From d21467adb5f6c4d71a5b9f9f9a339b04735b0567 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:34:19 -0400 Subject: [PATCH 1/7] feat: the fixture-hello recipe; pin the endpoint's serving ref MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registers minspec/fixture-hello 1.0 (bundle registration + config copy carrying the greeting parameter). Fixes a live endpoint defect found while designing the E2E: index.json declared branch "main" — a branch this repository has never had — while recipe_template hit the GitHub contents API with no ref, which serves the DEFAULT branch; after today's dev-trunk switch that meant recipes-in-review could reach real installs. The template now pins ?ref=master and every declaration names master, the stable branch: the road serves stable, review happens on dev. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- index.json | 13 +++++++++---- minspec.fixture-hello.1.0.json | 25 +++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 4 deletions(-) create mode 100644 minspec.fixture-hello.1.0.json diff --git a/index.json b/index.json index 42a0ce9..ab964bf 100644 --- a/index.json +++ b/index.json @@ -1,10 +1,15 @@ { - "recipes": {}, - "branch": "main", + "recipes": { + "minspec/fixture-hello": [ + "1.0" + ] + }, + "branch": "master", "is_contrib": true, "_links": { "repository": "github.com/minspec/recipes", - "origin_template": "{package}:{version}@github.com/minspec/recipes:main", + "origin_template": "{package}:{version}@github.com/minspec/recipes:master", "recipe_template": "https://api.github.com/repos/minspec/recipes/contents/{package_dotted}.{version}.json" - } + }, + "recipe_template": "https://api.github.com/repos/minspec/recipes/contents/{package_dotted}.{version}.json?ref=master" } diff --git a/minspec.fixture-hello.1.0.json b/minspec.fixture-hello.1.0.json new file mode 100644 index 0000000..746dfd3 --- /dev/null +++ b/minspec.fixture-hello.1.0.json @@ -0,0 +1,25 @@ +{ + "manifests": { + "minspec/fixture-hello": { + "manifest": { + "bundles": { + "Minspec\\FixtureHello\\FixtureHelloBundle": ["all"] + }, + "copy-from-recipe": { + "config/": "%CONFIG_DIR%/" + } + }, + "files": { + "config/packages/fixture_hello.yaml": { + "contents": [ + "parameters:", + " fixture_hello.greeting: 'wired-by-recipe'", + "" + ], + "executable": false + } + }, + "ref": "e2e-fixture-1.0" + } + } +} From bc8ffd99e5c265a9f3fd994de76d6c8cb9065852 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:36:46 -0400 Subject: [PATCH 2/7] fix: the endpoint is first-party, not contrib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Measured in the E2E dry run: Flex fetched the fixture-hello recipe and IGNORED it, because this endpoint declared is_contrib: true while the skeleton ships allow-contrib: false — MinSpec's own registry silently no-oped against MinSpec's own skeleton. The org's registry serving the org's packages is first-party; is_contrib is now false. Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- index.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.json b/index.json index ab964bf..79fd407 100644 --- a/index.json +++ b/index.json @@ -5,7 +5,7 @@ ] }, "branch": "master", - "is_contrib": true, + "is_contrib": false, "_links": { "repository": "github.com/minspec/recipes", "origin_template": "{package}:{version}@github.com/minspec/recipes:master", From 27284795d1fb420f96f83cbcd2fee95b6226bcdc Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:43:40 -0400 Subject: [PATCH 3/7] repo: workflow and MCP hardening from the security audit Findings applied from the independent audit (CHANGES verdict): workflow-level permissions contents:read; persist-credentials false on checkout; every action pinned to a reviewed commit SHA with its tag in a comment; Serena pinned in .mcp.json to the audited git commit instead of floating uvx resolution. Finding: [P1] workflows ran with default token permissions Finding: [P1] .mcp.json launched unversioned uvx serena Finding: [P2] mutable action tags across all repositories Verified: python yaml.safe_load + json.load on the changed files Source: original Co-Authored-By: GPT-5 Codex Co-Authored-By: Claude Fable 5 Reviewed-by: GPT-5 Codex Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- .github/workflows/ci.yml | 6 +++++- .mcp.json | 11 ++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ee7ec5..b05d4a6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,11 +3,15 @@ on: pull_request: