Audit fixes: test hermeticity, discovery guard, doc accuracy#33
Merged
Conversation
From the adversarial 6-dimension repo audit (6 confirmed findings):
- standup-autopilot git test: isolate GIT_CONFIG_GLOBAL/SYSTEM so a
contributor's commit.gpgsign=true can't fail the suite
- format-code + auto-stage tests: spawn hooks with a temp HOME so runs
stop appending noise to the user's real ~/.claude/hooks-logs
- meta discovery guard: walk the whole repo, not just the two expected
roots — an orphan *.test.js anywhere now fails the guard (verified
both directions with a planted orphan)
- format-code: valid-JSON null payload now falls through to {} exit 0
like the other 7 hooks
- README: notify-permission matcher row gains elicitation_dialog (the
hook handles and recommends it); Testing section states the real
formatter prerequisites instead of 'no dependencies'
- (repo setting, no diff) GitHub private vulnerability reporting is now
enabled, making SECURITY.md's only reporting channel actually work
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From the adversarial 6-dimension repo audit (6 confirmed findings):
contributor's commit.gpgsign=true can't fail the suite
stop appending noise to the user's real ~/.claude/hooks-logs
roots — an orphan *.test.js anywhere now fails the guard (verified
both directions with a planted orphan)
like the other 7 hooks
hook handles and recommends it); Testing section states the real
formatter prerequisites instead of 'no dependencies'
enabled, making SECURITY.md's only reporting channel actually work