#25 ci: vendor governance-enforce — this repo was never in the A_BLOCK ruleset

User description

Adds the governance-enforce A_BLOCK gate (secrets / hardcoded-paths, diff-scoped) to this repo. Part of claude-workstation#1624 E4 T4.9a, following the wave-av/cli#20 pilot.

Why this repo had no secrets scan

The org ruleset governance-a-block-enforce (17901847) requires an enforce check across the fleet. Its scope is an explicit include list of 112 hand-maintained repository names — and every one of them matches wave-*.

The 16 public repos absent from that list are exactly the 16 not named wave-*: .github, adk, api-spec, cli, companion-module-wave, create-wave-app, crest-console, dispatch-edge, examples, mcp-server, obs-wave-plugin, sdk, sdk-python, sdks, vmix-wave-integration, workflow-sdk.

Read the intersection: the repos that publish our npm packages are precisely the repos running with no A_BLOCK secrets scan. Nobody excluded them. A naming convention silently became a security boundary, and it drew the line in the worst possible place.

Why the workflow lands before the ruleset entry

Adding a repo to a required_status_checks ruleset before it emits that check is a permanent deadlock — a required check that never reports can never go green, and every PR on the repo becomes unmergeable. So the order is: vendor the workflow, observe it green, then extend the list. Doing it the intuitive way round would have bricked all sixteen.

This PR is also its own liveness drill. The workflow triggers on pull_request, so it runs on the PR that adds it. If enforce reports green here, the vendored shape works in this repo. If it does not, nothing was required and nothing is blocked — which is the point of this ordering.

Proven before fan-out, not assumed

@wave-av/governance is an internal-visibility package owned by claude-workstation, so whether a public repo's GITHUB_TOKEN can read it was the one real assumption. Rather than fan out on the inference, it was piloted on a single repo first:

wave-av/cli#20 — workflow run 31011943790, conclusion success.

That is the receipt this PR rides on. The shape is copied verbatim from wave-av/wave-moq-edge (public, 12/12 green), which matters because auto-approve.yml fails silently on every public repo — it calls a reusable workflow in the private wave-foundation, and a public repo cannot do that (parse-time failure, zero jobs, no annotation). This workflow calls nothing cross-repo, so that trap does not apply.

Security properties, unchanged from the source:

• actions SHA-pinned (actions/checkout@df4cb1c, actions/setup-node@48b55a0)
• persist-credentials: false on checkout
• least privilege: contents: read + packages: read
• isolated install into RUNNER_TEMP, --no-save, so nothing touches this repo's dependency tree
• the .npmrc is written with a literal ${NODE_AUTH_TOKEN} (single-quoted printf) which npm expands at run time — no secret value is ever written to disk or a log
• both ${{ }} inputs (base.sha, event.before) are routed through env: and read as "$VAR", never interpolated into the script body

Diff-scoped by design: it blocks new violations without failing on legacy debt.

Refs wave-av/claude-workstation#1624.

[!NOTE]
Low Risk
Adds CI-only governance scanning with no application or runtime changes; main operational risk is merge friction if the check misbehaves before the org ruleset requires it.

Overview
Adds .github/workflows/governance-enforce.yml, a new GitHub Actions job that runs @wave-av/governance@0.4.6 on pull_request, merge_group, and pushes to main/master. The enforce job checks the diff for A_BLOCK rules (secrets in git, hardcoded paths) so new violations fail without scanning legacy debt.

The workflow vendors a hardened install/run pattern: SHA-pinned actions, read-only permissions, isolated npm install under RUNNER_TEMP with --ignore-scripts and an exact package pin, registry token only on the install step, and concurrency that cancels superseded PR runs but does not cancel in-progress push runs so commit ranges are not skipped.

Diff base selection is fail-closed: it prefers PR/merge-group/push before SHAs, and if the base is missing, zero, or unreachable (e.g. force-push), it diffs against the empty tree and scans the full repo rather than silently scanning zero files.

^{Reviewed by Cursor Bugbot for commit 57a5f15a2dfdb8bb9d5d18f8577edb56f501a038. Bugbot is set up for automated code reviews on this repo. Configure here.}

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[!NOTE]

Add governance enforcement workflow to scan diffs on PRs and pushes to main

Adds governance-enforce.yml, which runs @wave-av/governance@0.4.6 on pull requests, merge groups, and pushes to main/master. The enforcer scans only changed files using a computed diff base; if no valid base is found, it falls back to the empty tree and scans the full repository. Push and merge group runs are not cancelable to ensure no committed ranges are skipped.

^{Macroscope summarized 57a5f15.}

Summary by Sourcery

Add and harden the repository's diff-scoped governance enforcement gate before enabling it as a required status check.

New Features:

• Add an A_BLOCK governance enforcement workflow that scans pull request, merge-group, and main/master push changes for secrets, Doppler policy violations, and hardcoded paths.

Bug Fixes:

• Ensure indeterminate or unreachable diff bases trigger a full-tree scan instead of allowing an empty or partial scan to pass.

Enhancements:

• Harden the workflow with pinned action versions, least-privilege permissions, isolated package installation, scoped registry credentials, disabled install scripts, and safe run concurrency.

CI:

• Run the vendored governance check as an enforce status check before adding the repository to the required governance ruleset.

CodeAnt-AI Description

Add a fail-closed governance scan for secrets and hardcoded paths

What Changed

• Scans pull requests, merge groups, and pushes to the main branches for newly introduced secrets and hardcoded paths
• Scans the full repository when the change base is missing or unreachable, instead of silently passing an empty or partial diff
• Uses a fixed enforcer release that reports git errors as failures rather than treating them as clean scans
• Prevents registry credentials from reaching installed package scripts or the scan itself
• Ensures push commits are not left unscanned when newer push runs start

Impact

✅ Fewer unscanned commits
✅ No false passes on git errors
✅ Reduced exposure of package registry credentials

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review