holocron/plugins/kyberforge/skills/apm-workflow/references/audit.md at e16c3dc95f2e41affcf99bcdc7923791985e8a99

Files

Defame1297 fc69553ba7 feat(kyberforge): add apm-workflow skill

Human-facing dispatch over apm's configure/marketplace/compile/audit
lifecycle, one reference file per concern, gitea-issues-style
dispatch table. apm-install handles the one-time binary/runtime
bootstrap that precedes this loop.

2026-08-10 17:46:03 +00:00

2.1 KiB

Raw Blame History

topic, source_keys

topic

source_keys

audit

context7-microsoft-apm

`apm audit`

apm audit                  # local: scan deployed files for hidden Unicode
apm audit --ci              # CI gate: lockfile consistency + drift replay + policy
apm audit --file <path>     # standalone: scan an arbitrary file

apm audit --ci runs baseline lockfile checks, install-replay drift detection (does a clean apm install reproduce what's on disk), and org policy checks. Exit code 0 on success, 1 on any violation — composes as a normal CI gate step. It covers AI agent configuration integrity, hidden-content scanning, lockfile verification, and policy enforcement — it does not replace general lint/test/security-scan CI steps, it sits alongside them.

Policy checks

apm audit --ci auto-discovers an org policy from the git remote if --policy/--policy-source isn't given explicitly; --no-policy skips policy discovery for a single invocation.

Marketplace ref validation

Separate from apm audit: apm marketplace check validates that every package reference declared in a marketplace's apm.yml actually resolves (correct path/ref, manifest present) — run before apm pack/publish, to catch a typo'd local path or stale pinned tag before it ships.

CI integration example (GitHub Actions)

jobs:
  apm-audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install apm-cli==X.Y.Z  # pin to the version standardized on
      - run: apm install
      - run: apm audit --ci -f sarif --output apm-audit.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: apm-audit.sarif }

-f sarif --output <file> emits SARIF for GitHub Code Scanning's inline PR annotations.

Frozen installs

apm install --frozen fails instead of silently re-resolving if the lockfile is out of date — the CI equivalent of npm ci vs npm install. Use in any CI job that must not be allowed to drift the lockfile.

2.1 KiB Raw Blame History

apm audit