Repository navigation
docs(spec-loop): sync specs with #1453 - #1454
Merged
Merged
Conversation
Back-fill the specs for the one commit merged since the last sync: workflow-security-audit takes zizmor's token from the environment instead of a sandboxed `$(gh auth token)`, security-issue-invalidate runs its last redirected `gh` call as a plain command, and the pre-PR adversarial-review block also covers skills that verify or import someone else's PR. Advance .last-sync to the current main. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tools/spec-loop/.last-syncnow points at77884f5c.repo-health-family.md:workflow-security-auditno longer passes zizmor--gh-token "$(gh auth token)", because aghinside$(…)stays sandboxed.zizmor reads its token from
GH_TOKEN,GITHUB_TOKENorZIZMOR_GITHUB_TOKEN.With none set, the skill scans a shallow clone made by a plain
gh repo clone, or asks the user to run the remote scan.adversarial-review.md: the shared pre-PR review block now also covers skills that verify or import someone else's PR (security-issue-import-from-pr).Those skills run the reviewers before reporting on or acting on that PR.
security-issue-lifecycle.md:security-issue-invalidateStep 1 now runsgh issue viewas a plain command and reads the JSON it prints, instead of redirecting it into a file.Type of change
Test plan
prek run --all-filespassesmainat77884f5c.Generative AI tooling was used to author this PR: Claude Code (Claude Opus 5).
🤖 Generated with Claude Code