Repository navigation
Conversation
taraxvoid
commented
Oct 24, 2026
taraxvoid
commented
Owner
- fix(site-ci): replace deprecated actionlint with jactionlint (fix(site-ci): replace deprecated actionlint with jactionlint #174)
- feat(cf-tokens): config and plan logic for scoped deploy tokens
- feat(cf-tokens): plan/apply/rotate script, just targets, fallback warning
- feat(cf-tokens): read CF_TOKEN_ADMIN through fnox
- feat(cf-tokens): per-env Cloudflare account for split dev/prod accounts
- feat: tool ergonomics (base hooks, tool-ci, mise, tool rulesets) (feat: tool ergonomics (base hooks, tool-ci, mise, tool rulesets) #157)
- feat(biome): shared base config sites extend as @taraxvoid/voidflow/biome (feat(biome): shared base config sites extend as @taraxvoid/voidflow/biome #183)
- feat(cf-tokens): --config for a fleet map kept in another repo
- chore: remove committed mise cache and stray file from feat: tool ergonomics (base hooks, tool-ci, mise, tool rulesets) #157 (chore: remove committed mise cache and stray file from #157 #184)
- chore(next): release 0.14.0-next (chore(next): release 0.14.0-next #176)
- refactor(config): one --config loader for the repo tools
- feat(rulesets): --config, and repos that spell rulesets out in full
- feat(ci): SARIF for gitleaks and zizmor, opt-in upload-sarif.yml (feat(ci): SARIF for gitleaks and zizmor, opt-in upload-sarif.yml #187)
- docs: spec -ci workflows and fleet sync (docs: spec <usecase>-ci workflows and fleet sync #188)
- chore(next): release 0.14.0-next.1 (chore(next): release 0.14.0-next.1 #189)
- feat(cf-tokens): pin fnox in mise, commit the Keychain provider
- fix(cf-tokens): never leave GitHub holding a deleted token
- fix(rulesets): a --config repo's missing fields default from tool()
- feat(cf-tokens): Worker and zones from the repo's wrangler config, secret per env or repo-wide
- chore: lint
- feat(cf-tokens): --try runs a deploy with a throwaway token scoped like an env's
- feat(cf-tokens): taraxvoid.net, the first migration
- chore: update txv.net cloudflare worker name
- refactor(cf-tokens): the fleet lives in the org's infra repo, not in voidflow
- chore: drop ravenflight references from tracked files
- chore: remove spec and docs
chore: back-merge v0.13.0 into next
## What and why actionlint is deprecated (mise now warns on it) in favour of [jactionlint](https://github.com/jdx/jactionlint), an actively maintained fork with upstream fixes merged. - `ci.yml`, `site-ci.yml` and the justfile pin jactionlint 2.1.0 and verify the release attestation wherever it's downloaded (site-ci previously piped actionlint's download script from curl). - **Consumers:** site-ci runs `--profile correctness`, which is actionlint's rule set, unless the caller's `.github/jactionlint.yaml` / `actionlint.yaml` sets `profile:`. That way this release can't fail caller CI on the default profile's new rules, and a repo can opt in when it's ready. - voidflow sets `profile: correctness` in `.github/jactionlint.yaml` for now. The default profile reports 9 findings, tracked in a follow-up. - `just lint-workflows` checks `jactionlint --version` instead of `command -v`, because a mise shim with no version set is on PATH but fails. Verified locally: `just lint-workflows` (download path included), `just lint-actions`, `just security`. Closes #173 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Per-Worker Workers Editor plus Workers Routes Write on the custom-domain zones, 90-day expiry, recorded fallback for account-wide grants. transbot is the first entry. Refs #179 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ning scripts/cf-tokens.ts drives the account tokens API from cloudflare/tokens.ts and writes CLOUDFLARE_API_TOKEN env secrets with gh. cloudflare-deploy gains a token-fallback input that warns on every deploy when set. Refs #179 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fnox.toml declares the secret and a per-machine provider name (cf-admin) with no value. The cf-tokens-* recipes run under `fnox exec` unless the variable is already set, and `just doctor` reports whether it resolves. Refs #179 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An env can set its