From dab9ac8578b03ea581c602f37dc569d9293bf911 Mon Sep 17 00:00:00 2001 From: randypanding Date: Wed, 19 Aug 2026 08:01:27 +0000 Subject: [PATCH 1/4] =?UTF-8?q?fix:=20=E6=B2=BB=E7=90=86=E5=B1=82=E5=AF=B9?= =?UTF-8?q?=E9=BD=90=E2=80=94=E2=80=94ruleset=20=E5=90=88=E5=B9=B6?= =?UTF-8?q?=E8=A7=A3=E9=94=81+GOVERNANCE=20=E5=8F=A3=E5=BE=84+=E7=BB=84?= =?UTF-8?q?=E7=BB=87=E5=9C=B0=E5=9B=BE+gate=20=E5=AD=98=E5=9C=A8=E6=80=A7?= =?UTF-8?q?=EF=BC=88ADR-0021=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - rulesets/main-protection: require_code_owner_review true→false（单 owner 下=true 使一切合并 只能 admin bypass、SC-3 automerge 死锁——线上已同步修复，本提交对齐落盘单一真源） - GOVERNANCE: GM-1 cron daily 03:00→hourly（实现为 0 * * * *）；BP-1/2/3/4、GM-2 verify daily→hourly；BP-2/AG-3 幽灵 T-11 引用删除换真实口径；C1 scope template-service 整仓→ 脚手架面（与 SC-3 automerge 冲突收敛） - REPOS: agent-tools planned→active（悬空供应链引用消除——已建仓）；补申报 Shorts_Director （GM-4 漂移）；agent-registry key_paths 补 standards/ 与 simulate-wave.py - languages: dependency_policy 显式划定边界（新增依赖审批 vs minor/patch 自动合并） - gate.yml: 复用 CI-Workflows hygiene 聚合（CI-1 治理仓自食其粮）；adr-required 升级存在性 校验（ADR-0020 全仓公开后可零凭据跨读——伪造 ADR 从 24h 后验提前到 PR 时点拦截） - governance-drift.yml: 基础设施故障与真漂移分通道报告（限流/缺 token 不再误报为漂移） ADR-0021 --- .github/workflows/gate.yml | 50 +++++++++++++++++++----- .github/workflows/governance-drift.yml | 11 +++++- governance/GOVERNANCE.yaml | 16 ++++---- governance/REPOS.yaml | 16 ++++++-- governance/policy/languages.yaml | 3 ++ governance/rulesets/main-protection.json | 4 +- 6 files changed, 76 insertions(+), 24 deletions(-) diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index 1ad282c..d560ef8 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -11,13 +11,29 @@ on: permissions: {} jobs: + hygiene: + # CI-1 对治理仓自身（ADR-0021）：治理仓内容变更此前不经 gitleaks/zizmor—— + # 复用 CI-Workflows hygiene（大文件/凭据类文件/gitleaks 全历史/zizmor 工作流审计） + uses: Cloudbird-Software/CI-Workflows/.github/workflows/hygiene.yml@v1 + gate: runs-on: ubuntu-latest timeout-minutes: 10 # testing.yaml T-01 "gate<5min" 原则的硬上限（红队 #18 P2：无 timeout 的 job 失控可挂 6h） + needs: hygiene + if: always() permissions: - contents: read # job 级最小权限（评审项：防后续新增 job 继承 workflow 级权限） + contents: read # job 级最小权限（评审项：防后续新增 job 继承 workflow 级权限）； + # 兼读公开仓 agent-registry/decisions（adr-required 存在性校验） pull-requests: read # 仅 adr-required 步骤读取 PR 文件清单 steps: + - name: hygiene green? + env: + NEEDS: ${{ toJSON(needs) }} + run: | + echo "$NEEDS" + if echo "$NEEDS" | jq -e '[to_entries[] | select(.value.result != "success" and .value.result != "skipped")] | length > 0' >/dev/null; then + echo "::error::hygiene 未通过"; exit 1 + fi - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -75,11 +91,10 @@ jobs: # C1 路径（governance/ standards/ scripts/ .github/ CODEOWNERS）变更的 PR， # title/body 必须引用 ADR-NNNN——GOVERNANCE flows.governance_change "无 ADR 不合并" # 的机器执行。