
+      echo "::error::Sparse checkout config ${key} remains enabled after cleanup."
+      return 1
+    fi
+  done
+}
+
+index_requires_recovery() {
+  "${full_checkout_git[@]}" update-index --refresh >/dev/null 2>&1 || return 0
+  if "${full_checkout_git[@]}" ls-files -v | grep -q '^S '; then
+    return 0
+  fi
+  "${full_checkout_git[@]}" diff-index --quiet --ignore-submodules=all HEAD -- || return 0
+  return 1
+}
+
+recover_full_index() {
+  local started_at=${SECONDS}
+  local tracked_paths
+  tracked_paths="$("${full_checkout_git[@]}" ls-tree -r --name-only HEAD | wc -l | tr -d ' ')"
+  rm -f -- "$(git rev-parse --git-path index)"
+  "${full_checkout_git[@]}" read-tree --empty
+  "${full_checkout_git[@]}" reset --hard HEAD
+  echo "::warning::Full workspace index recovery restored ${tracked_paths} tracked paths in $((SECONDS - started_at))s."
+}
+
+full_checkout_git=(git -c core.sparseCheckout=false -c core.sparseCheckoutCone=false)
+clear_sparse_checkout_state
+reset_failed=false
+if ! "${full_checkout_git[@]}" reset --hard HEAD; then
   echo "::warning::git reset --hard failed; reclaiming workspace write bits and retrying once."
   restore_workspace_write_bits ||
     echo "::warning::Could not restore workspace write bits completely; retrying git reset with the repaired subset."
-  git reset --hard HEAD
+  if ! "${full_checkout_git[@]}" reset --hard HEAD; then
+    reset_failed=true
+  fi
+fi
+if [ "${reset_failed}" = "true" ] || index_requires_recovery; then
+  echo "::warning::Git index corruption remained after bounded cleanup; starting full recovery."
+  recover_full_index
 fi
 excludes=()
 # Trust-gate: a fork pull request is the only untrusted case.
@@ -153,6 +195,10 @@ if ! git clean -ffdx "${excludes[@]+"${excludes[@]}"}"; then
     echo "::warning::Could not restore workspace write bits completely; retrying git clean with the repaired subset."
   git clean -ffdx "${excludes[@]+"${excludes[@]}"}"
 fi
+if index_requires_recovery; then
+  echo "::warning::Git index corruption detected after clean; starting full recovery."
+  recover_full_index
+fi
 # Runs that preserve node_modules retain them for install speed.
 # Drop TypeScript incremental build info inside those preserved trees
 # so stale virtual-store paths do not survive dependency graph changes.

