gflow-cli 0.92.0__tar.gz → 0.93.0__tar.gz

gflow_cli-0.93.0/.codex-plugin/plugin.json

@@ -0,0 +1,34 @@
+{
+  "name": "gflow",
+  "version": "0.93.0",
+  "description": "Reusable development and operations workflows for gflow-cli",
+  "author": {
+    "name": "Flavio Oliva",
+    "url": "https://github.com/ffroliva"
+  },
+  "homepage": "https://github.com/ffroliva/gflow-cli",
+  "repository": "https://github.com/ffroliva/gflow-cli",
+  "license": "MIT",
+  "keywords": [
+    "gflow-cli",
+    "codex",
+    "google-flow"
+  ],
+  "skills": "./plugins/gflow/skills/",
+  "interface": {
+    "displayName": "gflow-cli",
+    "shortDescription": "Develop, validate, review, and operate gflow-cli.",
+    "longDescription": "Project workflows for planning, validation, issue handling, reviews, releases, and Google Flow CLI operations.",
+    "developerName": "Flavio Oliva",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Interactive",
+      "Write"
+    ],
+    "websiteURL": "https://github.com/ffroliva/gflow-cli",
+    "defaultPrompt": [
+      "Show the current gflow-cli task with $gflow:status.",
+      "Run the gflow-cli quality gates with $gflow:check."
+    ]
+  }
+}

gflow_cli-0.93.0/.github/workflows/ci.yml

@@ -0,0 +1,565 @@
+name: CI
+
+on:
+  push:
+    branches: [develop, main]
+  pull_request:
+
+# Least-privilege default token for every job (OpenSSF Scorecard:
+# Token-Permissions). Jobs that need more elevate per-job below.
+permissions:
+  contents: read
+
+env:
+  # Suppress Node.js deprecation warnings and align with user request to use Node 22/remove noise.
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  NODE_VERSION: '22'
+
+jobs:
+  # ── Security gate: runs first, on every push/PR, never skippable ──────────
+  secrets-scan:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # gitleaks-action PR feedback comments
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0  # full history so gitleaks can diff against base
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # ── Security gate: dependency CVE audit against locked deps ──────────────
+  deps-audit:
+    name: Dependency audit (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - name: Audit locked dependencies for known CVEs
+        # Fails the build on any known advisory. Accept later via: pip-audit --ignore-vuln <GHSA-id>
+        #
+        # `--all-extras` is REQUIRED, not tidiness. Without it `uv export` emits
+        # only the default dependency group, so everything reachable solely
+        # through an optional extra is never audited. That blind spot was real:
+        # aiohttp 3.13.5 and pyasn1 0.6.3 sat in uv.lock with published high
+        # advisories while this gate reported clean, because both arrive via the
+        # `gcs`/`s3` extras (gcsfs / s3fs / google-auth). GitHub's Dependabot
+        # alerts flagged them against uv.lock; this gate could not see them.
+        run: |
+          uv export --frozen --all-extras --format requirements-txt --no-emit-project > requirements-audit.txt
+          # pip-audit version pinned for a reproducible gate (uvx has no
+          # dependabot ecosystem — bump by hand when it drifts).
+          uvx pip-audit==2.10.1 -r requirements-audit.txt
+
+  # ── Security gate: static analysis of the workflows themselves ───────────
+  # Everything else in this file audits the Python we ship. Nothing audited the
+  # CI that ships it, and CI is a supply-chain surface in its own right: it
+  # holds a repository token, it publishes to PyPI, and its inputs (branch
+  # names, PR titles, fork content) are attacker-controllable text.
+  #
+  # zizmor is what turns that into a gate. It found real defects on its first
+  # run over this repo (#565): 12 checkouts persisting the job token into the
+  # workspace, and `${{ github.base_ref }}` interpolated straight into a
+  # governance-advisory shell script. Both are fixed; this job is what stops
+  # them coming back one copy-pasted step at a time.
+  workflow-audit:
+    name: Workflow audit (zizmor)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Audit workflows (zizmor)
+        # --offline: the online audits need a GH token and reach the network, so
+        #   they would make this gate non-deterministic and unrunnable on fork
+        #   PRs. Action freshness/pinning is already covered by Dependabot plus
+        #   Scorecard's Pinned-Dependencies check.
