randypanding · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026
@@ -0,0 +1,196 @@
+name: adversary-gate
+# W4-C3 adversary gate（Cloudbird-Software/.github#284，AC-14/AC-19，ADR-0067/0082）
+#
+# 目标：specs/** 路径 PR 必须含 adversary check（漏配/摘除/跳过即红）；开发路径
+# 豁免谓词由 diff 路径集确定性派生（禁人工打标，AC-14）。
+#
+# 机制：
+#   - 本 workflow 在每 PR 上运行（org-required-workflows required workflow），
+#     产出名为 "adversary" 的 check run（与 main-protection.json required_status_checks
+#     登记的 context 一致）。
+#   - 纯开发路径 PR（diff 无 specs/** 实质内容变更）：经 expected_skip.py 判定
+#     EXPECTED_SKIP=True → 写 "success"（留痕 reason），不阻塞合并。
+#   - specs/** 实质变更 PR（未全命中 owner 豁免清单）：EXPECTED_SKIP=False →
+#     必须由 adversary workflow（W3-C1/W4-C2）产出 verdict=survived 的 adversary
+#     check run 才能合并；本 gate 检查该 check run 是否存在且结论为 success——
+#     不存在/结论非 success 即红（fail-closed，负向断言）。
+#
+# 部署注意：
+#   - 本文件 + CI-Workflows .github/workflows/adversary.yml 当前 App 无
+#     workflows 权限，待权限到位后补推；rulesets JSON 已含 adversary context。
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: adversary-gate-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Checkout pipeline/adversary（expected_skip.py）
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            pipeline/adversary/expected_skip.py
+          sparse-checkout-cone-mode: false
-          sparse-checkout: |
-            pipeline/adversary/expected_skip.py
-          sparse-checkout-cone-mode: false
+          sparse-checkout: |
+            pipeline/adversary/expected_skip.py
+            scripts/gh-app-token.sh
+          sparse-checkout-cone-mode: false
-          sparse-checkout: |
-            pipeline/adversary/expected_skip.py
-          sparse-checkout-cone-mode: false
+          sparse-checkout: |
+            pipeline/adversary/expected_skip.py
+            scripts/gh-app-token.sh
+          sparse-checkout-cone-mode: false
+
+      - name: 派生 PR diff 路径集 + EXPECTED_SKIP（禁人工打标，AC-14）
+        id: skip
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_API: "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}"
+        run: |
+          set -euo pipefail
+          set +e
+          FILES=$(gh api "$PR_API/files?per_page=300" \
+            --jq '[.[].filename]' 2>/dev/null)
+          RC=$?
+          set -e
+          if [[ $RC -ne 0 || -z "$FILES" || "$FILES" == "null" ]]; then
+            echo "::warning::取 PR files 失败（负向断言：视为 spec 变更）"
+            FILES='["specs/_api_failed_fallback/spec.md"]'
+          fi
+          # 调 expected_skip.py judge 派生（确定性，禁人工打标）
+          SKIP_OUT=$(python3 pipeline/adversary/expected_skip.py judge --paths "$FILES" 2>/dev/null) \
+            || SKIP_OUT='{"expected_skip":false,"reason":"expected_skip.py 执行失败（fail-closed）","specs_paths":[]}'
+          echo "$SKIP_OUT" > "$RUNNER_TEMP/skip_result.json"
+          SKIP=$(echo "$SKIP_OUT" | python3 -c "import json,sys;print(str(json.load(sys.stdin)['expected_skip']).lower())" 2>/dev/null || echo "false")
+          echo "expected_skip=$SKIP" >> "$GITHUB_OUTPUT"
+          echo "skip_result=$SKIP_OUT"
-          SKIP=$(echo "$SKIP_OUT" | python3 -c "import json,sys;print(str(json.load(sys.stdin)['expected_skip']).lower())" 2>/dev/null || echo "false")
-          echo "expected_skip=$SKIP" >> "$GITHUB_OUTPUT"
-          echo "skip_result=$SKIP_OUT"
+          SKIP=$(echo "$SKIP_OUT" | python3 -c "import json,sys;print(str(json.load(sys.stdin)['expected_skip']).lower())" 2>/dev/null || echo "false")
+          echo "expected_skip=$SKIP" >> "$GITHUB_OUTPUT"
+          {
+            echo "skip_result<<EOF"
+            echo "$SKIP_OUT"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+          echo "skip_result=$SKIP_OUT"
