chore: unshadow entry-scope locals in the sync-bridge tests #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: agent-memory | |
| # GitHub member of the forge-aware ritual floor (v4.19.0; forge-aware v4.31.0–v4.32.0) — siblings: | |
| # .gitlab/agent-memory-ci.yml (GitLab) and .azuredevops/agent-memory-ci.yml (Azure DevOps), both | |
| # installed from the tool's templates/ on their forges. | |
| # Vendor-neutral ritual floor (v4.19.0). Runs server-side on every push/PR with ZERO per-user setup — | |
| # the untrained-user-proof layer (a git hook needs per-clone activation; CI does not). Advisory by | |
| # default (annotates, never fails the build). Set repo/Actions variable AGENT_MEMORY_STRICT=1 to gate. | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| memory: | |
| runs-on: ubuntu-latest | |
| env: | |
| AGENT_MEMORY_STRICT: ${{ vars.AGENT_MEMORY_STRICT }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history for the diff-based session-log check | |
| - name: memory-lint (deterministic integrity check) | |
| run: | | |
| if [ -f agent-skills/memory-lint/scripts/memory-lint.py ]; then | |
| # --strict makes warnings observable to this wrapper; the wrapper then preserves | |
| # advisory-by-default behavior or fails when AGENT_MEMORY_STRICT=1. | |
| python3 agent-skills/memory-lint/scripts/memory-lint.py --strict || { | |
| echo "::warning title=memory-lint::memory-lint reported issues (see log above)" | |
| [ "${AGENT_MEMORY_STRICT:-0}" = "1" ] && exit 1 || true | |
| } | |
| else | |
| echo "memory-lint not installed; skipping." | |
| fi | |
| - name: session-log presence (advisory) | |
| run: | | |
| base="${{ github.event.pull_request.base.sha }}" | |
| [ -n "$base" ] || base="${{ github.event.before }}" | |
| case "$base" in ''|0000000000000000000000000000000000000000) base="$(git rev-parse --verify --quiet HEAD~1 2>/dev/null || echo '')";; esac | |
| [ -n "$base" ] || { echo "no base ref; skipping ritual check"; exit 0; } | |
| changed="$(git diff --name-only "$base" HEAD 2>/dev/null || true)" | |
| work="$(printf '%s\n' "$changed" | grep -vE '^(memory/|\.agent/)' | grep -v '^$' || true)" | |
| logged="$(printf '%s\n' "$changed" | grep -E '^memory/sessions/.*\.md$' || true)" | |
| if [ -n "$work" ] && [ -z "$logged" ]; then | |
| echo "::warning title=agent-memory ritual::changes touched tracked files but added no memory/sessions/ log — write or enrich a session log per memory/PROTOCOL.md \"Close every session\"." | |
| [ "${AGENT_MEMORY_STRICT:-0}" = "1" ] && exit 1 || true | |
| else | |
| echo "ritual check: ok" | |
| fi | |
| - name: changed-config secret scan (advisory, v4.34.0) | |
| run: | | |
| # Push-time sibling of the pre-commit secret guard: credential-class scan of the | |
| # config files this push/PR changed (.json/.yml/.yaml/.properties/.toml/.ini/.env*). | |
| # Catches --no-verify bypasses and clones that never activated local hooks. | |
| [ -f agent-skills/memory-lint/scripts/memory-lint.py ] || { echo "memory-lint not installed; skipping."; exit 0; } | |
| base="${{ github.event.pull_request.base.sha }}" | |
| [ -n "$base" ] || base="${{ github.event.before }}" | |
| case "$base" in ''|0000000000000000000000000000000000000000) base="$(git rev-parse --verify --quiet HEAD~1 2>/dev/null || echo '')";; esac | |
| [ -n "$base" ] || { echo "no base ref; skipping config secret scan"; exit 0; } | |
| cfgs="$(git diff --name-only --diff-filter=ACMR "$base" HEAD 2>/dev/null | grep -E '(\.(json|ya?ml|properties|toml|ini|env))$|(^|/)\.env(\.[^/]+)?$' || true)" | |
| if [ -n "$cfgs" ] && [ -f .agent/secret-scan-ignore ]; then | |
| # committed, human-audited exemptions (formats that can't carry the inline waiver) | |
| cfgs="$(printf '%s\n' "$cfgs" | while IFS= read -r f; do | |
| [ -n "$f" ] || continue | |
| keep=1 | |
| while IFS= read -r pat || [ -n "$pat" ]; do | |
| case "$pat" in ''|'#'*) continue ;; esac | |
| case "$f" in $pat) keep=0; break ;; esac | |
| done < .agent/secret-scan-ignore | |
| [ "$keep" = "1" ] && printf '%s\n' "$f" | |
| done)" | |
| fi | |
| [ -z "$cfgs" ] && { echo "no changed config files; skipping."; exit 0; } | |
| out="$(printf '%s\n' "$cfgs" | tr '\n' '\0' | xargs -0 python3 agent-skills/memory-lint/scripts/memory-lint.py --scan-files 2>/dev/null || true)" | |
| if [ -n "$out" ]; then | |
| printf '%s\n' "$out" | |
| echo "::warning title=agent-memory secret scan::possible credential material in changed config files (see log above)" | |
| [ "${AGENT_MEMORY_STRICT:-0}" = "1" ] && exit 1 || true | |
| else | |
| echo "config secret scan: ok" | |
| fi |