Defame1297
591b9cccb8
Two review passes on PR #91 (correctness + simplification) found the
prior fixup commit (d6fd9b6) left the deprecation notice it added
half-applied, cited a nonexistent ADR, and introduced/compounded a
few duplicate restatements of the same facts across apm-workflow's
skill files and apm-orchestrate's Hard rules.
- plugin-author/SKILL.md cited ADR-0016 (doesn't exist) instead of
ADR-0006 for the version-parity invariant.
- The deprecation banner on plugin-author/marketplace-author wasn't
reflected in their routing `description:` frontmatter, forge's
routing table, either kyberforge README skill table, or CONTEXT.md
— now propagated consistently; routing behavior is unchanged since
issue #90 (repo-wide apm conversion) hasn't landed yet.
- apm-orchestrate's `configure` operation only covered scaffolding a
new package, not editing an existing apm.yml (e.g. removing a
marketplace.packages[] entry, which has no dedicated `apm` CLI verb
and is just a manifest edit). Added `edit-config`, intentionally
ungated — a local file edit isn't the same class of irreversible
action as `apm publish`, and normal review already gates the commit.
- Deduplicated facts restated 3-4x across SKILL.md/references/ADR
boundaries (audit semantics, reserved name prefixes, marketplace-add
direction, registries precondition), and trimmed configure.md's
~55-line apm.yml schema dump — copied near-verbatim from the
research doc — down to a compact key list with a pointer, matching
install.md's existing terse cross-referencing style.
Deliberately left as-is: apm-orchestrate's parallel/sequential
fan-out logic stays inline rather than extracted to a shared
reference, since neither git-orchestrate nor gitea-orchestrate need
it yet — premature extraction for a single caller.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186ERbyACLRuRxPRnqwpa4m
2.3 KiB
topic, source_keys
| topic | source_keys | |||
|---|---|---|---|---|
| audit |
|
apm audit
apm audit # local: scan deployed files for hidden Unicode
apm audit --ci # CI gate: lockfile consistency + drift replay + policy
apm audit --file <path> # standalone: scan an arbitrary file
Exit code 0 on success, 1 on any violation — composes as a normal CI gate step. It does not replace general lint/test/security-scan CI steps, it sits alongside them.
Policy checks
apm audit --ci auto-discovers an org policy from the git remote if --policy/--policy-source isn't given explicitly; --no-policy skips policy discovery for a single invocation.
Marketplace ref validation
Separate from apm audit: apm marketplace check validates that every package reference declared in a marketplace's apm.yml actually resolves (correct path/ref, manifest present) — run before apm pack/publish, to catch a typo'd local path or stale pinned tag before it ships.
CI integration example (GitHub Actions)
jobs:
apm-audit:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with: { python-version: "3.12" }
- run: pip install apm-cli==X.Y.Z # pin to the version standardized on
- run: apm install
- run: apm audit --ci -f sarif --output apm-audit.sarif
- uses: github/codeql-action/upload-sarif@v3
with: { sarif_file: apm-audit.sarif }
-f sarif --output <file> emits SARIF for GitHub Code Scanning's inline PR annotations.
Frozen installs
apm install --frozen fails instead of silently re-resolving if the lockfile is out of date — the CI equivalent of npm ci vs npm install. Use in any CI job that must not be allowed to drift the lockfile.
Claude Code validation is a separate terminal check
For packages compiling to the claude target, also run claude plugin validate [--strict] against the compiled output as a terminal check. apm audit/apm audit --ci do not check Claude Code-marketplace-specific schema rules (reserved prefixes, the agents/ stray-file behavior — see references/compile.md — etc.), so they don't substitute for it.