Land #9 and #10 on main (they merged into the stale peer-dependencies branch) - #12
Merged
Merged
Conversation
A packed tarball carried nothing identifying the source it was built from, so a consumer vendoring the archives could not prove which commit it runs. Every archive now ships dist/provenance.json with the packing commit, and packing refuses a modified build input tree unless --allow-dirty marks the result. packages:pack runs the build in the same Node process as pnpm pack so the flag reaches the build's argv; pnpm appends script arguments to the end of a compound shell command, where they would land on pnpm pack. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The security policy lived as prose in examples/better-auth/README.md and PACKAGES.md, phrased for a reader rather than a checker. State it once at the repo root as FAIL IF conditions, each naming what to inspect, and end each section with the tests that pin it, so a consumer's nightly audit can execute this file instead of reading the compiled tarballs. The prose stays where it is; it explains the same choices to a human. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
SECURITY.md states its guarantees as FAIL IF conditions so a machine can execute them, but nothing executed them. A single Opus agent now runs every one as a mechanical check with evidence, then reads the auth and infrastructure code adversarially, and publishes one report. The port of Dormouse's nightly audit drops everything that only exists because that repo has three domains: no orchestrator, no subagents, no fragment merge, no separate status file. The verdict is the report's own first line, and a `<!-- END OF REPORT -->` sentinel is what says the report is finished — so an agent cut off after rewriting that line reads as inconclusive rather than as a pass. Three outcomes, not two: an audit that never decided files under the same label as a finding and holds the check run red, but says in its own issue that it is not a security finding. The push-to-main trigger is load-bearing rather than convenience. A consumer that vendors a packed tarball recovers the commit from dist/provenance.json; it can now confirm that commit was audited by reading the security-audit check run on it, which is why the job id and its name are both that string. Claude Code is invoked directly instead of through claude-code-action, which throws `Unsupported event type: push` — its context parser accepts only workflow_dispatch, repository_dispatch, schedule and workflow_run, and a step-level GITHUB_EVENT_NAME cannot stand in because the runner writes the real GITHUB_* values over a step's env. The CLI keeps the per-commit check run and makes CI and the local runner the same command over the same prompt files. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The reporting step is the only thing that decides whether a commit's security-audit check run goes green, and it was enforced by nobody: a `VERDICT: PASS` widened to a prefix match, a dropped sentinel test, or a sink removed from the redactor's argument list would all have passed review and shipped. `pnpm test:scripts` extracts the shipped shell out of the workflow by indentation and runs it — a renamed step or a moved block scalar throws rather than quietly handing the test the rest of the file. The sinks the redactor must cover are read from the archive step's own path list, so a file that starts being published without starting to be redacted fails here instead. The local runner is covered against the same grammar, and `.github/audit/_preamble.md` is pinned as the producer of the sentinel every reader waits for, since nothing else writes that literal. Verified by mutation: widening the PASS match, dropping the sentinel requirement, and removing a sink from the redactor each turn the suite red. `clamp-issue-body.mjs` and its self-test come from Dormouse unchanged but for their pointers; GitHub rejects an over-long issue body outright, which loses the whole finding rather than truncating it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
CLAUDE_CODE_OAUTH_TOKEN moves out of repository scope into the security-audit environment, whose deployment-branch policy admits only main. A workflow pushed on another branch, or a dispatch from one, never receives it. SECURITY.md audits the environment, its policy, and the ruleset that reserves main to pull requests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#9 and #10 were stacked on
peer-dependencies. That branch was not deleted after #8 merged, so GitHub never retargeted them, and both merged intopeer-dependenciesinstead ofmain. This lands them onmain:dist/provenance.json) with dirty packs refusedsecurity-auditworkflowThe merge is conflict-free, and the resulting tree is identical to
peer-dependencies. The only commit onmainthat isn't already onpeer-dependenciesis #8's merge commit, whose tree is the same as297edf6.After this merges,
ddbf96c(the pgstencil commit that dormouse main vendors) is inmain's history. Thesecurity-auditworkflow runs on push tomain, but it will check the new merge commit, notddbf96c. So to satisfy dormouse's audit rule, dormouse needs to re-vendor from amaincommit whosesecurity-auditcheck has passed.🤖 Generated with Claude Code