package/skills/dependabot/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: dependabot
+description: Configure or audit Dependabot coverage, cooldowns, package-family grouping, trusted CI, and conservative auto-merge policy for a repository.
+---
+
+# Dependabot policy
+
+Read every applicable `AGENTS.md` and `CLAUDE.md`, then the repository's dependency, CI, release,
+and branch-protection documentation. The consumer wrapper owns the accepted cooldown, package roots,
+first-party publishers, manual-update exceptions, runner policy, required checks, and secret source.
+
+## Cover the dependency graph
+
+1. Inventory tracked manifests, lockfiles, Dockerfiles, workflow actions, infrastructure roots, and
+   any companion dependency bot. Add one Dependabot update entry for every supported ecosystem and
+   manifest root, without creating competing ownership for a dependency already assigned elsewhere.
+2. Schedule version checks daily. Set `cooldown.default-days` to the consumer's release delay; use
+   seven days unless local policy explicitly chooses another value. Cooldown applies to version
+   updates, not security updates.
+3. Set `open-pull-requests-limit: 5` on every update entry. This is a per-entry version-update
+   limit, not a repository-wide or security-update limit. A consumer may use a lower value when a
+   serialized repair or manual validation path requires it.
+4. Keep security updates enabled and immediate. Do not use a custom age gate to delay vulnerability
+   fixes.
+
+## Group package families
+
+Build groups around packages that form one compatibility family or release train, not around version
+types. Inspect manifests, peer dependencies, lockfiles, and upstream release practices to identify
+packages that should move together. For example:
+
+```yaml
+cooldown:
+  default-days: 2
+  exclude: ['@acme/*', 'acme-cli']
+groups:
+  first-party:
+    patterns: ['@acme/*', 'acme-cli']
+  oxc:
+    patterns: ['oxlint', 'oxfmt', 'oxlint-tsgolint']
+  vitest:
+    patterns: ['vitest', '@vitest/*', '@vitejs/*']
+  react:
+    patterns: ['react', 'react-dom']
+  react-security:
+    applies-to: 'security-updates'
+    patterns: ['react', 'react-dom']
+  react-email:
+    patterns: ['react-email', '@react-email/*']
+```
+
+- Name each group after the package, toolchain, framework, or verified release family it represents.
+  Prefer narrow namespace or prefix wildcards such as `@vitest/*` when that wildcard maps to one
+  compatibility family, and put more specific families before broader ones.
+- Do not create generic groups such as `other-minor-and-patch`, `minor-and-patch`,
+  `security-minor-and-patch`, or `security-updates`. Do not use the bare catch-all
+  `patterns: ['*']` merely to ensure every update belongs to a group. Narrow family wildcards are
+  expected. Leave unrelated packages ungrouped so Dependabot opens independently reviewable pull
+  requests for them.
+- Omit `update-types` from package-family groups so each family receives major, minor, and patch
+  updates. Major updates remain human-reviewed under the auto-merge policy; excluding them from a
+  family group only makes the release train harder to update coherently.
+- Groups default to `applies-to: version-updates`. When the same package-family relationship also
+  makes a joint security upgrade safe, define a separately named family group such as
+  `react-security` with the same package patterns and `applies-to: security-updates`. Never combine
+  unrelated vulnerability fixes into a generic security group.
+- Keep verified first-party packages in a dedicated `first-party` group. For a namespace wholly
+  controlled by the owner, prefer its scoped wildcard such as `@acme/*`; keep unscoped packages as
+  explicit names. Use the same patterns in `cooldown.exclude` so first-party updates have zero-day
+  eligibility while third-party packages retain the configured release delay. A grouped pull
+  request is auto-mergeable only when every included update is eligible.
+
+## Exempt verified first-party releases
+
+Use `cooldown.exclude` only for first-party packages whose owning repository and default-branch
+release workflow have been verified. The workflow must publish that package through OIDC with
+`id-token: write` and without a long-lived registry token. A namespace wildcard is appropriate only
+when the owner controls the entire namespace and intends future packages to inherit the exemption;
+otherwise use exact package names. Keep the consumer-owned registry, documentation, cooldown
+exclusions, and first-party group synchronized.
+
+## Preserve the trust boundary
+
+Use a trusted default-branch `pull_request_target` workflow only for metadata inspection and the
+minimal auto-merge mutation. Revalidate the live pull request, Dependabot identity, default base,
+same-repository `dependabot/` head, and immutable base/head SHAs. Never check out or execute pull
+request code in that privileged workflow, and pin external actions according to local policy.
+
+Auto-merge only verified semantic-version patches and stable minor updates whose old and new major
+versions are at least 1. Majors, pre-1.0 minors, prereleases, downgrades, malformed or inconsistent
+metadata, and consumer-declared manual ecosystems require human action. Enable platform auto-merge;
+do not auto-approve. Required checks and branch rules remain the merge gate.
+
+Use a dedicated `DEPENDABOT_AUTOMERGE_TOKEN` stored as a Dependabot secret, not only as an Actions
+secret. Grant only the repository Contents and Pull requests access needed to enable or disable
+auto-merge, and fail an eligible mutation visibly when the token is absent or underprivileged.
+
+Dependabot-triggered workflows cannot assume ordinary Actions secrets or trusted OIDC access. Copy
+only narrowly scoped credentials required for mandatory tests into Dependabot secret scope. For
+cloud, deployment, production, or otherwise privileged checks, keep credential-free validation
+running and make the trusted portion explicitly skipped or not applicable for Dependabot. Required
+fan-in jobs must distinguish that intentional state from an unexpected missing credential.
+
+## Validate and roll out
+
+Parse the final YAML, run the repository's workflow checker and policy tests, and inspect the diff
+for uncovered manifests, overlapping groups, broad exemptions, secret exposure, or pull request code
+crossing a privileged boundary. Verify repository settings for dependency security updates and
+auto-merge. After the configuration reaches the default branch, inspect Dependabot logs for every
+configured root and verify representative patch, minor, major, security, manual, and missing-secret
+paths.

package/skills/github-actions-authoring/SKILL.md

@@ -28,6 +28,16 @@ runner labels, permissions, action pins, concurrency, secrets, and required-chec
    deployments and services. A scheduled reconciliation workflow may repair missed events, but it
    must inspect a snapshot once and exit; it must not wait for convergence.
 
