ci-guard

Overview ¶

Command ci-guard enforces AppTheory's CI wiring and package-install hygiene invariants by parsing the underlying files with real parsers instead of matching lines of text.

Subcommands:

workflow-triggers --workflow <path> [--root <dir>]
    Parse the workflow YAML, classify every job by its effective triggers
    (workflow `on:` x job `if:`), and fail closed on any wiring the
    classifier does not model explicitly.

install-hygiene --root <dir>
    Read repository-relative surface paths (one per line) on stdin and fail
    closed on any package install that leaves lifecycle scripts enabled.

lockfile-config --root <dir>
    Read repository-relative lockfile paths (one per line) on stdin and fail
    closed when a lockfile directory is missing the package-manager config
    that disables lifecycle scripts, or sets scripts back on.

Exit codes: 0 PASS, 1 FAIL, 2 BLOCKED.