本仓不落盘 ADR（L1 决策记录在 agent-registry/decisions/， - # 见 REPOS.yaml role）。被引 ADR 的**存在性**校验不在本步骤做：agent-registry 是 - # 私有仓，PR 上下文的 GITHUB_TOKEN 无跨仓读权，而把 org secret（如 - # GOVERNANCE_TOKEN）注入 PR 触发的 workflow = 向 PR 控制的代码暴露凭据 - # （zizmor secret-exposure 模型）——存在性由 drift-check.sh §10 后验（每日， - # 可信 main 上下文），owner-only review 仍是 C1 的权威人类门禁。 + # 见 REPOS.yaml role）。存在性校验（ADR-0021 升级）：ADR-0020 全仓公开后， + # GITHUB_TOKEN 可读公开仓 contents——被引 ADR 必须真实存在于 agent-registry/decisions/ + #（此前只能等 drift-check §10 后验，伪造引用有 24h 窗口；现在 PR 时点即拦）。 + # 实体性（防空壳）仍由 drift-check §10 后验；owner-only review 仍是权威人类门禁。 - name: adr-required（C1 变更须引用 ADR） if: github.event_name == 'pull_request' env: @@ -123,9 +138,26 @@ jobs: fi # 词边界（评审项）：NOTADR-0013junk 之类子串不得满足 ADR 引用要求 ADR_RE='\bADR-[0-9]{4}\b' - if { echo "$PR_TITLE"; echo "$PR_BODY"; } | grep -qE "$ADR_RE"; then - echo "OK adr-required: $( { echo "$PR_TITLE"; echo "$PR_BODY"; } | grep -oE "$ADR_RE" | sort -u | tr '\n' ' ')（存在性后验：drift-check §10）" - else + if ! { echo "$PR_TITLE"; echo "$PR_BODY"; } | grep -qE "$ADR_RE"; then echo "::error::C1 路径变更（governance/standards/scripts/.github/CODEOWNERS）但 PR 未引用任何 ADR-NNNN（GOVERNANCE flows.governance_change C1：无 ADR 不合并）" exit 1 fi + # 存在性校验（ADR-0021）：被引 ADR 须存在于公开仓 agent-registry/decisions/ + #（GITHUB_TOKEN 读公开仓；API 失败 fail-closed——检测器失明不得伪装通过） + ADR_LISTING=$(gh api "repos/Cloudbird-Software/agent-registry/contents/decisions?per_page=100" --paginate --jq '.[].name' 2>/dev/null) + if [[ -z "$ADR_LISTING" ]]; then + echo "::error::agent-registry/decisions 清单拉取失败——ADR 引用存在性无法校验（fail-closed）" + exit 1 + fi + MISSING=0 + for ref in $( { echo "$PR_TITLE"; echo "$PR_BODY"; } | grep -oE "$ADR_RE" | sort -u ); do + num="${ref#ADR-}" + if ! grep -q "^ADR-${num}-" <<<"$ADR_LISTING"; then + echo "::error::引用的 ${ref} 在 agent-registry/decisions/ 无对应文件（幽灵 ADR——C1 决策背书不成立）" + MISSING=1 + fi + done + if [[ $MISSING -eq 0 ]]; then + echo "OK adr-required: $( { echo "$PR_TITLE"; echo "$PR_BODY"; } | grep -oE "$ADR_RE" | sort -u | tr '\n' ' ')（存在性已验；实体性后验：drift-check §10）" + fi + exit $MISSING diff --git a/.github/workflows/governance-drift.yml b/.github/workflows/governance-drift.yml index 895475a..221ea04 100644 --- a/.github/workflows/governance-drift.yml +++ b/.github/workflows/governance-drift.yml @@ -33,13 +33,20 @@ jobs: exit 2 fi bash governance/drift-check.sh | tee drift-report.txt - - name: 发现漂移则开 issue（幂等） + - name: 发现漂移则开 issue（幂等；基础设施故障分通道——ADR-0021） if: failure() env: GH_TOKEN: ${{ github.token }} REPO: ${{ github.repository }} run: | - TITLE="治理漂移检测：组织配置与 governance/ 落盘不一致" + # 分通道（红队 #66-G1）：exit 2（token 缺失）与 API 故障不是漂移—— + # 此前一律按漂移开口径开 issue，限流/传输故障会在整点被误报为漂移。 + # 判据：报告里存在 DRIFT 行=真漂移；否则=检测器自身故障（标题/处置路径不同）。 + if ! grep -q '^DRIFT' drift-report.txt 2>/dev/null; then + TITLE="drift-check 运行失败（基础设施故障——非漂移）" + else + TITLE="治理漂移检测：组织配置与 governance/ 落盘不一致" + fi # 归属标记（评审项）：issue 归属判定用专属 label 而非标题搜索—— # 标题搜索会把人工/其他来源的同名 issue 误当作本检测器的报告去评论/关闭 LABEL="auto-drift-report" diff --git a/governance/GOVERNANCE.yaml b/governance/GOVERNANCE.yaml index 2cf185c..ba01ee1 100644 --- a/governance/GOVERNANCE.yaml +++ b/governance/GOVERNANCE.yaml @@ -28,7 +28,7 @@ domains: intent: "合并前置：唯一 required check = gate（聚合检查）" strength: enforced platform: {github: {mechanism: ruleset-required-status, context: gate}} - verify: {method: negative-test, frequency: weekly, see: T-11} + verify: {method: "drift-check §1（required_status_checks 对账）", frequency: hourly} - id: BP-3 intent: "发布标签 v* 不可删除/覆盖" strength: enforced @@ -96,9 +96,9 @@ domains: strength: enforced platform: {github: {mechanism: script, entry: scripts/gh-app-token.sh}} - id: AG-3 - intent: "App 受全部 ruleset 约束（无 bypass）；CI 合并用 App 令牌（触发下游 workflow）" + intent: "App 受全部 ruleset 约束（bypass 仅 OrganizationAdmin——App 非 admin 无 bypass）；CI 合并用 App 令牌（触发下游 workflow）" strength: enforced - verify: {method: negative-test, frequency: weekly, see: T-11} + verify: {method: "drift-check §1（bypass_actors 对账）+ 季度人工负向复核", frequency: hourly} - id: AG-4 intent: "App 安装范围 selected；新仓初始化自动挂载" strength: monitored @@ -114,14 +114,14 @@ domains: governance_meta: measures: - id: GM-1 - intent: "期望状态落盘；每日漂移检测（红队修复：周检盲区最长 7 天→1 天）；漂移自动开 issue；漂移消除自动关闭 issue（防陈旧报告累积噪音）" + intent: "期望状态落盘；小时级漂移检测（ADR-0020：可见性盲区 24h→1h）；漂移自动开 issue；漂移消除自动关闭 issue（防陈旧报告累积噪音）；基础设施故障（token 缺失/API 不可达）与漂移分通道报告（ADR-0021）" strength: monitored - platform: {github: {mechanism: workflow, file: .github/workflows/governance-drift.yml, cron: "daily 03:00 UTC"}} + platform: {github: {mechanism: workflow, file: .github/workflows/governance-drift.yml, cron: "0 * * * *"}} verify: {method: self, state: expected-state.json} - id: GM-2 intent: "治理仓变更一律走 flows.governance_change 分级流程（C1 附 ADR / C2 过 validate / C3 走 PR）；破玻璃=直推后 24h 内回填；owner 与 AI 同受约束" strength: enforced - verify: {method: drift-check, part: section-8, frequency: daily} + verify: {method: drift-check, part: section-8, frequency: hourly} - id: GM-3 intent: "政策文件机器可判定（本目录）；agent 按需读取，不常驻上下文" strength: advisory @@ -190,9 +190,9 @@ flows: # 授权凭证 = ADR + PR 记录；破玻璃保留但被监控 classes: - id: C1 - scope: ["governance/（整目录——含 GOVERNANCE/REPOS.yaml、rulesets、expected-state、apply/drift 脚本、policy）", standards/, models.yaml, decisions/, scripts/, ".github/（CI 门禁自身——改门禁=改治理）", CODEOWNERS, profile/, "tests/（agent-registry 验证器元测试——验证器之验证）", "template-service（整仓——供应链入口：模板被污染=全部新仓继承后门，红队修复 P0）"] + scope: ["governance/（整目录——含 GOVERNANCE/REPOS.yaml、rulesets、expected-state、apply/drift 脚本、policy）", standards/, models.yaml, decisions/, scripts/, ".github/（CI 门禁自身——改门禁=改治理）", CODEOWNERS, profile/, "tests/（agent-registry 验证器元测试——验证器之验证）", "template-service 脚手架面（.github/、AGENTS.md、Makefile、docs/、zizmor.yml——供应链入口：模板防线被污染=全部新仓继承后门，红队修复 P0；src/ 业务面属 C3。