mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-14 09:08:12 +02:00
754b8dd76c
* fix: make the installer runtime pass strict supply-chain vetting
Remediate the four enterprise supply-chain vetting blockers from
affaan-m/ECC#2502 so the installer runtime (package.json + manifests +
scripts/lib/**) passes strict exact-pin evidence policy:
1. Remove the package.json `postinstall` lifecycle script (it only echoed a
post-install banner) and move that banner to an explicit opt-in
`npm run welcome` command. No install-time lifecycle script remains.
2. Exact-pin every dependency in package.json (dependencies + devDependencies)
to the versions already resolved in package-lock.json; no ^/~ ranges.
3. Replace non-ASCII characters on the installer runtime script/config surface:
em-dashes (U+2014) in scripts/lib/{path-safety,install-executor,
install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in
manifests/{install-components,install-modules}.json descriptions become
ASCII, so strict-surface Unicode scanners are clean.
4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file
already carries a complete hand-rolled validator enforcing the same
schemas/install-state.schema.json (ecc.install.v1) constraints, so the
installer closure is dependency-free (zero non-builtin bare requires).
Refs affaan-m/ECC#2502
* fix: avoid unpinned welcome invocations
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: validate translated skill frontmatter
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: repair skill frontmatter YAML
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: add MIT license to core skill manifests; pin verification-loop tsc invocation
* fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail)
* chore(deps): sync lockfiles with exact-pinned package.json
Regenerate package-lock.json and yarn.lock so the pinned dependency
specs are reflected in both lockfiles. npm ci and Yarn's --immutable
install now pass the sync check. The resolution tree is unchanged
(231 yarn resolutions, byte-identical set; zero npm transitive drift);
only the root descriptor strings move from ranges to the versions
already resolved in the committed lockfiles.
Addresses the Codex P1 on #2503.
---------
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>
129 lines
2.5 KiB
Markdown
129 lines
2.5 KiB
Markdown
---
|
|
name: verification-loop
|
|
description: "A comprehensive verification system for Claude Code sessions."
|
|
license: MIT
|
|
metadata:
|
|
origin: ECC
|
|
---
|
|
|
|
# Verification Loop Skill
|
|
|
|
A comprehensive verification system for Claude Code sessions.
|
|
|
|
## When to Use
|
|
|
|
Invoke this skill:
|
|
- After completing a feature or significant code change
|
|
- Before creating a PR
|
|
- When you want to ensure quality gates pass
|
|
- After refactoring
|
|
|
|
## Verification Phases
|
|
|
|
### Phase 1: Build Verification
|
|
```bash
|
|
# Check if project builds
|
|
npm run build 2>&1 | tail -20
|
|
# OR
|
|
pnpm build 2>&1 | tail -20
|
|
```
|
|
|
|
If build fails, STOP and fix before continuing.
|
|
|
|
### Phase 2: Type Check
|
|
```bash
|
|
set -o pipefail
|
|
# TypeScript projects
|
|
npx --no-install tsc --noEmit 2>&1 | head -30
|
|
|
|
# Python projects
|
|
pyright . 2>&1 | head -30
|
|
```
|
|
|
|
Report all type errors. Fix critical ones before continuing.
|
|
|
|
### Phase 3: Lint Check
|
|
```bash
|
|
# JavaScript/TypeScript
|
|
npm run lint 2>&1 | head -30
|
|
|
|
# Python
|
|
ruff check . 2>&1 | head -30
|
|
```
|
|
|
|
### Phase 4: Test Suite
|
|
```bash
|
|
# Run tests with coverage
|
|
npm run test -- --coverage 2>&1 | tail -50
|
|
|
|
# Check coverage threshold
|
|
# Target: 80% minimum
|
|
```
|
|
|
|
Report:
|
|
- Total tests: X
|
|
- Passed: X
|
|
- Failed: X
|
|
- Coverage: X%
|
|
|
|
### Phase 5: Security Scan
|
|
```bash
|
|
# Check for secrets
|
|
grep -rn "sk-" --include="*.ts" --include="*.js" . 2>/dev/null | head -10
|
|
grep -rn "api_key" --include="*.ts" --include="*.js" . 2>/dev/null | head -10
|
|
|
|
# Check for console.log
|
|
grep -rn "console.log" --include="*.ts" --include="*.tsx" src/ 2>/dev/null | head -10
|
|
```
|
|
|
|
### Phase 6: Diff Review
|
|
```bash
|
|
# Show what changed
|
|
git diff --stat
|
|
git diff HEAD~1 --name-only
|
|
```
|
|
|
|
Review each changed file for:
|
|
- Unintended changes
|
|
- Missing error handling
|
|
- Potential edge cases
|
|
|
|
## Output Format
|
|
|
|
After running all phases, produce a verification report:
|
|
|
|
```
|
|
VERIFICATION REPORT
|
|
==================
|
|
|
|
Build: [PASS/FAIL]
|
|
Types: [PASS/FAIL] (X errors)
|
|
Lint: [PASS/FAIL] (X warnings)
|
|
Tests: [PASS/FAIL] (X/Y passed, Z% coverage)
|
|
Security: [PASS/FAIL] (X issues)
|
|
Diff: [X files changed]
|
|
|
|
Overall: [READY/NOT READY] for PR
|
|
|
|
Issues to Fix:
|
|
1. ...
|
|
2. ...
|
|
```
|
|
|
|
## Continuous Mode
|
|
|
|
For long sessions, run verification every 15 minutes or after major changes:
|
|
|
|
```markdown
|
|
Set a mental checkpoint:
|
|
- After completing each function
|
|
- After finishing a component
|
|
- Before moving to next task
|
|
|
|
Run: /verify
|
|
```
|
|
|
|
## Integration with Hooks
|
|
|
|
This skill complements PostToolUse hooks but provides deeper verification.
|
|
Hooks catch issues immediately; this skill provides comprehensive review.
|