Files

T

chichuanandClaude Opus 4.6 83c64d31dd security(eval): add anti-forgery validation for eval-dispatch comments

Address P1 lint finding: structured eval-dispatch comments could be
forged by unauthorized users. Add three-layer consumer-side validation:

1. comment.user.login == 'github-actions[bot]' (platform-enforced identity)
2. comment.performed_via_github_app.slug == 'github-actions' (App signature)
3. payload.run_id verified against actual successful workflow run via API

Also adds:
- eval_poll_validate.py: consumer validation module (in-repo, auditable)
- test_eval_poll_validate.py: unit tests proving forged comments are rejected
- Go security contract test updated to assert run_id and validate reference

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-08-11 19:47:52 +08:00

security(eval): add anti-forgery validation for eval-dispatch comments

2026-08-11 19:47:52 +08:00

dev

feat(skills): fold long-tail skills into misc; rename dws-shared

2026-08-05 22:30:08 +08:00

hooks

init

2026-03-27 17:55:57 +08:00

policy

Merge branch 'main' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into feat/dws-event-oa

2026-08-11 10:18:55 +08:00

release

fix(release): accept successful sealed run reruns

2026-08-06 16:48:29 +08:00

gen_shortcut_backend_mcp_issues.py

feat: gate unverified shortcuts for release

2026-07-15 16:45:51 +08:00

gen_shortcut_comparison.py

feat: gate unverified shortcuts for release

2026-07-15 16:45:51 +08:00

gen_shortcut_error_review.py

feat: gate unverified shortcuts for release

2026-07-15 16:45:51 +08:00

gen_shortcut_public_catalog.py

feat(aitable): add verified shortcut workflows

2026-08-07 12:01:33 +08:00

gen_shortcut_test_matrix.go

fix(shortcut): close review and CI gaps

2026-07-15 23:05:04 +08:00

gen_skill_shortcut_sections.py

feat(doc): harden shortcuts and skill routing

2026-08-10 17:32:23 +08:00

install-devapp.ps1

feat(skills): wire misc routing and coverage for folded dev/skill

2026-08-05 22:02:11 +08:00

install-devapp.sh

feat(skills): wire misc routing and coverage for folded dev/skill

2026-08-05 22:02:11 +08:00

install-event.sh

feat(event): restore standalone event skill

2026-08-07 16:38:30 +08:00

install-from-branch.sh

feat(auth): support multi-profile login (#500 )

2026-06-29 18:27:25 +08:00

install-skills.sh

Merge remote-tracking branch 'upstream/main' into feat/dws-devapp

2026-06-24 22:32:25 +08:00

install.ps1

docs: drop multi skill experimental banners

2026-08-06 10:46:42 +08:00

install.sh

docs: drop multi skill experimental banners

2026-08-06 10:46:42 +08:00

README.md

ci: govern exact CLI flag migrations

2026-08-10 10:46:20 +08:00

record_real_shortcut_run.py

fix(shortcut): fix projection-data-loss silent-empty returns

2026-07-24 10:07:02 +08:00

run_chat_shortcut_live_audit_test.py

fix(chat): address pagination and audit review feedback

2026-08-07 18:26:39 +08:00

run_chat_shortcut_live_audit.py

fix(chat): address pagination and audit review feedback

2026-08-07 18:26:39 +08:00

run_chat_shortcut_live_write_audit.py

fix(im): harden live audit contracts

2026-08-03 20:39:27 +08:00

run_chat_shortcut_write_dry_run_audit.py

feat(chat): align and harden IM shortcuts

2026-07-29 00:21:26 +08:00

run_shortcut_real_write_matrix.py

feat: gate unverified shortcuts for release

2026-07-15 16:45:51 +08:00

shortcut_real_result_test.py

fix(shortcut): fix projection-data-loss silent-empty returns

2026-07-24 10:07:02 +08:00

shortcut_real_result.py

fix(shortcut): fix projection-data-loss silent-empty returns

2026-07-24 10:07:02 +08:00

README.md

Go Bootstrap Scripts

These repo-local entrypoints are the supported shell entrypoints for building, testing, packaging, and policy checks.

make build: build the dws CLI from cmd
make test: run every default package returned by go list ./...
make test-plan: verify every default Go package belongs to exactly one CI test shard
make lint: run the repository-wide format check, go vet, and required staticcheck
make format-check: check every tracked or non-ignored untracked repository Go source file with gofmt
make fmt: format every tracked or non-ignored untracked repository Go source file
make policy: reuse the current dws binary and run the complete policy suite (make build first)
make package: build all release artifacts locally
make release-pre VERSION=vX.Y.Z-beta.N: validate a prerelease (PUBLISH=1 pushes its tag)
make release-stable VERSION=vX.Y.Z FROM_BETA=vX.Y.Z-beta.N: validate a stable promotion (PUBLISH=1 pushes its tag)

Script groups:

Root installers: ./scripts/install.sh, ./scripts/install.ps1, ./scripts/install-skills.sh
Product convenience installers: ./scripts/install-devapp.sh, ./scripts/install-devapp.ps1, ./scripts/install-event.sh
CI package plan: ./scripts/ci/test-packages.sh
Dev helpers: ./scripts/dev/build.sh, ./scripts/dev/lint.sh, ./scripts/dev/ci-local.sh, ./scripts/dev/run-mock-e2e.sh, ./scripts/dev/coverage.sh
Policy checks: ./scripts/policy/check-generated-drift.sh, ./scripts/policy/check-command-surface.sh, ./scripts/policy/check-command-compatibility.sh --base-ref <main-ref> --stable-ref <latest-GA-tag> --candidate-ref <candidate-sha>, ./scripts/policy/check-schema-catalog.sh, ./scripts/policy/check-schema-binary.sh, ./scripts/policy/check-open-source-assets.sh
Policy runtime files: set DWS_POLICY_TMPDIR to override the default .worktrees/policy-tmp workspace
Release entrypoint and contract: ./scripts/release/release.sh, ./scripts/release/release-contract.sh; operator guide: docs/releasing.md
Release packaging helpers: ./scripts/release/post-goreleaser.sh, ./scripts/release/stage-npm-package.sh, ./scripts/release/pack-npm-package.sh, ./scripts/release/verify-delivered-stable.sh, ./scripts/release/verify-release-artifacts.sh, ./scripts/release/verify-github-release-assets.sh, ./scripts/release/verify-github-tag-authority.sh, ./scripts/release/verify-package-managers.sh, ./scripts/release/publish-homebrew-formula.sh