everything-claude-code

ci: harden workflows and sponsor code review config

ECC Test · 2026-06-09 21:20:17 -04:00

3e30f1a56a

ci: harden release announce checkout

ECC Test · 2026-06-09 21:03:22 -04:00

10c303e609

security: harden advisory intake and dependency coverage

ECC Test · 2026-06-09 20:46:14 -04:00

3c5bcc2b66

feat(discord): release -> #announcements auto-post + pin + GitHub Discussions (#2201 )

On a published GitHub release, post the notes to the ECC Discord
#announcements channel (via bot), pin it, and cross-post to GitHub
Discussions (Announcements category). Release data flows through env vars
(no shell interpolation of untrusted input). Secrets: DISCORD_BOT_TOKEN,
DISCORD_ANNOUNCE_CHANNEL_ID (repo secrets), GITHUB_TOKEN.

Ties the 2.0.0/1.11.0 official release to the community launch.

Co-authored-by: ECC Test <ecc@example.test>

Affaan Mustafa · 2026-06-08 22:38:03 -04:00

edebcc89ef

chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#2183 )

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] · 2026-06-07 13:25:31 +08:00

09e2bc58d3

chore(deps): bump actions/stale to 10.3.0 (#2045 )

Bumps actions/stale from 10.2.0 to 10.3.0. Verified by the full CI matrix on the PR.

dependabot[bot] · 2026-05-25 14:06:27 -04:00

870c5eb21b

feat: extend harness audit integration scoring (#1990 )

Salvages the useful harness-audit scoring work from #1989 while preserving the current hook registry and newer plugin install detection. Adds GitHub integration checks, conditional deploy-provider categories, dynamic applicable category metadata, and CODEOWNERS coverage.

Affaan Mustafa · 2026-05-19 06:20:54 -04:00

af9b2c1c4c

docs: define ECC 2.0 hypergrowth release lane

Refresh the active 2.0 release surface for the affaan-m/ECC repo identity, update package/plugin/workflow launch metadata, and add an operator command center for release video, partner, sponsor, consulting, and social launch execution.

Affaan Mustafa · 2026-05-19 05:42:38 -04:00

9ee1e15564

security: scope release oidc publishing

Affaan Mustafa · 2026-05-18 13:41:10 -04:00

7911af4a39

chore(deps): bump pnpm/action-setup from 6.0.6 to 6.0.8

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6.0.6 to 6.0.8.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/91ab88e2619ed1f46221f0ba42d1492c02baf788...0e279bb959325dab635dd2c09392533439d90093)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

dependabot[bot] · 2026-05-17 01:33:19 -04:00

cde0b12180

Add supply-chain advisory source refresh

Affaan Mustafa · 2026-05-15 23:09:54 -04:00

a8e3bcb00f

Harden CI installs against supply-chain lifecycle hooks

Affaan Mustafa · 2026-05-15 17:29:03 -04:00

f7035b5644

Add scheduled supply-chain watch workflow

Affaan Mustafa · 2026-05-15 16:56:49 -04:00

6951b8d5d2

ci: restore dependency caches without saving (#1934 )

Affaan Mustafa · 2026-05-15 13:51:51 -04:00

c2c54e7c0b

feat: add platform and supply-chain audit commands (#1926 )

Affaan Mustafa · 2026-05-15 08:06:26 -04:00

13585f1092

feat: add command registry and coverage checks (#1906 )

Salvages the useful parts of #1897 without generated .caliber state or stale counts.

- adds a deterministic command registry generator and drift check
- commits the current command registry for 75 commands
- validates the rc.1 README catalog summary against live counts
- adds a single Ubuntu Node 20 coverage job instead of running coverage in every matrix cell

Co-authored-by: jodunk <jodunk@users.noreply.github.com>

Affaan Mustafa · 2026-05-14 22:02:36 -04:00

f7315016c0

security: add supply-chain IOC scanner (#1904 )

Affaan Mustafa · 2026-05-14 21:15:35 -04:00

7d15a2282b

ci: disable checkout credential persistence in privileged workflows (#1851 )

Affaan Mustafa · 2026-05-13 01:15:49 -04:00

209abd403b

ci: require npm audit signature checks

Require npm registry signature verification wherever workflow npm audit checks run.

- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior

Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846

Affaan Mustafa · 2026-05-12 23:48:56 -04:00

797f283036

feat: add GitHub Copilot prompt support

Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.

Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Girish Kanjiyani · 2026-05-12 23:00:00 -04:00

766f4ee1d8

ci: harden workflow install boundaries

- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

Affaan Mustafa · 2026-05-12 21:55:36 -04:00

daf0355531

ci: ignore install scripts in release workflows (#1839 )

Affaan Mustafa · 2026-05-12 21:36:36 -04:00

33db548be3

ci: keep package manager cache failures non-blocking

Affaan Mustafa · 2026-05-12 18:03:30 -04:00

6fbf58d590

fix: harden CI validators

Ports personal-path validator hardening and quoted checkout detection onto current main.