own account (dev/staging apart from prod, as in ravenflight.io and rvnflt); it defaults to the repo's. Token lookups, create/rotate/delete and retire all run in the env's account. retire entries can name an account. CF_TOKEN_ADMIN is now documented as a user-owned token covering every configured account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closes #155. Makes voidflow the default kit for any @taraxvoid bun repo, not only Astro sites. ## Changes - **`lefthook/base.yml`** (breaking): the hook set moves from `lefthook/site.yml` to `lefthook/base.yml`. Before the `test:unit` and `test:push` steps it runs `unset $(git rev-parse --local-env-vars)`, so tests that spawn git in a temp repo no longer act on the hooked repo. Tests run the real hook snippets against a stub to check this. - **`lefthook/site.yml` stub**: Renovate bumps only `ref:`, and lefthook skips a missing remote config without any warning. A plain rename would therefore turn every consumer's hooks off silently. `site.yml` is now a stub whose `pre-commit` and `pre-push` fail with the one-line fix. - **mise**: a `mise.toml` for contributor tools, plus a `prepare` script that tolerates a missing `lefthook` binary. The README setup becomes `mise install && bun install`, and the consumer docs get a starter `mise.toml`. The package description and keywords now cover tools. - **`tool-ci.yml`**: a reusable validation workflow for bun tools. - Steps: gitleaks, the shared install script, `mise-action` when the repo has a `mise.toml`, then `lint`/`check`/`build`/`test`/`check:licenses` for whichever scripts `package.json` defines. actionlint and zizmor run when workflows change. - The job reports `validate / Validate`. - Parity tests keep the steps it shares identical to `site-ci.yml` and `actions/bun-install`. - **Rulesets**: a `tool()` helper (main only, no Netlify, CODEOWNERS, linear history, requires `validate / Validate`). `SITE_CHECK` is renamed `VALIDATE_CHECK`. ## Migration Consumers change `configs: [lefthook/site.yml]` to `lefthook/base.yml` when they bump `ref`. Until they do, commits and pushes fail with that instruction. ## Notes - On free personal plan the rulesets API returns 403 for private repos, which aborts the whole `apply-rulesets` run. - `bun scripts/apply-rulesets.ts --check` reports the fleet in sync. An earlier run listed 5 differences, but none was drift. They were retired `next (staging)`/`live (prod)` rulesets on queeromaha, soundry and synthomaha, waiting for `--prune`. Those rulesets have now been pruned, and the stale `next`/`live` branches on soundry and synthomaha (0 commits ahead of main, no open PRs) have been deleted. That cleanup was done out of band; this branch does not change it. ## Verification - `bun test`: 148 pass, 0 fail. - `just validate`: actionlint, check-jsonschema, shellcheck, gitleaks and zizmor all clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…iome (#183) Closes #182 - `biome/base.json`: the house style five sites already share (4-space, LF, width 80, single quotes, semicolons as needed, trailing commas, `recommended` preset, organize imports, CSS lint off, HTML formatter settings, git ignore file, `.astro` unused-import override). No ignore lists; those stay per site. - Exported as `@taraxvoid/voidflow/biome` and added to `files`, so a site writes `"extends": ["@taraxvoid/voidflow/biome"]`. - Biome 1.x warning (never fails) in the `lefthook/site.yml` pre-commit hook and a `Check Biome version` step in `site-ci.yml` before `Lint Code`. - README section on using it. ## Testing `test/biome-base.test.ts` builds a throwaway site that extends the package by name and runs Biome 2.5.14 (new exact devDependency) on it: - the base resolves through the package export - house style is enforced (semicolons, double quotes fail) and the recommended preset is on - the `.astro` override matches files in the extending site (with a control showing recommended flags the same file without the base) - a site setting overrides the base It also runs the hook and CI snippets against fake installs of Biome 1.9.4, 2.5.14 and none. `bun test`: 125 pass, 1 fail. The failure is `lefthook/site.yml > is a valid lefthook