+        # --min-severity low: informational findings are advisory, not defects.
+        #   The one open today is `superfluous-actions` on
+        #   softprops/action-gh-release; rewriting the release publisher is not
+        #   a hardening change and is deliberately declined (docs/GITHUB.md).
+        # Version pinned for a reproducible gate — uvx has no Dependabot
+        # ecosystem, so bump it by hand (the pin is asserted by
+        # tests/scripts/test_workflow_hardening.py, which fails if the two drift).
+        run: uvx zizmor==1.29.0 --offline --min-severity low .github/workflows/
+
+  # ── Supply-chain gate: resolve WITHOUT the lockfile ───────────────────────
+  # Every other job installs via `uv sync`, which honours uv.lock. That means CI
+  # never exercises the version RANGES in pyproject.toml — the exact blind spot
+  # that let `mcp>=1.0.0` (unbounded) ship a broken MCP surface to every fresh
+  # `pip install gflow-cli` while CI stayed green: mcp 2.0.0 deleted
+  # `mcp.server.fastmcp`, which the server imports at module load.
+  #
+  # This job installs the way a USER does — from the declared ranges, newest
+  # compatible versions, no lockfile — and smoke-imports the surfaces that break
+  # first. It is what turns "a dependency published a major bump" from a user
+  # bug report into a CI failure.
+  resolve-drift:
+    name: Dependency resolution drift (no lockfile)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install from pyproject ranges (ignore uv.lock)
+        # --upgrade resolves to the newest versions the ranges allow, so a newly
+        # published major that our bounds do not exclude is caught here.
+        run: |
+          uv venv
+          uv pip install --upgrade .
+
+      - name: Smoke-import the MCP surface
+        # Import-time failures (deleted modules, moved symbols) surface here.
+        # Registration is a decorator side effect, so a successful import with a
+        # non-empty tool registry proves the whole surface still wires up.
+        run: |
+          uv run --no-sync python - <<'PY'
+          from gflow_cli.mcp.server import server, run_stdio, run_http, run_sse
+          from gflow_cli.mcp import prompts, resources, tools  # noqa: F401
+
+          n_tools = len(server._tool_manager._tools)
+          n_resources = len(server._resource_manager._resources)
+          n_prompts = len(server._prompt_manager._prompts)
+          print(f"tools={n_tools} resources={n_resources} prompts={n_prompts}")
+          assert n_tools, "no MCP tools registered"
+          assert n_resources, "no MCP resources registered"
+          assert n_prompts, "no MCP prompts registered"
+
+          import mcp.types as t
+          print("negotiable protocol ceiling:", t.LATEST_PROTOCOL_VERSION)
+          PY
+
+      - name: Smoke-run the CLI entry points
+        run: |
+          uv run --no-sync gflow --version
+          uv run --no-sync gflow --help
+          uv run --no-sync gflow serve --help
+
+      - name: Report the resolved versions
+        # Printed unconditionally so a green run still records what was resolved.
+        if: always()
+        run: uv pip list
+
+  # ── Main test matrix ──────────────────────────────────────────────────────
+  # 3.11 and 3.12 run everything in one job each. 3.13 is the coverage job and was
+  # the critical path (Chromium, real-DOM tests, the hermetic e2e), so it runs as
+  # parallel shards below and `test-313` aggregates them under the required name.
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install ${{ matrix.python-version }}
+
+      # --frozen: install from the committed uv.lock without re-resolving it.
+      # Plain `uv sync` REWRITES uv.lock in place, which would silently repair
+      # the exact version drift the hygiene gate below exists to catch.
+      - name: Install deps
+        run: uv sync --frozen --extra dev
+
+      # --no-sync for the same reason: `uv run` re-locks before running.