+## Persistent workspaces
+
+Check out the full tree and prevent sparse-checkout configuration with a YAML-aware policy over
+tracked workflow and action files. Correct the producer of unsafe workspace state: writable workspace
+bind mounts use a non-root identity whose ownership and write access are compatible with the runner.
+Do not make each job traverse the whole workspace before checkout to repair permissions. Drain and
+migrate an already contaminated runner once. At runtime, repair may cover bounded known generated
+paths; a workspace-wide fallback must stay failure-gated, same-filesystem, directory-only, and batched,
+with path-count and timing evidence in its diagnostics.
+
 ## Reject polling designs
 
 Do not add a sleep-and-read loop, repeated run/check/deployment/lease/service queries, a CLI waiter,

package/skills/github-actions-checklist/SKILL.md

@@ -16,6 +16,22 @@ Apply this portable baseline unless a stricter repository-local rule overrides i
   pull-request content.
 - Load [github-actions-authoring](../github-actions-authoring/SKILL.md) when changing orchestration.
   Do not poll remote workflow, deployment, lease, service, or health state.
+- Required checks must be actual workflow jobs that execute or aggregate the work they report.
+  Workflow code must not create or publish check runs or commit statuses merely to synthesize a
+  required context, copy another workflow's conclusion, or bypass the event graph. A purpose-built
+  external CI or analysis integration may report its own result; do not use its API as a relay for
+  work owned by GitHub Actions.
+- On `main`, or the consumer's configured default branch, split test jobs by domain such as web and
+  backend instead of hiding unrelated suites in one monolithic test job. Keep domain job names stable
+  when they are required checks, and use a real bounded fan-in job only when the merge contract needs
+  one combined result.
+- Serialize test runs for the same pull request or default branch with a stable concurrency group. For
+  pull requests, use `cancel-in-progress: true` so a superseded head replaces the active run. On
+  `main`, or the consumer's configured default branch, use `cancel-in-progress: false` so the active
+  run finishes before the newest pending revision starts. GitHub may replace an older pending main
+  run with the newest pending revision; preserving every intermediate queued revision is not required.
+  When one workflow handles both events, make `cancel-in-progress` conditional on the pull-request
+  event while keeping the PR number or branch ref in the concurrency group.
 - Give every concrete job a timeout of no more than 30 minutes. A caller job that invokes a reusable
   workflow through top-level `jobs.<job_id>.uses` cannot accept `timeout-minutes`; enforce the bound
   on every concrete job inside the called workflow. If the underlying operation cannot terminate
@@ -27,6 +43,16 @@ Apply this portable baseline unless a stricter repository-local rule overrides i
   operation in another service.
 - Use GitHub-hosted runners only for public repositories. Private repositories use the consumer's
   approved self-hosted or disposable runner labels.
+- Persistent workspaces must check out the full tree. Do not configure sparse checkout; enforce that
+  prohibition with a YAML-aware check over intended tracked workflow and action files, with fixtures
+  for accepted and rejected shapes.
+- Fix workspace ownership at the producer. A container with a writable workspace bind mount must use
+  a non-root identity whose ownership and write access are compatible with the runner workspace. Do not
+  add an unconditional, pre-checkout, workspace-wide permission or ownership traversal to recover
+  persistent runners. Migrate an already contaminated workspace once while the runner is drained.
+  Normal runtime repair may cover bounded known generated paths. A necessary workspace-wide fallback
+  must stay failure-gated, same-filesystem, directory-only, and batched, and record path count and timing
+  evidence.
 - Pin every repository-backed external `uses:` reference—anything other than a local `./...`
   action—to a full lowercase 40-character Git SHA followed immediately by its machine-maintainable
   version comment, such as `# v4.2.0`, so Dependabot can update both. Pin `docker://...` actions to an
@@ -43,8 +69,9 @@ Apply this portable baseline unless a stricter repository-local rule overrides i
    conflict. Identify trusted and untrusted inputs and every credential boundary.
 2. Give each job the least permissions it needs. Keep untrusted pull-request content out of shell
    interpolation, privileged tokens, and write-capable steps.
-3. Apply the portable pinning, runner, trigger, and timeout baseline plus any stricter consumer
-   policy. Keep checkout refs, artifact boundaries, caches, and concurrency behavior explicit.
+3. Apply the portable check, test-topology, concurrency, pinning, runner, trigger, and timeout
+   baseline plus any stricter consumer policy. Keep checkout refs, artifact boundaries, caches, and
+   concurrency behavior explicit.
 4. Validate changed YAML with the local workflow checker and run the affected workflow tests or
    scripts. Update local CI documentation when behavior or operator expectations change.
 5. Review the final diff for privilege escalation, accidental secret exposure, unsafe quoting,