push: branches: [dev, master] +permissions: + contents: read jobs: ci: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: JSON validity run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty - name: YAML validity diff --git a/.mcp.json b/.mcp.json index e16128b..7a030cd 100644 --- a/.mcp.json +++ b/.mcp.json @@ -2,7 +2,16 @@ "mcpServers": { "serena": { "command": "uvx", - "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."] + "args": [ + "--from", + "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84", + "serena", + "start-mcp-server", + "--context", + "claude-code", + "--project", + "." + ] } } } From ab159712237aaa0f1d8a91a48cff8d985d235427 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:49:22 -0400 Subject: [PATCH 4/7] repo: call the org road test on every change here MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo can break the package road, so its PRs now run the canonical e2e from minspec/workbench via workflow_call — this PR's code in its own slot, siblings at dev. One test, owned in one place, never copied. Source: owner 2026-09-01 ("make it a real test and stick to it") Source: original Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- .github/workflows/e2e.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/e2e.yml diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml new file mode 100644 index 0000000..c885746 --- /dev/null +++ b/.github/workflows/e2e.yml @@ -0,0 +1,16 @@ +name: e2e +# Caller of the org's canonical road test (minspec/workbench e2e.yml): +# this repo's PR rides in its own slot, siblings at dev. One test, +# no copies to drift. +on: + pull_request: + push: + branches: [dev, master] +permissions: + contents: read +jobs: + e2e: + uses: minspec/workbench/.github/workflows/e2e.yml@dev + with: + recipes_ref: ${{ github.event.pull_request.head.sha || github.sha }} + workbench_ref: dev From c7e4b944b81ad544b0b05242d896658069840033 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:09:33 -0400 Subject: [PATCH 5/7] repo: run the term wall in CI Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230933Z-apply-push-0f6370 Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b05d4a6..5003b7e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,10 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false + - name: term wall + uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + env: + TERM_WALL: ${{ vars.TERM_WALL }} - name: JSON validity run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty - name: YAML validity From 2b9f260a536772f581fa88a6ac1387607ae03514 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:46:55 -0400 Subject: [PATCH 6/7] repo: scan a pull request again when its text is edited `pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234654Z-apply-push-597506 Patch-SHA256: 5bd4712af8c79fee62fd38b617467cd3bc0c814a188db1a96af657736a143c67 --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5003b7e..27620d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,7 @@ name: ci on: pull_request: + types: [opened, synchronize, reopened, edited] push: branches: [dev, master] permissions: From 0828c8aa1ada707d7eeb765fe6cdf8ac73ae8af8 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 20:40:46 -0400 Subject: [PATCH 7/7] repo: move the wall to the object-store scan, pin the e2e workflow minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. The e2e job called the reusable workflow in workbench at the mutable `dev`; pin it to the current dev commit. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004046Z-apply-push-2cfd0c Patch-SHA256: 63cb576da555e6faa8de431db398c22cf34346acb764980d5792b988df5bd105 --- .github/workflows/ci.yml | 2 +- .github/workflows/e2e.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27620d0..51e8847 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: with: persist-credentials: false - name: term wall - uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10 env: TERM_WALL: ${{ vars.TERM_WALL }} - name: JSON validity diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index c885746..ac9f6c7 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -10,7 +10,7 @@ permissions: contents: read jobs: e2e: - uses: minspec/workbench/.github/workflows/e2e.yml@dev + uses: minspec/workbench/.github/workflows/e2e.yml@a84bc5568a33220fd7b4037345c2b38186cff29d # dev with: recipes_ref: ${{ github.event.pull_request.head.sha || github.sha }} workbench_ref: dev