This repository was archived by the owner on Jul 15, 2026. It is now read-only.
CI: branch-protection ruleset, govulncheck workflow, Dependabot config - #21
Merged
Merged
Conversation
- .github/rulesets/main.json: importable ruleset for main — PRs only (squash), required checks 'gofmt + vet + tests' + 'docker image builds', review-thread resolution, linear history, no force pushes/deletions. README documents rationale and the one-command apply (gh api / UI import). - .github/workflows/security.yml: govulncheck over both Go modules on module-graph PRs, main pushes, weekly schedule, and manual dispatch. - .github/dependabot.yml: weekly grouped updates for both gomod modules, Actions pins, and the docs-site npm tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JCk6XWnqks9gjbJ4Zi5uVT
govulncheck's first run flagged GO-2026-5856 (crypto/tls ECH privacy leak, fixed in Go 1.25.12) because setup-go resolved '1.25' to the runner's cached 1.25.11 — for the scan AND the shipped builds. check-latest: true makes every Go job track the newest 1.25.x patch, where stdlib security fixes land. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JCk6XWnqks9gjbJ4Zi5uVT
setup-go's version manifest can lag the module proxy, so check-latest alone still resolved go1.25.11 on the runner. The toolchain directive makes every build — CI and local — use the crypto/tls-patched 1.25.12 regardless of the installed Go. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWWaS4f9mr6Yp43S4GXHE7
… fix Review follow-up: official golang images set GOTOOLCHAIN=local, so the build stage ignored the go.mod 'toolchain go1.25.12' directive and could still ship the GO-2026-5856-vulnerable crypto/tls while the Security workflow passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWWaS4f9mr6Yp43S4GXHE7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the missing repo-hygiene pieces around the existing CI/CSS/Desktop/docs workflows:
.github/rulesets/main.json— importable branch-protection ruleset formain: all changes via PR, squash merges only (matches the SDD merge strategy in CLAUDE.md), required checksgofmt + vet + testsanddocker image builds, review-thread resolution, linear history, no force pushes/deletions. The path-filtered workflows (CSS, Desktop, Security) are deliberately not required checks — a required check that never reports would deadlock PRs that don't touch those paths..github/rulesets/README.mddocuments the rationale and the one-command apply..github/workflows/security.yml—govulncheckover both Go modules (core + desktop shell), on PRs touching the module graphs, pushes tomain, a weekly schedule, and manual dispatch..github/dependabot.yml— weekly grouped dependency updates for bothgomodmodules, the Actions pins, and the docs-site npm tree.Owner follow-up after merge: GitHub doesn't read rulesets from the repo automatically — apply once via Settings → Rules → Rulesets → Import a ruleset (upload
.github/rulesets/main.json) orgh api repos/joestump-agent/msgbrowse/rulesets --input .github/rulesets/main.json.🤖 Generated with Claude Code
https://claude.ai/code/session_01JCk6XWnqks9gjbJ4Zi5uVT
Generated by Claude Code