ADR-0021 收敛范围：整仓 C1 会与 SC-3 依赖 automerge 冲突——依赖 PR 无 ADR 不可自动合并）"] requires: [PR, "ADR（新建或引用编号）", "drift-check 本地预检", owner-merge] - rationale: "治理意图变更必须可追溯到一个决策记录；无 ADR 不合并。scope 与机器执法路径全集一致（.github gate：governance/standards/scripts/.github/CODEOWNERS/profile；agent-registry validate：standards/decisions/scripts/.github/CODEOWNERS/tests——评审项：声明与执行不得互斥）；template-service 是新仓派生源头，视同治理意图变更（gate adr-required 机器检查 + owner-only review）" + rationale: "治理意图变更必须可追溯到一个决策记录；无 ADR 不合并。scope 与机器执法路径全集一致（.github gate：governance/standards/scripts/.github/CODEOWNERS/profile；agent-registry validate：standards/decisions/scripts/.github/CODEOWNERS/tests——评审项：声明与执行不得互斥）；template-service 的脚手架面是新仓派生源头，视同治理意图变更（gate adr-required 机器检查 + owner-only review；ADR-0021 范围收敛后与 CI-Workflows ci.yml 的 C1 路径判定一致）" - id: C2 scope: [agent-registry/registry/, 业务仓 AGENTS.md/CODEOWNERS] requires: [PR, "validate.py 通过"] diff --git a/governance/REPOS.yaml b/governance/REPOS.yaml index 5bdd713..ee5aa0a 100644 --- a/governance/REPOS.yaml +++ b/governance/REPOS.yaml @@ -37,7 +37,9 @@ repos: visibility: public status: active role: 注册层——agent/skill/tool/team 声明 + 模型注册表(models.yaml) + ADR；AR-2 状态门禁校验器 - key_paths: [registry/, decisions/, scripts/validate.py] + key_paths: [registry/, decisions/, standards/, scripts/validate.py, scripts/simulate-wave.py] + # ADR-0021：standards/（协作标准）与 simulate-wave.py（CI required + # 门禁，ADR-0015）此前不在组织地图——门禁自身逃逸治理地图 policies: [agent_runtime] - name: template-service @@ -50,8 +52,16 @@ repos: - name: agent-tools layer: L2 visibility: public - status: planned - role: 自研工具实现仓——被 tool 声明的 implementation 字段引用 + status: active + role: 自研工具实现仓——被 tool 声明的 implementation 字段引用（ADR-0021：approved 工具 + gitcode-pr 引用本仓，planned=悬空供应链引用；已按 flows.new_repo 从 template-service + 派生并跑 new-repo-init） + - name: Shorts_Director + layer: L2 + visibility: public + status: active + role: 产品仓——短视频导演工具（ADR-0021：线上存在但未申报=GM-4 漂移，补申报；治理面 + 随首个正式 PR 落地 AGENTS.md/CODEOWNERS 接入） - name: AI_Web_School layer: L2 diff --git a/governance/policy/languages.yaml b/governance/policy/languages.yaml index 7e5e24e..18e3216 100644 --- a/governance/policy/languages.yaml +++ b/governance/policy/languages.yaml @@ -43,6 +43,9 @@ rules: - {id: INFRA-2, lang: infra, rule: "local 值禁止参与资源命名", enforcement: review} dependency_policy: + scope: "新增依赖引入（package.json/manifest 新条目）——approval_required 针对本域； + 既有依赖的 minor/patch 更新走 GOVERNANCE SC-3 自动合并（gate 绿即合，dependabot+automerge）， + major 升级留人（ADR-0021：两口径并存曾可读作互斥，此处显式划定边界）" approval_required: true approver: "owner（randypanding）——CODEOWNERS owner-only 路径；owner 缺席 7 天由 stewardship curator 在周报升级（无静默挂起）" response_sla: "提案 PR 开出后 7 天内必须批/驳（超时=依赖审批债，进 curator 债清单）" diff --git a/governance/rulesets/main-protection.json b/governance/rulesets/main-protection.json index aec9573..18b1bf4 100644 --- a/governance/rulesets/main-protection.json +++ b/governance/rulesets/main-protection.json @@ -40,7 +40,7 @@ "parameters": { "required_approving_review_count": 0, "dismiss_stale_reviews_on_push": true, - "require_code_owner_review": true, + "require_code_owner_review": false, "require_last_push_approval": false, "required_review_thread_resolution": true, "allowed_merge_methods": [ @@ -61,4 +61,4 @@ } } ] -} \ No newline at end of file +} From 16e4452406eabd58f499ef4abe3a57fce769b619 Mon Sep 17 00:00:00 2001 From: randypanding Date: Wed, 19 Aug 2026 08:14:08 +0000 Subject: [PATCH 2/4] =?UTF-8?q?fix:=20=E9=A1=B6=E5=B1=82=E6=9D=83=E9=99=90?= =?UTF-8?q?=20{}=20=E8=87=B4=20reusable=20workflow=20startup=5Ffailure?= =?UTF-8?q?=E2=80=94=E2=80=94=E6=94=B9=E6=9C=80=E5=B0=8F=E9=9D=9E=E7=A9=BA?= =?UTF-8?q?=E9=9B=86=20contents:read?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/gate.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index d560ef8..3f3ccf1 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -8,7 +8,11 @@ on: push: branches: [main] -permissions: {} +# 顶层不可为空权限集（ADR-0021 实测教训）：hygiene 复用工作流按 workflow_call 需要 +# contents:read 落盘 checkout——被调用方只能收窄不能提升调用方权限，顶层 permissions:{} +# 会令 reusable workflow 直接 startup_failure。取最小非空集 contents:read；各 job 自行收窄。 +permissions: + contents: read jobs: hygiene: From 7d70ba2ea051b63097c9df0ec9cbb3b0a55e3e80 Mon Sep 17 00:00:00 2001 From: randypanding Date: Wed, 19 Aug 2026 08:24:49 +0000 Subject: [PATCH 3/4] =?UTF-8?q?ci:=20=E9=87=8D=E8=A7=A6=E5=8F=91=E2=80=94?= =?UTF-8?q?=E2=80=94=E6=B3=84=E6=BC=8F=E5=88=86=E6=94=AF=E5=B7=B2=E5=88=A0?= =?UTF-8?q?=E9=99=A4=EF=BC=88=E8=A7=81=20#74=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From 41b8d9a307de6efcf079b7da97946cc18719e7ed Mon Sep 17 00:00:00 2001 From: randypanding Date: Wed, 19 Aug 2026 08:30:57 +0000 Subject: [PATCH 4/4] =?UTF-8?q?fix:=20hygiene=20=E5=A4=8D=E7=94=A8?= =?UTF-8?q?=E9=92=89=20commit=20hash=EF=BC=88zizmor=20unpinned-uses?= =?UTF-8?q?=EF=BC=8CADR-0021=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/gate.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index 3f3ccf1..d47a71c 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -18,7 +18,9 @@ jobs: hygiene: # CI-1 对治理仓自身（ADR-0021）：治理仓内容变更此前不经 gitleaks/zizmor—— # 复用 CI-Workflows hygiene（大文件/凭据类文件/gitleaks 全历史/zizmor 工作流审计） - uses: Cloudbird-Software/CI-Workflows/.github/workflows/hygiene.yml@v1 + # 钉 commit hash（zizmor unpinned-uses：可变 tag 不算钉住；ADR-0021）： + # hash 即 CI-Workflows v1 tag 当前指向，升级 v1 须同步换 hash + uses: Cloudbird-Software/CI-Workflows/.github/workflows/hygiene.yml@9c20d43d60e9f9d1438f171aeee8e4dbdf02c08b # v1 gate: runs-on: ubuntu-latest