config`, which fails locally because `lefthook` on PATH is a mise shim with no version set (`Bun.which` finds the shim). `mise exec lefthook@2.2.1 -- lefthook validate` on the changed config prints "All good". `just lint-workflows lint-shell lint-actions` pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
REPOS stays the built-in (taraxvoid) config. --config loads a module's REPOS or default export instead, checked up front with every problem reported by path, so another org can keep its account and Worker layout in its own private repo. The just recipes pass CF_TOKENS_BASE so a relative path resolves from where just was run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#157 (e775c8b) committed mise state from a run with HOME at the repo root: `.cache/mise/`, `.local/share/mise/` (including lefthook binaries) and `.local/state/mise/`, plus a stray file `f` containing `y`. This removes them and adds `/.cache/` and `/.local/` to `.gitignore` so they don't come back. `mise.toml` stays. Refs #157 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
🤖 I have created a release *beep* *boop* --- ## [0.14.0-next](v0.13.0...v0.14.0-next) (2026-10-16) ### Features * **biome:** shared base config sites extend as @taraxvoid/voidflow/biome ([#183](#183)) ([a5f0977](a5f0977)) * tool ergonomics (base hooks, tool-ci, mise, tool rulesets) ([#157](#157)) ([e775c8b](e775c8b)) ### Bug Fixes * **site-ci:** replace deprecated actionlint with jactionlint ([#174](#174)) ([6192a43](6192a43)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: ravenflight-releases[bot] <330165707+ravenflight-releases[bot]@users.noreply.github.com>
Moves the cf-tokens loader to scripts/lib/config.ts so apply-rulesets can share it, and renames the base-dir variable to VOIDFLOW_CONFIG_BASE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
apply-rulesets takes --config like cf-tokens, so another org's rulesets live in its own repo. A repo there may list raw rulesets instead of tiers (RawConfig) when its protection doesn't fit the tier model; they are wanted verbatim. OrganizationAdmin is now a valid bypass actor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`site-ci.yml` and `tool-ci.yml` now write gitleaks and zizmor results as SARIF and keep them as the `voidflow-sarif` artifact. New opt-in `upload-sarif.yml` sends them to code scanning, so voidlight's `findings.zizmor` / `findings.gitleaks` stop being `null`. - gitleaks: same step, plus `--report-format sarif` (redacted). Still gates. - zizmor: extra `--format sarif` run over every workflow after the gates, `!cancelled()`, never fails the job (zizmor disables exit codes for SARIF). The existing zizmor gate in tool-ci is unchanged. - Upload is a separate reusable workflow because it needs `security-events: write`; asking for it inside site-ci/tool-ci would fail every caller that doesn't grant it. Callers add a `sarif` job (README has the snippet). - One category per tool, so each upload only closes its own fixed alerts. - Tests keep the SARIF steps identical between site-ci and tool-ci and pin `security-events` to upload-sarif.yml only. Doesn't add the zizmor *gate* to site-ci (#178), but sites using `upload-sarif.yml` get zizmor findings counted. Private repos need GitHub Code Security for the upload; public sites are free. Suggested bump: **minor** (feat) → 0.14.0. --- _Generated by [Claude Code](https://claude.ai/code/session_01KVnoX5acfvfmD6ge48HjqB)_ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Spec for `python-ci.yml`, `skills-ci.yml`, a deferred `iac-ci.yml`, the shared contract every `<usecase>-ci.yml` follows, and fleet sync (Renovate group rule, PR-time drift warning, `just fleet-sync`). Docs only, no bump. --- _Generated by [Claude Code](https://claude.ai/code/session_01KVnoX5acfvfmD6ge48HjqB)_ --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: ravenflight-releases[bot] <330165707+ravenflight-releases[bot]@users.noreply.github.com>
🤖 I have created a release *beep* *boop* --- ## [0.14.0-next.1](v0.14.0-next...v0.14.0-next.1) (2026-10-22) ### Features * **ci:** SARIF for gitleaks and zizmor, opt-in upload-sarif.yml ([#187](#187)) ([3ff2a33](3ff2a33)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: ravenflight-releases[bot] <330165707+ravenflight-releases[bot]@users.noreply.github.com>
