External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(agnosticism): close the audit residue — B6/B8/B10 + three MAJORs (#587)

Browse Source 
Thread the deployer's product name through the X reply + feature-spotlight
prompts (B6 leftover; release/video paths shipped in #570); make the
docs-site repo/URL config (ROBOCO_DOCS_SITE_*, defaults unchanged) instead
of a roboco-website hardcode (B8); de-assert our repo from the Main PM
prompt (B10); derive PR labels from the real target branch instead of
literal to-master/to-slave; drop the stale headcount from base.md; and
make the bash-guard's Makefile check require an actual quality/gate/lint/
test target before denying raw package-manager commands (no more
false-remediation loop on Go/Rust Makefiles).

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This commit is contained in:
Renzo F
2026-07-19 17:52:17 +02:00
committed by GitHub
co-authored by Renn F
parent 29f7082030
commit 5b27a443e9
15 changed files with 234 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/scripts/bash-guard-hook.sh
+10 -5
View File
@@ -389,11 +389,16 @@ fi
# present, denying raw uv/pip/conda/poetry and remediating to the make targets.
# The Makefile sets UV_NO_SYNC=1 + a private UV_CACHE_DIR for consistent gate
# behaviour; bare `uv run` bypasses both. Skipped when no Makefile exists so
# Makefile-less projects aren't blocked. `make`-internal uv (hook inspects the
# agent's command string, not subprocesses) and WorkspaceService's uv sync
# (subprocess, not the agent Bash tool) are untouched. On grok a deny cancels
# the whole run, so ROBOCO_GUARD_SKIP_PM=1 nudges (exit 0) instead.
if test -f Makefile && echo "$low" | grep -qE '(^|[[:space:];&|])(uv[[:space:]]+(run|sync|pip[[:space:]]+(install|uninstall)|lock|add|remove)|pip3?[[:space:]]+(install|uninstall)|conda[[:space:]]+(install|create|run)|poetry[[:space:]]+(run|install|add))([[:space:]]|$)'; then
# Makefile-less projects aren't blocked, AND skipped when a Makefile exists but
# declares none of the remediation targets (e.g. a Go/Rust Makefile with only
# `build`/`run`) — existence alone isn't enough, or the remediation below sends
# the agent into a dead-end loop calling a target that doesn't exist.
# `make`-internal uv (hook inspects the agent's command string, not
# subprocesses) and WorkspaceService's uv sync (subprocess, not the agent Bash
# tool) are untouched. On grok a deny cancels the whole run, so
# ROBOCO_GUARD_SKIP_PM=1 nudges (exit 0) instead.
if test -f Makefile && grep -qE '^(quality|gate|lint|test):' Makefile && \
echo "$low" | grep -qE '(^|[[:space:];&|])(uv[[:space:]]+(run|sync|pip[[:space:]]+(install|uninstall)|lock|add|remove)|pip3?[[:space:]]+(install|uninstall)|conda[[:space:]]+(install|create|run)|poetry[[:space:]]+(run|install|add))([[:space:]]|$)'; then
if [ -n "${ROBOCO_GUARD_SKIP_PM:-}" ]; then
echo "Nudge: raw package-manager commands are blocked — use \`make quality\` / \`make gate\` / \`make lint\` / \`make test\`. The Makefile sets UV_NO_SYNC=1 + a private cache; bare \`uv run\` bypasses that." >&2
exit 0