-          SKIP=$(echo "$SKIP_OUT" | python3 -c "import json,sys;print(str(json.load(sys.stdin)['expected_skip']).lower())" 2>/dev/null || echo "false")
-          echo "expected_skip=$SKIP" >> "$GITHUB_OUTPUT"
-          echo "skip_result=$SKIP_OUT"
+          SKIP=$(echo "$SKIP_OUT" | python3 -c "import json,sys;print(str(json.load(sys.stdin)['expected_skip']).lower())" 2>/dev/null || echo "false")
+          echo "expected_skip=$SKIP" >> "$GITHUB_OUTPUT"
+          {
+            echo "skip_result<<EOF"
+            echo "$SKIP_OUT"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+          echo "skip_result=$SKIP_OUT"
+          echo "EXPECTED_SKIP=$SKIP"
+
+      - name: 铸 App 令牌（checks:write，INV-02）
+        id: token
+        env:
+          CB_APP_ID: ${{ secrets.CB_APP_ID }}
+          AGENT_APP_SECRET: ${{ secrets.AGENT_APP_SECRET }}
+          REPO: ${{ github.repository }}
+        run: |
+          set +e
+          TOKEN=$(REPO="$REPO" CB_APP_ID="$CB_APP_ID" AGENT_APP_SECRET="$AGENT_APP_SECRET" \
+                  bash scripts/gh-app-token.sh 2>/dev/null)
+          if [[ -z "$TOKEN" ]]; then
+            echo "::error::App 令牌铸造失败——无法写回 adversary check run"
+            echo "have_token=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "APP_TOKEN=$TOKEN" >>"$GITHUB_ENV"
+            echo "have_token=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: 开发路径豁免——写 success check run（EXPECTED_SKIP=True）
+        if: steps.skip.outputs.expected_skip == 'true' && steps.token.outputs.have_token == 'true'
+        env:
+          SKIP_RESULT: ${{ steps.skip.outputs.skip_result }}
+        run: |
+          set -euo pipefail
+          SUMMARY=$(echo "$SKIP_RESULT" | python3 -c "
+          import json,sys
+          d=json.load(sys.stdin)
+          lines=['EXPECTED_SKIP=True（开发路径豁免，AC-14）',d.get('reason','')]
+          sp=d.get('specs_paths',[])
+          if sp: lines.append('specs_paths(已豁免): '+', '.join(sp))
+          lines.append('派生方式=diff路径集确定性派生（禁人工打标）')
+          sys.stdout.write('\\n'.join(lines))
+          ")
+          python3 - "$SUMMARY" > "$RUNNER_TEMP/check_body.json" <<'PYEOF'
+          import json, sys, datetime as dt
+          summary = sys.argv[1]
+          body = {
+            "name": "adversary",
+            "head_sha": "${{ github.event.pull_request.head.sha }}",
+            "status": "completed",
+            "conclusion": "success",
+            "completed_at": dt.datetime.now(dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "output": {"title": "adversary: skipped (dev path EXPECTED_SKIP)", "summary": summary},
+          }
+          json.dump(body, sys.stdout)
+          PYEOF
+          curl -fsS -X POST \
+            -H "Authorization: Bearer $APP_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/${{ github.repository }}/check-runs" \
+            -d @"$RUNNER_TEMP/check_body.json" \
+            && echo "开发路径：adversary check run 已写回 success（EXPECTED_SKIP）"
+
+      - name: specs/** PR——校验 adversary check run 已存在且 survived
+        if: steps.skip.outputs.expected_skip == 'false'
+        env:
+          SKIP_RESULT: ${{ steps.skip.outputs.skip_result }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+          HAVE_TOKEN: ${{ steps.token.outputs.have_token }}
+        run: |
+          set -euo pipefail
+          SUMMARY=$(echo "$SKIP_RESULT" | python3 -c "
+          import json,sys
+          d=json.load(sys.stdin)
+          sp=d.get('remaining_specs',[]) or d.get('specs_paths',[])
+          head=', '.join(sp[:5])+('...' if len(sp)>5 else '')
+          sys.stdout.write('EXPECTED_SKIP=False: specs/'+head)
+          ")
+          # 查 head sha 上名为 adversary 的 check run（取 completed 最新）
