@cryptotaxi247 / netdata-1
Code Commits Issues Pulls Sessions CI/CD
master
master
yml 72 lines 1.91 KB
Raw
1 name: SOW
2
3 on:
4 pull_request:
5 branches:
6 - master
7 paths:
8 - ".agents/sow/**"
9 - ".agents/skills/**"
10 - ".agents/skill-verification/**"
11 - ".agents/ENV.md"
12 - "AGENTS.md"
13 - "CLAUDE.md"
14 - "GEMINI.md"
15
16 permissions:
17 contents: read
18
19 jobs:
20 no-working-files:
21 runs-on: ubuntu-latest
22 steps:
23 - uses: actions/checkout@v6
24
25 - name: Reject committed SOW working files
26 run: |
27 set -euo pipefail
28
29 found=0
30
31 while IFS= read -r file; do
32 [ -n "$file" ] || continue
33 echo "::error file=${file}::SOW working files may be committed for takeover/handoff and must be deleted before merge."
34 found=1
35 done < <(
36 {
37 find .agents/sow/active -maxdepth 1 -type f -name 'SOW-*.md' 2>/dev/null || true
38 find .agents/sow/pending .agents/sow/current .agents/sow/done -type f -name 'SOW-*.md' 2>/dev/null || true
39 } | sort
40 )
41
42 exit "$found"
43
44 sensitive-data:
45 runs-on: ubuntu-latest
46 steps:
47 - uses: actions/checkout@v6
48 with:
49 fetch-depth: 0
50
51 - name: Scan changed durable artifacts for sensitive data
52 run: |
53 set -euo pipefail
54
55 base="${{ github.event.pull_request.base.sha }}"
56 head="${{ github.event.pull_request.head.sha }}"
57
58 mapfile -t files < <(
59 git diff --name-only --diff-filter=ACMR "$base...$head" -- \
60 .agents/sow .agents/skills .agents/skill-verification .agents/ENV.md \
61 AGENTS.md CLAUDE.md GEMINI.md \
62 | while IFS= read -r file; do
63 [ -f "$file" ] && printf '%s\n' "$file"
64 done
65 )
66
67 if [ "${#files[@]}" -eq 0 ]; then
68 echo "No changed durable artifacts to scan."
69 exit 0
70 fi
71
72 bash .agents/sow/scan-sensitive.sh "${files[@]}"