Defame1297
1e4aab53a7
Description 817 -> 324 chars, body 421 -> 237 words, Gotchas 6 -> 2. The five capability clauses, the second trigger register and the prose boundary form go; one trigger clause, the indirect trigger and one boundary clause remain. Four of six Gotchas move into the flow file that every branch needing them already loads. Two stay in the always-loaded body because a dispatch body must carry the gates common to every branch, not just the dispatch table: the MCP secret indirection rule, and the `apm experimental enable registries` precondition. The first pass moved registries into references/configure.md alone, which stranded it -- references/compile.md documents publishing to a registry and references/install.md resolves dependencies through one, and neither points at configure.md. Declaring a registry without the precondition is a silent no-op, so the failure had no signal. Also drops an unsourced claim the compression pass introduced (that apm checks `type:` going forward -- no source supports it), corrects the MCP rationale to install *or* runtime per configuration.md:98, and repoints two apm-orchestrate back-references that pointed at body Gotchas which had moved. Refs #99 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MWb5RQgCL1ye7cGp2RPb2u
2.6 KiB
topic, source_keys
| topic | source_keys | |||
|---|---|---|---|---|
| audit |
|
apm audit
apm audit # local: scan deployed files for hidden Unicode
apm audit --ci # CI gate: lockfile consistency + drift replay + policy
apm audit --file <path> # standalone: scan an arbitrary file
Exit code 0 on success, 1 on any violation — composes as a normal CI gate step. It does not replace general lint/test/security-scan CI steps, it sits alongside them.
Policy checks
apm audit --ci auto-discovers an org policy from the git remote if --policy/--policy-source isn't given explicitly; --no-policy skips policy discovery for a single invocation.
Marketplace ref validation
Separate from apm audit: apm marketplace check validates that every package reference declared in a marketplace's apm.yml actually resolves (correct path/ref, manifest present) — run before apm pack/publish, to catch a typo'd local path or stale pinned tag before it ships.
CI integration example (GitHub Actions)
jobs:
apm-audit:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with: { python-version: "3.12" }
- run: pip install apm-cli==X.Y.Z # pin to the version standardized on
- run: apm install
- run: apm audit --ci -f sarif --output apm-audit.sarif
- uses: github/codeql-action/upload-sarif@v3
with: { sarif_file: apm-audit.sarif }
-f sarif --output <file> emits SARIF for GitHub Code Scanning's inline PR annotations.
Frozen installs
apm install --frozen fails instead of silently re-resolving if the lockfile is out of date — the CI equivalent of npm ci vs npm install. Use in any CI job that must not be allowed to drift the lockfile.
Claude Code validation is a separate terminal check
For packages compiling to the claude target, also run claude plugin validate [--strict] against the compiled output as a terminal check. apm audit/apm audit --ci do not check Claude Code-marketplace-specific schema rules (reserved prefixes, the agents/ stray-file behavior — see references/compile.md — etc.), so they don't substitute for it.
Gotchas
- Plain
apm auditandapm audit --cicheck different things: plainapm auditscans deployed files for hidden Unicode only;--ciadditionally runs lockfile-consistency checks, install-replay drift detection, and org policy checks. A clean plainapm auditis not a CI-equivalent pass.