feat(c1): GitHub Action + pre-commit hook — doctor gate for consumer repos - #23
Merged
Merged
Conversation
…ard, dogfooded in CI Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ships `.pre-commit-hooks.yaml` (hook id loop-doctor -> `loop doctor .`, a language:python hook usable from any consumer .pre-commit-config.yaml on PR1's self-contained wheel) plus `scripts/test_precommit_hook.py`, which asserts the hook definition is sound and the entry matches a declared console script, and an env-guarded consumer fixture that runs the hook through `pre-commit try-repo` end-to-end. The action-dogfood CI job installs pre-commit and runs that fixture for real on the PR checkout. CHANGELOG gains the C1 entry covering both the composite action and the pre-commit gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Env-indirect inputs.version/path/fail-under-score in action.yml's run: steps (install, doctor, inspect+scorecard heredoc argv) to close the GitHub Actions script-injection footgun for a published reusable action. Behavior unchanged for legitimate inputs (verified via a real inspect.json run through both pass/fail branches). Also documents in ci.yml why bare `python` is on PATH in the dogfood job's pre-commit fixture step (the preceding `uses: ./` composite step ran setup-python). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01As92NaD7jMDbnQTqXDzBVa
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…gitignored, absent in CI Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01As92NaD7jMDbnQTqXDzBVa
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR4 (C1) of the adoption-slices plan (docs/superpowers/plans/2026-07-03-adoption-slices.md).
What
action.yml(composite, repo root) — pip-installs loop-engineer fromgithub.action_pathby default (source mode: CI gates the working tree) or from PyPI via aversioninput; runsloop doctoras a hard gate; renders aloop inspectscorecard to$GITHUB_STEP_SUMMARYwith afail-under-scorethreshold; optional PR comment viagithub-token. All user inputs reach bash via env-indirection (env:+ quoted"$VAR"), not raw${{ }}interpolation — no script-injection surface for downstream consumers..pre-commit-hooks.yaml— hook idloop-doctor(language: python,always_run), so consumers gate commits on their own contract.action-dogfoodCI job gates this repo's own contract (fail-under-score: 90; current inspect score 100/strong, so the gate is non-vacuous and fails loudly on any broken-action path) + a livepre-commit try-repoconsumer fixture.Review trail
Per-task reviews: both Approved. Whole-branch review: Ready to merge — Yes (verified the inspect JSON ↔ scorecard contract, wheel force-include completeness for bare action checkouts, and every fail-loudly branch); its input-injection hardening landed as
2aa7bd9, re-review approved.Tests
Canonical suite: 246 passed / 9 skipped (baseline 244/8 at branch; +2 tests, +1 env-guarded skip). This PR's CI run is the first hosted-runner proof of the action's install path — the
action-dogfoodjob is the acceptance gate.🤖 Generated with Claude Code
https://claude.ai/code/session_01As92NaD7jMDbnQTqXDzBVa