+          if [[ "$HAVE_TOKEN" != "true" ]]; then
+            echo "::error::无 App 令牌，无法校验 adversary check run（fail-closed）"
+            exit 1
+          fi
+          CHECKS=$(curl -fsS \
+            -H "Authorization: Bearer $APP_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/$REPO/commits/$HEAD_SHA/check-runs?per_page=100" 2>/dev/null) \
+            || CHECKS='{"check_runs":[]}'
+          VERDICT=$(echo "$CHECKS" | python3 -c "
+          import json,sys
+          runs=json.loads(sys.stdin.read()).get('check_runs',[])
+          adv=sorted([r for r in runs if r.get('name')=='adversary'], key=lambda r:(r.get('status')!='completed',))
+          if not adv:
+              print('MISSING')
+          else:
+              a=adv[-1]
+              if a.get('status')=='completed' and a.get('conclusion')=='success':
+                  print('SURVIVED')
+              elif a.get('status')=='completed':
+                  print('RED:'+str(a.get('conclusion')))
+              else:
+                  print('PENDING:'+str(a.get('status')))
+          ")
+          if [[ "$VERDICT" == "SURVIVED" ]]; then
+            echo "adversary check run 已存在且 survived：$SUMMARY"
+            exit 0
+          fi
+          # 未审计/未 survived：写 failure check run（阻断合并，AC-4 负向断言）
+          if [[ "$VERDICT" == MISSING* ]]; then
+            TITLE="adversary: 缺失（specs/** PR 未含 adversary check，阻断）"
+          else
+            TITLE="adversary: ${VERDICT}（specs/** PR 审计未通过，阻断）"
+          fi
+          python3 - "$TITLE" "$SUMMARY" > "$RUNNER_TEMP/check_body.json" <<'PYEOF'
+          import json, sys, datetime as dt
+          title, summary = sys.argv[1], sys.argv[2]
+          json.dump({
+            "name": "adversary",
+            "head_sha": "${{ github.event.pull_request.head.sha }}",
+            "status": "completed",
+            "conclusion": "failure",
+            "completed_at": dt.datetime.now(dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "output": {"title": title[:255], "summary": summary},
+          }, sys.stdout)
+          PYEOF
+          curl -fsS -X POST \
+            -H "Authorization: Bearer $APP_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/$REPO/check-runs" \
+            -d @"$RUNNER_TEMP/check_body.json"
+          echo "阻断：$VERDICT —— $SUMMARY"
+          exit 1
@@ -0,0 +1,74 @@
+name: g060 guard
+
+# ADR-0061 g060 语义扩展至治理仓（ISSUE-263 W2-C2）：
+#   - PR 变更 specs/*/suite/** 时校验写者身份；
+#   - 定时扫描未裁决的 g060 阻断 issue，超 TTL 触发 dead-man 提醒。
+#
+# 注意：当前 App 无 workflows 权限，本文件已完整实现但暂无法推送至上游，
+#       阻塞记录在 ISSUE-263 W2-C2 交付说明中。
+on:
+  pull_request:
+    paths:
+      - 'specs/*/suite/**'
+  schedule:
+    # 每 6 小时巡检一次（与 butler 系列对齐）
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: '指定裁决 issue 编号（未指定则处理全部 open g060 issue）'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  g060-lock:
+    # 仅在 PR 事件且命中 paths 时触发
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read        # checkout
+      issues: write         # 非法修改时创建裁决 issue
+      pull-requests: read   # 读取 PR 文件清单
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0      # 需要完整历史做 base..head diff 兜底
+
+      - name: g060 lock check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+        run: bash scripts/g060-lock.sh
+
+  g060-escalation:
+    # 定时/手动触发：处理未裁决 issue
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: g060 escalation
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          if [[ -n "${{ inputs.issue }}" ]]; then
+            python3 scripts/g060-escalation.py --issue "${{ inputs.issue }}"
+          else
+            python3 scripts/g060-escalation.py --all
+          fi