Repository navigation
chore: add Destructive Command Guard workflow - #69
Closed
wheeljackz wants to merge 1 commit into
Closed
wheeljackz wants to merge 1 commit into
wheeljackz wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Owner
This was referenced Sep 10, 2026
zainfathoni
added a commit
that referenced
this pull request
Sep 11, 2026
## Summary - Add a conservative Destructive Command Guard workflow for repository-wide scan coverage. - Pin DCG to **v0.14.3** and install the Linux musl binary directly, with SHA-256 verification of the release archive. - Keep permissions read-only and fail only on error-severity findings. ## Why not the composite action Previous attempts failed in this repository's GitHub Actions: - #69 used `Dicklesworthstone/destructive_command_guard/action@v0` - #71 used `action@v0.4.5` The only green implementation was #70's direct-binary install, but it was closed without merging. This PR follows that approach, updated for the current release: - Linux x86_64 artifacts are now `x86_64-unknown-linux-musl` (not `x86_64-unknown-linux-gnu`) - The archive SHA-256 is pinned in the workflow so a swapped GitHub Release cannot run ## Validation - Local `dcg scan --paths . --fail-on error` on the source tree (excluding `node_modules`) reported **0 findings**. - The workflow file itself extracts 9 commands and reports **0 findings**. - GitHub Actions DCG jobs from this PR are the remaining check. ## Policy (first rollout) - Triggers: `push` and `pull_request` - `permissions: contents: read` - `dcg scan --paths . --fail-on error --format pretty` - No PR comments Co-authored-by: Amp <amp@ampcode.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dicklesworthstone/destructive_command_guard/action@v0pushandpull_requesterrorfindings and keep PR comments disabled for the initial rolloutNotes