+      - name: Repo hygiene (no artefacts, no hardcoded paths, version lockstep)
+        run: uv run --no-sync python scripts/ci/check_repo_hygiene.py
+
+      - name: Documentation links
+        run: uv run python scripts/ci/check_doc_links.py
+
+      - name: Website docs PII guard (no private identifiers in the published mirror)
+        run: uv run python scripts/ci/check_website_docs_pii.py
+
+      - name: Website docs mirror in sync (regenerate-and-diff)
+        run: uv run python scripts/ci/generate_website_docs.py --check
+
+      - name: Council memory (every cited slug resolves, every file is cited)
+        run: uv run python scripts/ci/check_council_memory.py
+
+      - name: Plugin skills in sync (curated payload, no maintainer-only skill shipped)
+        run: uv run python scripts/ci/generate_plugin_skills.py --check
+
+      - name: Lint
+        run: uv run ruff check src tests
+
+      - name: Format check
+        run: uv run ruff format --check src tests
+
+      - name: Type check
+        run: uv run pyright src
+
+      - name: Test (smoke only)
+        # e2e/live tests require a logged-in Chromium profile and may spend
+        # Flow credits. pyproject.toml excludes both markers by default; CI
+        # intentionally relies on that default smoke set.
+        # -n auto: pytest-xdist, one worker per runner vCPU (~2x on the full suite;
+        # 198 s vs ~390 s measured locally at -n 8).
+        # --dist worksteal: the default `load` hands each worker a fixed chunk up
+        # front, and test_agent_only_composer_driver.py's 85 contiguous tests all
+        # landed on one worker (338 s there, ~20 s on the other three, measured).
+        run: uv run python -m pytest -q -n auto --dist worksteal --junitxml=pytest-report.xml
+
+      - name: Test-count guard (a green build that ran nothing is not green)
+        # Floor well below the real count (~2900): catches collection collapse
+        # (bad marker/-k filter, broken conftest), never routine deletions.
+        run: uv run python scripts/ci/check_test_count.py pytest-report.xml 2000
+
+  # ── 3.13: three unit shards + the hermetic e2e, in parallel ───────────────
+  # GFLOW_TEST_SHARD=k/N makes root conftest.py keep only shard k's files, split
+  # by whole file and balanced on tests/test_durations.json
+  # (scripts/ci/shard_tests.py). Every file runs in exactly one shard; the count
+  # floor is checked over the SUM in `test-313`, never per shard.
+  test-313-shard:
+    name: test 3.13 (${{ matrix.shard }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: ["1/3", "2/3", "3/3", "e2e"]
+    env:
+      SHARD: ${{ matrix.shard }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install deps
+        run: uv sync --frozen --extra dev
+
+      # The repo gates are version-independent except pyright; 3.11/3.12 run them
+      # too. On 3.13 they ride on the first unit shard, the lightest after the split.
+      - name: Repo gates (hygiene, docs, plugin skills, lint, format, types)
+        if: matrix.shard == '1/3'
+        run: |
+          uv run --no-sync python scripts/ci/check_repo_hygiene.py
+          uv run python scripts/ci/check_doc_links.py
+          uv run python scripts/ci/check_website_docs_pii.py
+          uv run python scripts/ci/generate_website_docs.py --check
+          uv run python scripts/ci/check_council_memory.py
+          uv run python scripts/ci/generate_plugin_skills.py --check
+          uv run ruff check src tests
+          uv run ruff format --check src tests
+          uv run pyright src
+
+      # The overlay-precondition tests (#593) drive the captured changelog markup in
+      # a real headless Chromium — a mock cannot tell you whether
+      # `[role='dialog']:has(a[href*='changelog']) button` resolves against Flow's
+      # actual DOM, only a real CSS engine can. They skip cleanly when the browser is
+      # absent, which would make them silently decorative in CI, so every 3.13 shard
+      # installs it. No account, no network, no credits.
+      - name: Install Chromium (real-DOM fixture tests)
+        run: uv run playwright install chromium --with-deps
+
+      - name: Test shard + coverage
+        if: matrix.shard != 'e2e'
+        env:
+          GFLOW_TEST_SHARD: ${{ matrix.shard }}
+        run: uv run python -m pytest -q -n auto --dist worksteal --cov=gflow_cli --cov-report= --junitxml=pytest-report.xml
+
+      # Five files under tests/e2e/ are hermetic: every Flow origin is served by
+      # `page.route(...).fulfill(...)`, so they need no account, no profile, no
+      # network and no credits — only the Chromium installed above. They are the
+      # regression tests for #593, #773, #859 and #860, and because `-m e2e` is
+      # excluded by pyproject's addopts and no job overrode it, they ran nowhere:
+      # a regression of any of those fixes would have gone green. They are the
+      # only e2e tests that CAN run here; the other 42 need a logged-in profile.