package/skills/manifest.json

@@ -4,7 +4,7 @@
     {
       "name": "agent-workflow",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "agent-workflow/SKILL.md"
     },
     {
@@ -17,9 +17,16 @@
     {
       "name": "blackboard",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "blackboard/SKILL.md"
     },
+    {
+      "name": "dependabot",
+      "plugin": "vouchington-workflow",
+      "pluginVersion": "0.6.2",
+      "path": "dependabot/SKILL.md",
+      "prerequisites": ["github-actions-checklist"]
+    },
     {
       "name": "dotnet-test-authoring",
       "plugin": "vouchington-testing",
@@ -29,26 +36,26 @@
     {
       "name": "git-commit-checklist",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "git-commit-checklist/SKILL.md"
     },
     {
       "name": "github-actions-authoring",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "github-actions-authoring/SKILL.md",
       "prerequisites": ["github-actions-checklist"]
     },
     {
       "name": "github-actions-checklist",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "github-actions-checklist/SKILL.md"
     },
     {
       "name": "github-issue",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "github-issue/SKILL.md"
     },
     {
@@ -61,25 +68,25 @@
     {
       "name": "npm-publishing",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "npm-publishing/SKILL.md"
     },
     {
       "name": "organize-github-issues",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "organize-github-issues/SKILL.md"
     },
     {
       "name": "package-json-checklist",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "package-json-checklist/SKILL.md"
     },
     {
       "name": "planning",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "planning/SKILL.md"
     },
     {
@@ -103,43 +110,43 @@
     {
       "name": "pr-description",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "pr-description/SKILL.md"
     },
     {
       "name": "retrospective",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "retrospective/SKILL.md"
     },
     {
       "name": "retrospective-distill",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "retrospective-distill/SKILL.md"
     },
     {
       "name": "review-ci-logs",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "review-ci-logs/SKILL.md"
     },
     {
       "name": "review-github-issue-taxonomy",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "review-github-issue-taxonomy/SKILL.md"
     },
     {
       "name": "revisit-followups",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "revisit-followups/SKILL.md"
     },
     {
       "name": "static-analysis-checklist",
       "plugin": "vouchington-workflow",
-      "pluginVersion": "0.5.1",
+      "pluginVersion": "0.6.2",
       "path": "static-analysis-checklist/SKILL.md"
     },
     {

package/skills/review-ci-logs/SKILL.md

@@ -14,9 +14,15 @@ Use when investigating CI failures, repeated workflow noise, or misleading diagn
    Inspect failed steps and representative large entries, then remove temporary artifacts.
 3. Classify findings as a real error, misleading output, downstream cascade, necessary diagnostic,
    or volume-only concern. Identify the first repository-owned root cause.
-4. Prefer one bounded fix that preserves non-zero exits, primary errors, artifacts, summaries, and
+4. For persistent-workspace failures, identify the producer of sparse state or unsafe ownership before
+   proposing cleanup. Reject unconditional pre-checkout workspace traversals. Bounded known generated
+   paths may be repaired routinely; a workspace-wide fallback must be failure-gated, same-filesystem,
+   directory-only, and batched. Require path-count and timing evidence, plus a drained one-time migration
+   and producer-side fix such as a compatible non-root writable workspace mount when runner state is
+   contaminated.
+5. Prefer one bounded fix that preserves non-zero exits, primary errors, artifacts, summaries, and
    diagnostic evidence. Do not hide stderr, globally quiet output, or add retries to mask a cause.
-5. Add focused regression evidence, run local workflow validation, compare before and after output
+6. Add focused regression evidence, run local workflow validation, compare before and after output
    where meaningful, and report deferred findings without creating issues unless authorized.
 
 This skill supplies no workflow names, log-retention policy, CI provider command, retry policy, or

package/skills/static-analysis-checklist/SKILL.md

@@ -10,13 +10,16 @@ documentation, rule inventory, and fixture conventions before selecting an imple
 
 1. State the invariant and search for an existing analyzer, rule, or guard that owns it. Prefer the
    narrowest established owner over a parallel scanner.
-2. Add positive and negative fixtures before the rule. Cover path routing, parser boundaries, and
-   every allowed exception.
-3. Keep discovery limited to tracked, intended files. Make suppressions and allowlists narrow,
+2. For workflow or action policy, parse YAML instead of text matching and inspect only intended tracked
+   configuration files. A persistent-workspace guard must reject sparse-checkout inputs and unsafe
+   writable workspace mounts while allowing unrelated YAML keys and ordinary read-only mounts.
+3. Add meaningful accepted and rejected fixtures before the rule. Cover path routing, parser
+   boundaries, equivalent YAML forms, and every allowed exception.
+4. Keep discovery limited to tracked, intended files. Make suppressions and allowlists narrow,
    justified, and mechanically checked for freshness where practical.
-4. Run the focused fixture test and analyzer, then the local aggregate checks. Keep diagnostics
+5. Run the focused fixture test and analyzer, then the local aggregate checks. Keep diagnostics
    actionable and deterministic.
-5. Update the local inventory or documentation and delete superseded migration artifacts only when
+6. Update the local inventory or documentation and delete superseded migration artifacts only when
    the replacement invariant is demonstrably enforced.
 
 This skill does not name analyzer roots, fixture locations, commands, suppression syntax, or