Brings main's 0.14.0 release and the Depot CI migration (#203) into next. Version bookkeeping follows scripts/back-merge.ts: package.json, jsr.json and both manifests move to 0.14.0, CHANGELOG.md takes main's side. Other conflicts keep next's side (SARIF in tool-ci.yml, README, tests) and add main's ravenflight.io ruleset entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: back-merge v0.14.0 into next
Maintainers no longer edit ~/.config/fnox/config.toml: fnox.toml defines cf-admin as the macOS Keychain, and a gitignored fnox.local.toml can redefine it for other backends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves the conflicts the back-merge job refused (#219): - README.md: take main's consumer rewrite and keep next's SARIF section as a top-level "Code scanning (SARIF)" section after Tool CI. - test/site-ci.test.ts: main's docs-only gate test required every step after `decide` to carry the gate, but next's SARIF steps run after failures and must stay last. Exempt the three trailing SARIF steps so docs-only PRs still keep their gitleaks/zizmor SARIF. - .release-please/next-manifest.json: 0.14.0 to 0.15.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: back-merge v0.15.0 from main into next
README went consumer-only on next; the Cloudflare tokens and --config sections move to CONTRIBUTING.md next to Branch rulesets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed `gh secret set` after minting a token left the new token in place. On the next run the create case planned `ok` forever (the secret was never written), and the rotate case kept the latest-expiring duplicate, the one GitHub never received, and deleted the one it held. Now a failed secret write deletes the token it just minted, and any duplicates are rotated away (fresh token into the secret, then all old ones deleted) instead of guessing which one is live. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
checkFleet hard-coded the boolean fields it checked, so a field added to RepoConfig later (mergeQueue in #209) went unchecked and a config that left it out relied on undefined being falsy. Missing fields now take tool()'s value, given ones must match its type, and unknown fields (typos) are reported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cret per env or repo-wide An env no longer has to copy its Worker name and zones from wrangler: the plan reads the repo's wrangler config (default branch) the way wrangler does, maps each route host to the account zone it sits in, and fails on a host in none. `worker` and `zones` still override; `zones: []` grants none (Worker Preview tokens). `secret: 'repo'` puts an env's token in the repository secret for repos that deploy without GitHub environments; the default stays an environment secret, gated by that environment's branch policy. When every env uses environments, a leftover repository CLOUDFLARE_API_TOKEN is reported and deleted with --prune. Also: list endpoints page by result_info instead of looping while pages are full, and scripts and zones are fetched once per account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ke an env's A local deploy can't use the real token (its value only exists in GitHub) and a shell holding an admin token hides missing grants, so this mints a one-hour token with the env's exact policies, runs the command with it as CLOUDFLARE_API_TOKEN (CF_TOKEN_ADMIN removed), then deletes it. The plan also prints each token's last_used_on, so a CI deploy shows up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…voidflow cloudflare/tokens.ts keeps the config shape and plan logic; repo names, account ids and envs move to <user-or-org>/infra, and cf-tokens now requires --config. cf-tokens-try takes the config path so an infra repo's [no-cd] recipe can run it from a site checkout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The ravenflight.io ruleset entry belongs in the org's infra repo (--config), like its cf-tokens fleet. Tests and docs use example-org placeholders. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.