feat: pilot Ozark internal stdlib — runtime deps through osl-* forks#106
Merged
Conversation
Coding agents working in this repo can no longer silently add runtime dependencies. Per the new AGENTS.md ## Dependency policy section, any proposed external library requires writing .ozark/fork-proposals/<dep>.md and stopping — the maintainer then runs the fork-and-trim workflow before any consumer change lands. - AGENTS.md: new ## Dependency policy section, sits after ## Supply Chain Policy. Spells out the osl-* fork rule, the no-touch-manifest rule, and the proposal-file workflow. Scopes the rule to runtime deps for the pilot; devDependencies and toolchain remain upstream pending Phase 2. - CLAUDE.md: dep policy added to the top non-negotiables list and a one-line pointer added to ## Tech & runtime constraints. - .ozark/fork-proposals/_TEMPLATE.md: the canonical fork-proposal template, mirroring the version in Ozark-Security-Labs/.github. - .github/workflows/fork-proposal-issue.yml: mirrors every new proposal file into an issue in Ozark-Security-Labs/.github so the maintainer sees all pending fork requests in one place. Uses OZARK_CROSS_REPO_TOKEN (PAT or GH App token, not the default GITHUB_TOKEN) for cross-repo issue creation. Workflow validates proposal filenames to defeat shell-metacharacter injection and uses env-var interpolation for all event payload values. Full org-wide runbook + index of forks live in Ozark-Security-Labs/.github (docs/ozark-stdlib.md and docs/fork-and-trim-workflow.md).
Pilot bring-up of the Ozark internal standard library: the four runtime
dependencies of deterministic-deps now resolve from osl-prefixed forks
in Ozark-Security-Labs, pinned by full commit SHA via npm git URLs.
Forks consumed (each tagged upstream/<sha> at its fork point and
trimmed/renamed per the fork-and-trim workflow):
- osl-actions-core @ 23007f60... (upstream actions/toolkit packages/core
pruned to root, lib/ built ahead-of-time and committed)
- osl-glob @ df4a3af8... (upstream isaacs/node-glob)
- osl-js-yaml @ 721957e8... (upstream nodeca/js-yaml)
- osl-minimatch @ 4a0ff5b8... (upstream isaacs/minimatch)
Changes:
- package.json: dependencies entries switched from registry installs to
github:Ozark-Security-Labs/osl-*#<sha> git URLs. Names use the osl-*
prefix matching each fork's package.json name field.
- package-lock.json: regenerated. npm warns about skipped integrity
checks for git deps — expected, the pinned SHA is the integrity check.
- src/{main,scanner,config,remote,rules/index}.ts: six import sites
updated from upstream names to osl-* names.
- src/types/osl-js-yaml.d.ts: type shim re-declaring @types/js-yaml's
module declarations under the osl-js-yaml name so TypeScript still
resolves types for `import yaml from 'osl-js-yaml'`.
- __tests__/{action-metadata,config,fixtures}.test.ts: same import
rename in test files.
- dist/: re-bundled via ncc; dogfood scan against the rebuilt action
returns 0 findings (the new git URLs are SHA-pinned and pass the
Node rule).
Verification (all green): npm run lint, npm test (7 suites, 157 tests),
npm run build (tsc --noEmit), npm run bundle (ncc), npm run format,
git diff --check, node dist/index.js dogfood (0 findings).
Pilot verification step 2: bumped osl-glob's pinned SHA from df4a3af → 3d32991 (a benign CHANGELOG-OZARK.md append on the fork side), reinstalled, reran `npm run all` (lint + test + build + bundle), and confirmed the dogfood scan still reports 0 findings. The round-trip loop from fork-patch → SHA-bump → consumer-rebuild works.
bjcorder
marked this pull request as ready for review
May 22, 2026 15:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First pilot of the Ozark internal-stdlib strategy: this PR switches
deterministic-deps' four runtime dependencies from upstream npm registry installs to git-URL installs pinned to commit SHAs ofOzark-Security-Labs/osl-*forks, and adds the agent-enforcement policy that keeps it that way.Forks consumed
osl-actions-core23007f60ab3ee61aefe66202f4790b0c9e6552e4osl-glob3d32991b7f0fcdff9c394e3025b40a6a5e253b44osl-js-yaml721957e87b8fd2716d29c30a859ac816b2768f0fosl-minimatch4a0ff5b8e7ab0a3d12c5ef09660994125f759e3bPolicy
## Dependency policysection: coding agents must NOT modify any manifest or lockfile to add a runtime dep; instead they file.ozark/fork-proposals/<dep>.mdand stop, leaving the maintainer to run the fork-and-trim workflow.## Tech & runtime constraintssection.devDependencies(typescript,jest,eslint,ncc, etc.) remain upstream and are a Phase 2 follow-up.Cross-repo wiring
Ozark-Security-Labs/.github(new public profile repo) holds the canonicaldocs/ozark-stdlib.md,docs/fork-and-trim-workflow.md, and proposal template..github/workflows/fork-proposal-issue.ymlmirrors each proposal into aFork request: osl-<dep>issue in the central repo. Requires theOZARK_CROSS_REPO_TOKENsecret to be configured (fine-scoped PAT or GitHub App token withissues: writeonOzark-Security-Labs/.github); deferred per pilot scope, but the workflow is harmless until that secret exists.Verification
npm run all: lint + 157 tests + tsc + ncc bundle — all green.npm run formatclean.git diff --checkclean.node dist/index.js: 0 findings.502e811— pushed a benign CHANGELOG entry toosl-glob, bumped SHA here, rebuilt; no test or scan deltas.Known follow-ups (out of pilot scope)
OZARK_CROSS_REPO_TOKENrepo secret.devDependencies(forkingtypescript,eslint,jest,ncc, etc.).src/rules/index.ts(~9new RegExp()call sites) flagged by Semgrep — unrelated to this pilot; addressed in a separate workstream.osl-*git URLs inpackage.json(mechanical guard for the negative test).Test plan
Ozark-Security-Labs/.github/docs/ozark-stdlib.md— the four pinned SHAs in the index match the four entries inpackage.jsonon this branch..ozark/fork-proposals/lodash.md(without touchingpackage.json) onceOZARK_CROSS_REPO_TOKENis set, and confirm an issue is filed inOzark-Security-Labs/.github.