ci: vendor governance-enforce — this repo was never in the A_BLOCK ruleset

Merged
YA
1mo ago
+107-0

Adds the governance-enforce A_BLOCK gate (secrets / hardcoded-paths, diff-scoped) to this repo. Pilot of claude-workstation#1624 E4 T4.9a — the other four package origins follow once this one is observed green.

Why this repo had no secrets scan

The org ruleset governance-a-block-enforce (17901847) requires an enforce check across the fleet. Its scope is an explicit include list of 112 hand-maintained repository names — and every one of them matches wave-*.

The 16 public repos absent from that list are exactly the 16 not named wave-*. That set is .github, adk, api-spec, cli, companion-module-wave, create-wave-app, crest-console, dispatch-edge, examples, mcp-server, obs-wave-plugin, sdk, sdk-python, sdks, vmix-wave-integration, workflow-sdk.

Read the intersection: the repos that publish our npm packages are precisely the repos running with no A_BLOCK secrets scan. Nobody excluded them. A naming convention silently became a security boundary, and it drew the line in the worst possible place.

Why the workflow lands before the ruleset entry

Adding a repo to a required_status_checks ruleset before it emits that check is a permanent deadlock — a required check that never reports can never go green, and every PR on the repo becomes unmergeable. So the order is: vendor the workflow, observe it green, then extend the list. Doing it the intuitive way round would have bricked all sixteen.

This PR is therefore its own liveness drill. The workflow triggers on pull_request, so it runs on the PR that adds it. If enforce reports green here, the vendored shape works on a public repo. If it does not, nothing was required and nothing is blocked — which is the whole point of this ordering.

Why this shape

Copied verbatim from wave-av/wave-moq-edge, which is public and 12/12 green — so the shape is proven on a public repo rather than inferred from a private one. That distinction matters here: auto-approve.yml fails silently on every public repo because it calls a reusable workflow in the private wave-foundation, and a public repo cannot do that (parse-time failure, zero jobs, no annotation). This workflow calls nothing cross-repo, so that trap does not apply.

Security properties, unchanged from the source:

  • actions SHA-pinned (actions/checkout@df4cb1c, actions/setup-node@48b55a0)
  • persist-credentials: false on checkout
  • least privilege: contents: read + packages: read
  • isolated install into RUNNER_TEMP, --no-save, so nothing touches this repo's dependency tree
  • the .npmrc is written with a literal ${NODE_AUTH_TOKEN} (single-quoted printf) which npm expands at run time — no secret value is ever written to disk or a log
  • both ${{ }} inputs (base.sha, event.before) are routed through env: and read as "$VAR", never interpolated into the script body

Diff-scoped by design: it blocks new violations without failing on legacy debt.

The one assumption being tested

@wave-av/governance is an internal-visibility package owned by claude-workstation. wave-moq-edge is public and reads it fine, but rather than fan out on that inference, this PR pilots a single repo. Green here means the remaining four (sdk, adk, mcp-server, workflow-sdk) follow immediately.

Refs wave-av/claude-workstation#1624.

Open in Devin Review

[!NOTE]
Low Risk
CI-only change with no application runtime impact; main operational risk is workflow misconfiguration (e.g. required check before green runs), which the PR explicitly sequences to avoid.

Overview
Adds governance-enforce.yml, a new GitHub Actions workflow that runs on pull requests and pushes to main/master. It installs a pinned @wave-av/governance@0.4.6 into an isolated temp directory and runs enforce.mjs against the PR or push diff (not the full tree on the happy path), targeting A_BLOCK rules: secrets in git, Doppler sourcing, and hardcoded paths.

The workflow is hardened so the gate cannot report green without actually scanning files: registry token only on the npm install step, --ignore-scripts, push-run concurrency that does not cancel in-progress scans, unreachable diff bases validated with git cat-file, and a fail-closed fallback to the empty tree when no base SHA exists (instead of diffing HEAD against itself).

This is a pilot for repos outside the org governance-a-block-enforce ruleset (non-wave-* names like cli). The PR description notes the ruleset entry should wait until enforce is observed green here.

Reviewed by Cursor Bugbot for commit 36142007f32e57802c4ea34b486763ca61475cdf. Configure here.

[!NOTE]

Add governance enforcement workflow to scan diffs on PRs and pushes to main

Adds governance-enforce.yml, which runs @wave-av/governance@0.4.6 on pull requests, merge groups, and pushes to main/master. The enforcer scans only changed files using a computed diff base; if no valid base is found, it falls back to the empty tree and scans the full repository. Push and merge group runs are not cancelable to ensure no committed ranges are skipped.

Macroscope summarized a3dbfa9.