+      - name: E2E (hermetic subset — route-intercepted, $0, no profile)
+        if: matrix.shard == 'e2e'
+        run: >
+          uv run python -m pytest -q -m e2e
+          tests/e2e/test_account_chooser_e2e.py
+          tests/e2e/test_blocking_dialog_dismissal_bdd.py
+          tests/e2e/test_click_attribution_bdd.py
+          tests/e2e/test_frame_picker_binding_bdd.py
+          tests/e2e/test_landing_state_diagnosis_bdd.py
+          --junitxml=pytest-e2e-hermetic.xml
+
+      - name: E2E-count guard (an empty e2e run is not a passing e2e run)
+        if: matrix.shard == 'e2e'
+        run: uv run python scripts/ci/check_test_count.py pytest-e2e-hermetic.xml 10
+
+      # `.coverage` is a dotfile, which upload-artifact skips unless told otherwise.
+      - name: Upload shard report + coverage data
+        if: matrix.shard != 'e2e'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: shard-${{ strategy.job-index }}
+          path: |
+            pytest-report.xml
+            .coverage
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 1
+
+  # The required check `test (3.13)` lives HERE, so the ruleset needs no edit.
+  # `if: always()` plus the result gate are both load-bearing: GitHub reports a
+  # SKIPPED required check as passing, so without them a failed shard would skip
+  # this job and the PR would merge green.
+  test-313:
+    name: test (3.13)
+    runs-on: ubuntu-latest
+    needs: test-313-shard
+    if: always()
+    steps:
+      - name: Every 3.13 shard passed
+        env:
+          SHARDS: ${{ needs.test-313-shard.result }}
+        run: |
+          if [ "$SHARDS" != "success" ]; then
+            echo "::error::a 3.13 shard ended '$SHARDS' — see the test 3.13 (...) jobs"
+            exit 1
+          fi
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install deps
+        run: uv sync --frozen --extra dev
+
+      - name: Download shard reports
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          pattern: shard-*
+
+      # Each shard is named, not globbed: a shard that uploaded nothing must fail
+      # here rather than shrink the sum.
+      - name: Test-count guard over every shard (a green build that ran nothing is not green)
+        # Floor well below the real count (~2900): catches collection collapse
+        # (bad marker/-k filter, broken conftest, a lost shard), never routine deletions.
+        run: >
+          uv run --no-sync python scripts/ci/check_test_count.py
+          shard-0/pytest-report.xml shard-1/pytest-report.xml shard-2/pytest-report.xml 2000
+
+      - name: Combine shard coverage
+        run: |
+          uv run --no-sync coverage combine shard-0/.coverage shard-1/.coverage shard-2/.coverage
+          uv run --no-sync coverage xml -o coverage.xml
+          uv run --no-sync coverage report --format=total
+
+      # Upload coverage XML so the sonar job can consume it. It must come from the
+      # Chromium-installing 3.13 shards: the real-DOM fixture tests skip everywhere
+      # else, so a 3.11 upload counted every browser-tested module as uncovered
+      # (#989's agent_only_composer.py measured 39% new coverage with its tests green).
+      - name: Upload coverage report
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          retention-days: 1
+
+      # Report-only (watch mode): `continue-on-error` and the brace group mean nothing
+      # in this step can turn the job red. Reads the shard-*/pytest-report.xml already
+      # downloaded above (copied alone so the scan never sees coverage.xml or the repo); no new upload.
+      - name: Speed check (report only)
+        continue-on-error: true
+        run: |
+          { mkdir speed-in && cp --parents shard-*/pytest-report.xml speed-in/ \
+              && uv run --no-sync python -m scripts.ci.pytest_speed check speed-in --config pytest-speed.toml --out speed.md \
+              && cat speed.md >> "$GITHUB_STEP_SUMMARY"; } || echo "speed check: not run" >> "$GITHUB_STEP_SUMMARY"
+
+  # ── Focused OS matrix: ProfileLease cross-process contract (Task D2) ──────
+  # Everything else in this file runs Ubuntu-only (the `test` job above).
+  # This job exists because ProfileLease's kernel lock is genuinely
+  # OS-specific (msvcrt.locking on Windows vs. fcntl.flock on POSIX) and D1's
+  # local Windows-only run left the POSIX fcntl branch reasoned-but-unexecuted
+  # (see .superpowers/sdd/task-D1-report.md). Runs ONLY the lease unit +
+  # subprocess tests, not the full suite.
