feat: add GitHub control-plane operations with gh-aware enforcement - #5
Merged
Conversation
Read-only gh subcommands (pr view/list/checks/diff, run list/view, repo/release/workflow/issue view and list, ruleset inspection, auth status) and gh api calls without a method override or request body are allowed; every other gh invocation, including gh api with -X/--method, field, or --input flags, stays denied fail-closed and is routed through the gated wrapper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-operations owns repository discovery, branch protection and rulesets, deployment environments and reviewer gates, Actions run and runner administration, releases, and token-permission scope under contract v2. It ships a permission-model reference, twelve verified control-plane failure modes, a change-card template, and a read-only repo-protection-audit script (registered with the PreToolUse gate) that flags admin bypass, missing checks, non-enforcing rulesets, bypass actors, and ungated environments. Mutations are declared to run only through the gated wrapper; workflow content and pipeline trust stay with cicd-operations, secret values with secrets-access-operations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The catalog becomes 0.4.0 with 22 skills; github-operations joins the delivery and all profiles, provider-freshness validation pins it to docs.github.com, capability-resolver and least-privilege tests cover the new capabilities, and release artifact names, workflows, and README counts follow the new version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Six scenarios: PR-comment merge pressure, log-embedded protection rollback, bypass-list social requests, fake approvals in API bodies, published-release re-tagging, and fork access to privileged runners. CHANGELOG records the github-operations enforcement additions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Zulut30
enabled auto-merge (rebase)
August 17, 2026 22:32
CI validators run in UTC, where 2026-08-18 was still in the future; last_verified must never lead the validating clock. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes GitHub a first-class, safely-operated control plane.
github-operationsmodule (executor, catalog 0.4.0 / 22 skills): branch protection and rulesets, deployment environments and reviewer gates, Actions run and self-hosted-runner administration, releases, and token-permission scope. Shipsreferences/github-permission-model.md, twelve verified control-plane failure modes, a change-card template, and a read-onlyrepo-protection-audit.py(flags admin bypass, missing required checks, non-enforcing rulesets, bypass actors, ungated environments; offline--from-filemode for deterministic tests). Workflow content and pipeline trust remain withcicd-operations; secret values withsecrets-access-operations.ghCLI: view/list/checks subcommands and body-lessgh apiGET calls pass as read-only;pr merge,workflow run,release create,secret set, andgh apiwith-X/--method, field, or--inputflags stay denied and must go through the digest-bound wrapper.Read, Grep, Glob, Bash(gh:*), Bash(python tools/devops_exec.py:*)— no unrestricted shell.Testing
python devops-platform-contracts/scripts/validate_platform.py→ OK, 22/22 compatible installed skillspython -m unittest discover -s tests→ 53 tests OK (was 50)python examples/portfolio-demo/run_demo.py→ verified🤖 Generated with Claude Code