ci: fix every false positive, false negative, warning and error in the pipeline - #200

Merged

konard merged 34 commits into

mainfrom

issue-199-32c07917fc87

Sep 5, 2026

Commits on Sep 4, 2026

Initial commit with task details
konard
committed
f1bb99c
docs: collect CI/CD evidence and deep analysis for issue #199
konard
committed
469484f
fix(ci): stop reporting a successful npm publish as a failure
konard
committed
50c467e
fix(ci): make Rust warnings fail the build and clear the backlog
konard
committed
7bd6eab
docs(dev-log): commit the CI evidence collected for issue #199
konard
committed
84610d4
fix(ci): make the JavaScript lint and duplication gates actually check code
konard
committed
72a681c
fix(ci): lint and format the whole repository, not just js/
konard
committed
a0d9fd5
fix(ci): lint the workflows themselves and clear every finding
konard
committed
e1e3f39
test(ci): match the layout guard to the root lint config and !cancelled()
konard
committed
7c418fd
fix(deps): clear the audit findings in both JavaScript lockfiles
konard
committed
9bae0c4
feat(ci): audit the dependency trees and analyse the sources
konard
committed
bd6946c
test(ci): pin the workflow-level-secrets invariant, record the jscpd repro
konard
committed
2d1b6f4
fix(ci): scope the zizmor audit and degrade dependency review gracefully
konard
committed
e08edeb
chore(release): add the changeset and changelog fragment for issue #199
konard
committed
a00126b
fix(ci): clear the two warnings -D warnings surfaced outside Linux
konard
committed
0dec3bc
docs(analysis): record the off-Linux warnings and the fourth upstream report
konard
committed
4243a61
fix(ci): run the three Rust guards that shipped without a caller
konard
committed
6c26793
feat(ci): scan the tree for committed credentials
konard
committed
2664646
feat(ci): validate the real merge result, not a stale merge preview
konard
committed
fa82ddd
feat(ci): validate the documentation the same way the code is validated
konard
committed
ed871d8
fix(ci): stop letting whole classes of change go unchecked
konard
committed
3e32781
docs(ci): describe the sixth workflow and the four new invariants
konard
committed
3dc7470
ci: check external links weekly instead of on pull requests
konard
committed
0a3971e
test: list tracked files without a shell so the checks work on Windows
konard
committed
0596cec
docs(dev/log): record root causes 4.17-4.23 and the two new upstream reports
konard
committed
d76ea3b
ci: document and pin the duplication threshold, drop the bootstrap .gitkeep
konard
committed
66e1cae

Navigation Menu

Uh oh!

ci: fix every false positive, false negative, warning and error in the pipeline - #200

ci: fix every false positive, false negative, warning and error in the pipeline#200
konard merged 34 commits into
mainfrom
issue-199-32c07917fc87

Commits on Sep 4, 2026

Initial commit with task details

docs: collect CI/CD evidence and deep analysis for issue #199

fix(ci): stop reporting a successful npm publish as a failure

fix(ci): make Rust warnings fail the build and clear the backlog

docs(dev-log): commit the CI evidence collected for issue #199

fix(ci): make the JavaScript lint and duplication gates actually check code

fix(ci): lint and format the whole repository, not just js/

fix(ci): lint the workflows themselves and clear every finding

test(ci): match the layout guard to the root lint config and !cancelled()

fix(deps): clear the audit findings in both JavaScript lockfiles

feat(ci): audit the dependency trees and analyse the sources

test(ci): pin the workflow-level-secrets invariant, record the jscpd repro

fix(ci): scope the zizmor audit and degrade dependency review gracefully

chore(release): add the changeset and changelog fragment for issue #199

fix(ci): clear the two warnings -D warnings surfaced outside Linux

docs(analysis): record the off-Linux warnings and the fourth upstream report

fix(ci): run the three Rust guards that shipped without a caller

feat(ci): scan the tree for committed credentials

feat(ci): validate the real merge result, not a stale merge preview

feat(ci): validate the documentation the same way the code is validated

fix(ci): stop letting whole classes of change go unchecked

docs(ci): describe the sixth workflow and the four new invariants

ci: check external links weekly instead of on pull requests

test: list tracked files without a shell so the checks work on Windows

docs(dev/log): record root causes 4.17-4.23 and the two new upstream reports

ci: document and pin the duplication threshold, drop the bootstrap .gitkeep

Commits on Sep 5, 2026

ci: audit workflows at low confidence so credential persistence is visible

test: skip the publish suite when the CDN it depends on is unreachable

docs: describe the CDN reproduction accurately

test: keep the evidence archive non-executable

fix(release): load use-m through a shared loader with timeout and retries

docs: record the use-m loader invariant, the debug switches and issue #161

docs(dev/log): correct the module-scope caller count in the #161 report

fix: load use-m through the shared loader in claude-profiles.mjs too