+  profile-lease-matrix:
+    name: ProfileLease (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    env:
+      PYTHONUTF8: "1"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest, ubuntu-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install deps
+        run: uv sync --extra dev
+
+      - name: ProfileLease unit + subprocess tests
+        run: uv run python -m pytest tests/test_profile_lease.py tests/test_profile_lease_subprocess.py -q --junitxml=pytest-lease.xml
+
+      - name: Test-count guard (lease matrix ran its suite)
+        # Floor well below the ~29 executed per OS leg — catches collapse, not
+        # routine test consolidation.
+        run: uv run python scripts/ci/check_test_count.py pytest-lease.xml 10
+
+  # ── Storage container tests (S3 via RustFS, GCS via fake-gcs-server) ───────
+  # Nothing ran `-m containers` before this job, so the pinned MinIO image was
+  # deleted from Docker Hub and the S3 tests rotted unnoticed. A registry
+  # deletion or a broken backend now turns CI red. The count guard catches the
+  # other silent failure: every fixture `importorskip`s, so a missing dependency
+  # would skip all 12 tests and still exit 0.
+  storage-containers:
+    name: Storage container tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      PYTHONUTF8: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install deps
+        run: uv sync --frozen --group containers
+
+      - name: Container tests
+        run: uv run --no-sync python -m pytest -m containers tests/integration/ -q --junitxml=pytest-containers.xml
+
+      # 9 S3 (incl. the #1003 migrated-clip upload) + 4 GCS. The expander-gateway
+      # tests share the marker but skip without an LLM endpoint; skips do not count.
+      - name: Test-count guard (all storage tests executed, none skipped)
+        run: uv run --no-sync python scripts/ci/check_test_count.py pytest-containers.xml 13
+
+  # ── SonarCloud analysis ───────────────────────────────────────────────────
+  sonar:
+    name: SonarCloud analysis
+    runs-on: ubuntu-latest
+    needs: [test, test-313]   # wait for tests + the combined coverage report
+    permissions:
+      contents: read
+      pull-requests: read  # PR-context analysis / decoration lookups
+    # Forked pull_request runs do not receive repository secrets, so SONAR_TOKEN
+    # is empty there and the scanner fails before analysis. Dependabot-triggered
+    # runs are the same case: GitHub serves them the separate Dependabot secrets
+    # namespace, so SONAR_TOKEN is also empty even though the branch is in-repo.
+    # Keep SonarCloud on trusted pushes/internal PRs where the token is available.
+    if: >
+      always() &&
+      github.actor != 'dependabot[bot]' &&
+      (
+        github.event_name != 'pull_request' ||
+        github.event.pull_request.head.repo.full_name == github.repository
+      )
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0  # shallow clones break blame / new-code detection
+
+      - name: Download coverage report
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: coverage-xml
+        continue-on-error: true  # graceful if coverage upload was skipped
+
+      # SonarCloud is a third-party service; it does have outages (seen live
+      # 2026-07-16, ~504s across its whole API including the unauthenticated
+      # /api/system/status endpoint). Reassessed fresh on every run — no manual
+      # flag to remember to flip back once it recovers. A skip here still lets
+      # the job COMPLETE (green), it just doesn't run the scan step; local
+      # coverage during an outage comes from the shared SonarQube instance
+      # (scripts/dev/sonar-local-scan.sh) — see docs/GITHUB.md § SonarCloud
+      # outage handling.
+      - name: Check SonarCloud availability
+        id: sonarcloud_health
+        run: |
+          if curl -sf -m 10 "https://sonarcloud.io/api/system/status" | grep -q '"status":"UP"'; then
+            echo "up=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "up=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::SonarCloud is unreachable or degraded — skipping the scan for this run (not a code quality failure). Verify locally with scripts/dev/sonar-local-scan.sh before merging if this persists, and re-run this job once SonarCloud recovers."
+          fi
+
+      - name: SonarCloud scan
+        if: steps.sonarcloud_health.outputs.up == 'true'
+        # sonarcloud-github-action is ARCHIVED upstream (dependabot never bumps
+        # archived actions, so its pin would rot silently); sonarqube-scan-action
+        # is SonarSource's maintained successor and serves SonarCloud when
+        # SONAR_HOST_URL points at it.
