holocron/plugins/kyberforge/skills/apm-workflow/references/audit.md at 92e7ff26aae59736083b8305137bd9c46ea90676

Files

Defame1297 92e7ff26aa docs(kyberforge): narrow issue #89 scope, migrate CC platform facts to apm-workflow

A grill-me session determined plugin-author/marketplace-author are fully
superseded by the landed apm-install/apm-workflow/apm-orchestrate artifacts
and will be deleted (not adapted) under issue #90, narrowing issue #89 to
skill-author/agent-author only; forge stays untouched. ADR-0015 is amended
to record this correction plus a three-way content-migration audit.

Claude Code platform-constraint facts that lived only in
plugin-author/marketplace-author (reserved name prefixes, the ADR-0010
agents/ stray-.md validator gotcha, claude plugin validate as a terminal
check, and a removal/re-pack confirm-before-proceeding note) remain true
post-conversion and are migrated into apm-workflow's reference docs via
kyberforge:skill-author, which also updated the skill's README and
sources.md provenance records. Dual-manifest-specific conventions (ADR-0006
parity, CC/Copilot field-placement split) do not carry forward since they
no longer apply.

ADR: 0015

2026-08-11 12:09:43 +00:00

2.6 KiB

Raw Blame History

topic, source_keys

topic

source_keys

audit

context7-microsoft-apm

context7-websites-code-claude

claude-code-plugins-docs

`apm audit`

apm audit                  # local: scan deployed files for hidden Unicode
apm audit --ci              # CI gate: lockfile consistency + drift replay + policy
apm audit --file <path>     # standalone: scan an arbitrary file

apm audit --ci runs baseline lockfile checks, install-replay drift detection (does a clean apm install reproduce what's on disk), and org policy checks. Exit code 0 on success, 1 on any violation — composes as a normal CI gate step. It covers AI agent configuration integrity, hidden-content scanning, lockfile verification, and policy enforcement — it does not replace general lint/test/security-scan CI steps, it sits alongside them.

Policy checks

apm audit --ci auto-discovers an org policy from the git remote if --policy/--policy-source isn't given explicitly; --no-policy skips policy discovery for a single invocation.

Marketplace ref validation

Separate from apm audit: apm marketplace check validates that every package reference declared in a marketplace's apm.yml actually resolves (correct path/ref, manifest present) — run before apm pack/publish, to catch a typo'd local path or stale pinned tag before it ships.

CI integration example (GitHub Actions)

jobs:
  apm-audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install apm-cli==X.Y.Z  # pin to the version standardized on
      - run: apm install
      - run: apm audit --ci -f sarif --output apm-audit.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: apm-audit.sarif }

-f sarif --output <file> emits SARIF for GitHub Code Scanning's inline PR annotations.

Frozen installs

apm install --frozen fails instead of silently re-resolving if the lockfile is out of date — the CI equivalent of npm ci vs npm install. Use in any CI job that must not be allowed to drift the lockfile.

Claude Code validation is a separate terminal check

For packages compiling to the claude target, also run claude plugin validate [--strict] against the compiled output as a terminal check. apm audit/apm audit --ci do not check Claude Code-marketplace-specific schema rules (reserved prefixes, the agents/ stray-file behavior — see references/compile.md — etc.), so they don't substitute for it.

2.6 KiB Raw Blame History

apm audit