feat(skills): add security scanning to cicd - #26
Merged
Merged
Conversation
The pipeline this skill composes validates build, test and docs and never scans. Adds the four classes, scoped to what the diff touches and disclosed either way, so a scan that could not run is not read as one that found nothing — the scanner-level form of skipped-job-reports-success. delivery-review's security lens now names the scans that backed it, so it can meet the evidence bar that skill already sets.
Resolves the overlap with #25, which landed first: - cicd/SKILL.md — keep main's "Use when…" description house form, carry this branch's "add security scanning" / "scan for vulnerabilities" triggers, and take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump. - delivery-review/SKILL.md — #25 moved the seven lenses out to references/lenses.md, so this branch's inline lens-6 edit had no target left. Re-applied it there instead: the security lens still has to name the scans that backed it and the classes that did not run. Taking either side of that conflict verbatim would have dropped the change silently, with CI green either way. - conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause into the 0.4.x band to match the version this branch sets. - docs/ai/skills/delivery-review.md — record references/lenses.md and the new Red Flags / Rationalizations sections, which #25's lens extraction left out of the companion doc. Verified after resolution: security-scanning.md, the ci-structure security section, the empty-scan-reads-as-clean trap, the three Verify items and the lens-6 scan disclosure are all present; #25's lens extraction and scope-band reference are intact; skill-lint passes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reopens #23, which was reverted from
mainalong with #22.GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the
same work. The commit is @Abdol164's original, cherry-picked unchanged — the
diff against
mainis byte-identical to #23 (7 files, +177/-23).Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted
(
ae4ae31,567ffba). This PR is independent of #25 again, exactly as #23 wasindependent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
Both PRs will report MERGEABLE because GitHub tests each against
mainindependently, not against each other.
The one that matters is
skills/delivery-review/SKILL.md. This PR edits lens 6in place to name the scans that backed it; #25 deletes that inline lens block
and moves the lenses to
references/lenses.md. If #25 lands first, thisedit has no target left — resolving the conflict by taking either side drops
it silently, and
security-scanning.mdships while the review lens meant toconsume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take0.4.0forcmk:cicd(a new guidance facet) over #25's0.3.4wording bump.