feat(scripts+ci): swap governance TS-allowlist check to AffineScript-compiled .deno.js

[hyperpolymath]

Depends on: #310

Second half of the seed-PR plan from #283: once the .affine source actually compiles + runs (#310), wire the workflow at the AffineScript-compiled output.

Changes

1. scripts/check-ts-allowlist.deno.js (NEW, 344 lines)

   • Generated by affinescript compile --deno-esm from the post-fix(scripts): make check-ts-allowlist.affine compile cleanly (follow-up to #283) #310.affine source. Self-contained Deno-ESM bundle: inlined runtime shims for codegen-known externs (walkRecursive, regexMatch, readTextFile, exit, consoleError) + the split / ends_with helpers. Auto-invokes await main() at module load — same shape Deno runs the existing .ts with.

2. .github/workflows/governance-reusable.yml:193

   • deno run ... check-ts-allowlist.ts → ... check-ts-allowlist.deno.js
   • Comment block explains the dual-target window: .ts kept for the regression suite (scripts/tests/check-ts-allowlist-test.sh) and for parallel-validation; retirement is a separate follow-up after the validation window.

Why ship the compiled artifact (vs compile-in-CI)

Compile-in-CI would require an AffineScript toolchain in the workflow (OCaml + dune + affinescript repo as a dep). The compiler is deterministic for this surface; committing the output keeps CI provider-free and matches the precedent in affinescript/tests/codegen-deno/*.deno.js (committed golden files).

Drift between source and committed output is the obvious risk. Follow-up will add a just check-ts-allowlist-drift recipe (recompile + diff) wired into a non-blocking CI lint.

Verification

End-to-end runtime test of the compiled output (matches the runtime fix in PR #310 commit b046787):

fixture	exit	output
empty dir	0	success line
src/Foo.ts violation	1	error block + file list
mod.ts (filename ok)	0	success line
scripts/x.ts (dir ok)	0	success line

Test plan

• CI green on this branch — note AS scanner / Hypatia / SPARK Theatre Gate may need to acknowledge the new committed .deno.js as a generated artifact (ignore findings tagged as generated)
• scripts/tests/check-ts-allowlist-test.sh still passes against the unchanged .ts archetype (no behavioural change to .ts)
• Caller repos using governance-reusable.yml show green "Check for TypeScript" steps after merge

Refs #239 (umbrella TS→AffineScript), #241 (STEP 2 tail-batch-1). Follow-up plan: add drift-detection lint, then a separate PR retires the .ts archetype after the parallel-validation window.

Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 191 issues detected

Severity	Count
🔴 Critical	64
🟠 High	37
🟡 Medium	90

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in affinescript-verify.yml",
"type": "missing_timeout_minutes",
"file": "affinescript-verify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in changelog-reusable.yml",
"type": "missing_timeout_minutes",
"file": "changelog-reusable.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql-reusable.yml",
"type": "missing_timeout_minutes",
"file": "codeql-reusable.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in deno-ci-reusable.yml",
"type": "missing_timeout_minutes",
"file": "deno-ci-reusable.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in doc-format.yml",
"type": "missing_timeout_minutes",
"file": "doc-format.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence