CI: hardening — PSScriptAnalyzer coverage, SHA-pinned actions, Go config-input coverage

[mlorentedev]

Severity: Med · Proposed priority: P2 · Audit IDs: C24, C31, C32

CI has coverage and supply-chain gaps that let whole classes of bug ship green.

C24 — PSScriptAnalyzer covers 4 of ~12 production .ps1. .github/workflows/ci.yml:57 lints only setup-windows.ps1, knowledge-crystallize.ps1, obs-cli.ps1, profile.ps1. No analyzer anywhere for scripts/utils.ps1 (the Set-StrictMode library every .ps1 dot-sources), dotfiles-sync.ps1, install-dotf.ps1, vault-maintenance-weekly.ps1, windows/*.ps1, paths.ps1. The vault's own "ps1 must be ASCII / PSSA fails CI on non-ASCII" rule is therefore unenforced (em dashes already sit in setup-windows.ps1/install-dotf.ps1 comments). Overlaps POLISH-003.

C31 — Go config inputs escape Go CI. cli.yml:5 path-filters to cli/**. A breaking edit to env-contract.json, secrets/registry.yaml, session-start-config.json, harness/manifest.json, or versions.conf — all parsed by Go — does not trigger go test; only a post-merge runtime failure surfaces it. Add those paths to the filter.

C32 — every GitHub Action pinned by moving tag, none by SHA. checkout@v5, github-script@v9, release-please-action@v4, add-to-project@v1.0.2, goreleaser-action@v6, action-shellcheck@2.0.0. A compromised moving tag runs with BITACORA_PAT (repo+project write) or RELEASE_TOKEN (contents+PR write) — full write + release forgery. Pin to SHA (Dependabot keeps them fresh).

Also worth folding in: the lint job shellchecks only ./scripts + setup-linux.sh, so git-hooks/*.sh and git-hooks/lib/*.sh (the GUARD-001 guard scripts) are never linted; and there is no actionlint on the workflows.

Source: docs/audits/codebase-audit-2026-07-06.md (C24, C31, C32).

[mlorentedev]

Two more from the codebase audit (docs/audits/codebase-audit-2026-07-06.md) that belong under CI/coverage hardening:

• C9 — tests/antigravity.bats:17 skips the whole file when agy is absent, and no CI job installs agy, so all 15 tests never run — including ~8 pure-static regression guards ("--directory must not return", "no hardcoded /home/") that need no agy. A PR reintroducing "--directory","/home/manu/Projects/hive" into ai/agy/mcp_servers.json passes CI green while breaking Windows agy. Either install agy in CI or split the static guards out of the agy-gated setup().
• C41 — tests that assert nothing: verify-setup.bats:308 body is literal true; utils.bats:243/258 whitespace-eating $(...); shell-profile.bats:29 title/body mismatch; dotfiles-sync.bats:20/33 OR-form asserts; setup-windows.bats:109 grep that passes even if the source flips to fatal. Worth a lint/review pass for no-op assertions.

[mlorentedev]

Concrete coverage gaps surfaced while implementing BUG-031/#689:

• The Run PSScriptAnalyzer step lints a hardcoded list of 4 files (setup-windows.ps1, scripts/knowledge-crystallize.ps1, scripts/obs-cli.ps1, powershell/profile.ps1). Real scripts like scripts/utils.ps1, scripts/vault-maintenance-weekly.ps1, scripts/dotfiles-sync.ps1, scripts/profile-heal.ps1, windows/*.ps1 and the tests/*.Tests.ps1 suites are never linted. Recommend globbing **/*.ps1 (or a git-tracked-.ps1 list) instead of the static array, so new scripts are covered by default.
• ASCII-only is not actually enforced. pattern-powershell-ascii-only says .ps1 must be ASCII-only, but the current .PSScriptAnalyzerSettings.psd1 has no rule that flags non-ASCII glyphs: setup-windows.ps1 already carries 9 em-dash/section-sign chars in comments (lines 534, 586, 614, 836, 1166, 1318, 1452, 1583, 1692) and CI is green. Add a custom rule (or a cheap grep -P '[^\x00-\x7F]' gate) so the convention is machine-enforced rather than aspirational.

Both are latent (CI green today) but defeat the intent of the lint-powershell job.