+        uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # PR decoration
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}    # set in repo → Settings → Secrets
+          SONAR_HOST_URL: https://sonarcloud.io
+
+  # Fails on N+1 queries and swallowed programming errors (see dev/sharpit_app.py). sharpit is pinned: a new release
+  # can add findings, so upgrading it is a change of its own.
+  sharpit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install deps
+        run: uv sync --frozen --extra dev
+
+      # --with adds sharpit to this run only; uv.lock and the wheel never depend on it.
+      - name: Test suite under pytest --sharpit
+        run: >-
+          uv run --no-sync --with "sharpit==0.4.0" python -m pytest -q -n auto
+          --sharpit --sharpit-no-advisors
+          --sharpit-report=sharpit-report.json --sharpit-junit=sharpit-junit.xml
+
+      - name: Upload the sharpit reports
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: sharpit-report
+          path: |
+            sharpit-report.json
+            sharpit-junit.xml

gflow_cli-0.93.0/.github/workflows/deps-watch.yml

@@ -0,0 +1,83 @@
+name: Dependency watch
+
+# ── Why this exists, on a CLOCK ──────────────────────────────────────────────
+# CI's `deps-audit` job runs the same pip-audit command, but only `on: push` and
+# `on: pull_request`. That gate has no clock: an advisory published *after* the
+# last push stays invisible until someone happens to push. That is exactly how
+# CVE-2026-69247 (cryptography 49.0.0) reached the v0.50.0 release PR — the
+# lockfile had been sitting on the vulnerable version for days and nothing was
+# scheduled to re-check it. This workflow gives that gate a timer.
+#
+# It also answers the question no existing job answers: "what CAN we update?"
+# Every other job installs via `uv sync` against uv.lock, so the lockfile hides
+# both halves of the picture — what upstream has published, and what our own
+# declared bounds are currently refusing. Both are printed below.
+
+on:
+  schedule:
+    # Mondays 07:00 UTC — one hour before Dependabot's 08:00 Europe/Lisbon run,
+    # so the audit result is already on screen when the bump PRs land.
+    - cron: "0 7 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  watch:
+    name: Audit + report upgradable dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      # ── The gate: fails the run, which emails the repo owner ───────────────
+      - name: Audit locked dependencies for known CVEs
+        run: |
+          # --all-extras: without it only the default group is exported, so
+          # anything reachable solely through an optional extra goes unaudited.
+          # See the matching note in ci.yml — this is how aiohttp/pyasn1 hid.
+          uv export --frozen --all-extras --format requirements-txt --no-emit-project > requirements-audit.txt
+          # pip-audit deliberately floats here (unlike the pinned gate in
+          # ci.yml): this weekly watch job never gates a merge, and fresh
+          # advisory tooling is exactly what it is for.
+          uvx pip-audit -r requirements-audit.txt
+
+      # ── The reports: never fail the run, and still run when the audit fails
+      #    (a red audit is precisely when you want to know what's upgradable) ─
+      - name: Report what our bounds allow us to take now
+        if: always()
+        # Resolves the newest versions pyproject.toml's ranges permit, without
+        # writing uv.lock. This is the "safe to merge today" list.
+        run: |
+          echo '## Upgradable within current bounds' >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          # uv writes this report to STDERR, so it must be folded into stdout
+          # BEFORE the pipe. `... 2>&1 >> file` would be wrong: that order sends
+          # stdout to the file and leaves stderr on the terminal, which silently
+          # published an empty summary section. tee keeps both destinations.
+          uv lock --upgrade --dry-run 2>&1 | tee -a "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Report what upstream has published
+        if: always()
+        # Unlike the step above, this ignores our constraints and reports the
+        # true latest on PyPI — so a package frozen by one of OUR upper bounds
+        # shows up here and nowhere else. This is the expiry alarm for those
+        # bounds: `playwright>=1.61.0,<1.62.0` is deliberate (an untested driver
+        # silently wedged video generation — see the comment in pyproject.toml),
+        # but a deliberate pin still needs a periodic "how stale is it now?"
+        # signal, and raising it requires a live-verified generation first.
+        run: |
+          uv sync --frozen
+          echo '## Latest upstream (ignores our bounds)' >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          uv pip list --outdated 2>&1 | tee -a "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"