Documentation
¶
Overview ¶
Package workflow renders the repository files of the workflow-configured cloud agents (ADR-0034): the Claude Code and Gemini CLI GitHub Actions and Copilot's copilot-setup-steps.yml, SHA-pinned and least-privilege, and checks every rendered file against the security invariants. It imports only policy, so release builds can carry its output.
Index ¶
Constants ¶
const ( ClaudeWorkflow = ".github/workflows/halos-claude.yml" GeminiWorkflow = ".github/workflows/halos-gemini.yml" CopilotWorkflow = ".github/workflows/copilot-setup-steps.yml" )
Rendered workflow paths, relative to a repository root. Copilot's name is fixed by GitHub; the others are Halos-owned, so inventory can tell a governed run from anything else in the repository.
Variables ¶
This section is empty.
Functions ¶
func Check ¶
Check asserts the security invariants on a rendered file by reading its text, not by trusting how it was produced: no permission-bypass token (invariant 1), no literal credential, every action pinned to a full commit SHA, a top-level `permissions: {}` (jobs grant their own, least privilege), no `${{ }}` expression inside a run script (script injection), valid YAML, and every run script one Halos renders verbatim (runScripts), so a policy value reaches a shell only through env (shell and YAML injection).
Types ¶
type File ¶
type File struct {
Vendor string `json:"vendor"`
Path string `json:"path"`
Data []byte `json:"-"`
Repos []string `json:"repos,omitempty"` // policy repo patterns it is for
}
File is one rendered repository file. Releases carry it signed, for review and for the PR that adds it; halod never writes it to a machine.
Source Files