[#784] add fleet CI workflow (shellcheck + secret scan + rule audit)

https://projects.knownelement.com/issues/784
2026-09-05 06:08:57 -05:00
parent 958d287a99
commit 7822abf2eb
1 changed files with 25 additions and 0 deletions
@@ -0,0 +1,25 @@
 # OAM fleet CI [#784] — same gate as pre-commit: shellcheck + secret scan + rule audit.
 # Uniform across KNEL OAM repos (single-branch main until dev/release split lands).
 name: ci
 on:
  push:
    branches: [main]
  pull_request:
 jobs:
  audit:
    runs-on: ultix
    container:
      image: node:20-bookworm
    steps:
      - uses: actions/checkout@v4
      - name: install shellcheck
        run: apt-get update -qq >/dev/null && apt-get install -qq -y shellcheck git >/dev/null
      - name: secret scan
        run: |
          if grep -rInE "BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY|aws_secret_access_key *=|AKIA[0-9A-Z]{16}" --exclude-dir=.git .; then
            echo "::error::secret material committed"; exit 1
          else
            echo "secret scan clean"
          fi
      - name: rule audit (framework check-rules)
        run: bash scripts/check-rules.sh --fast