Affaan Mustafa · 2026-05-11 03:08:43 -04:00

e674a7dbd7

build(deps): bump pnpm/action-setup from 6.0.0 to 6.0.6 (#1708 )

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6.0.0 to 6.0.6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/08c4be7e2e672a47d11bd04269e27e5f3e8529cb...91ab88e2619ed1f46221f0ba42d1492c02baf788)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] · 2026-05-11 01:12:31 -04:00

c013479019

chore(deps): bump actions/cache from 5.0.4 to 5.0.5 (#1497 )

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] · 2026-05-11 01:11:50 -04:00

01b171947c

feat(ecc2): finalize rc1 release surface

Affaan Mustafa · 2026-04-28 22:10:04 -04:00

0a87323eda

fix: relax pnpm strict build checks in CI

Affaan Mustafa · 2026-04-15 16:44:58 -07:00

6b7bd7156c

fix: allow manual release workflow dispatch

Affaan Mustafa · 2026-04-14 21:02:23 -07:00

8b5c0c1b07

fix: wire npm auth into release publish

Affaan Mustafa · 2026-04-14 20:43:22 -07:00

b5c4d2beb9

fix: publish npm releases and clarify install identifiers

Affaan Mustafa · 2026-04-14 20:42:28 -07:00

34380326c8

Merge pull request #1369 from affaan-m/dependabot/github_actions/pnpm/action-setup-6.0.0

build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0

Affaan Mustafa · 2026-04-13 01:05:16 -07:00

85e331e49a

Merge pull request #1370 from affaan-m/dependabot/github_actions/softprops/action-gh-release-3.0.0

build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0

Affaan Mustafa · 2026-04-13 00:30:59 -07:00

5c4570baa5

fix: allow pnpm cache probe under node 18

Affaan Mustafa · 2026-04-13 00:21:42 -07:00

1a950e4f83

fix: use corepack pnpm on node 18

Affaan Mustafa · 2026-04-13 00:17:17 -07:00

ef7613c526

fix: use pnpm 9 for node 18 workflow jobs

Affaan Mustafa · 2026-04-13 00:13:54 -07:00

bd207aabe1

fix: pin pnpm version for setup action v6

Affaan Mustafa · 2026-04-13 00:10:39 -07:00

6eadf786f5

chore: update release action version comments

Affaan Mustafa · 2026-04-12 23:54:26 -07:00

db8247d701

chore: update pnpm action version comments

Affaan Mustafa · 2026-04-12 23:53:57 -07:00

adb46a95a6

Merge pull request #1371 from affaan-m/dependabot/github_actions/actions/github-script-9.0.0

build(deps): bump actions/github-script from 8.0.0 to 9.0.0

Affaan Mustafa · 2026-04-12 23:53:17 -07:00

48e5a1fa75

Merge pull request #1368 from affaan-m/dependabot/github_actions/actions/upload-artifact-7.0.1

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1

Affaan Mustafa · 2026-04-12 23:53:01 -07:00

2fb041c6de

fix: block unsafe privileged workflow checkouts

Affaan Mustafa · 2026-04-12 23:23:01 -07:00

3792b69a38

fix: harden release surface version and packaging sync (#1388 )

* fix: keep ecc release surfaces version-synced

* fix: keep lockfile release version in sync

* fix: remove release version drift from locks and tests

* fix: keep root release metadata version-synced

* fix: keep codex marketplace metadata version-synced

* fix: gate release workflows on full metadata sync

* fix: ship all versioned release metadata

* fix: harden manual release path

* fix: keep localized release docs version-synced

* fix: sync install architecture version examples

* test: cover shipped plugin metadata in npm pack

* fix: verify final npm payload in release script

* fix: ship opencode lockfile in npm package

* docs: sync localized release highlights

* fix: stabilize windows ci portability

* fix: tighten release script version sync

* fix: prefer repo-relative hook file paths

* fix: make npm pack test shell-safe on windows

Affaan Mustafa · 2026-04-12 22:33:32 -07:00

28edd197c2

build(deps): bump actions/github-script from 8.0.0 to 9.0.0

Bumps [actions/github-script](https://github.com/actions/github-script) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

dependabot[bot] · 2026-04-12 04:52:39 +00:00

57de4129da

build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/153bb8e04406b158c6c84fc1615b65b24149a1fe...b4309332981a82ec1c5618f44dd2e27cc8bfbfda)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

dependabot[bot] · 2026-04-12 04:52:35 +00:00

5ae63b301f

build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/fc06bc1257f339d1d5d8b3a19a8cae5388b55320...08c4be7e2e672a47d11bd04269e27e5f3e8529cb)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

dependabot[bot] · 2026-04-12 04:52:33 +00:00

4b92288a27

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

dependabot[bot] · 2026-04-12 04:52:29 +00:00

45faeb90a7

ci: gate releases on opencode payload verification

Affaan Mustafa · 2026-04-06 14:08:08 -07:00

4967dad08c

chore: bump actions stale workflow

Affaan Mustafa · 2026-04-05 15:22:27 -07:00

c2199710c2

fix: refresh existing monthly metrics snapshots

Affaan Mustafa · 2026-04-05 15:15:56 -07:00

bf5961e8d1

80 Commits