Harden repository quality and CLI safety

.gitattributes

@@ -1,5 +1,8 @@
 * text=auto eol=lf
 *.mjs text eol=lf
+*.json text eol=lf
 *.md text eol=lf
+*.cff text eol=lf
 *.yml text eol=lf
 *.yaml text eol=lf
+*.png binary

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# The maintainer owns the complete repository, including this policy file.
+* @TheStreamCode

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/TheStreamCode/agentic-rd-skill/security/advisories/new
+    about: Report sensitive vulnerabilities privately instead of opening a public issue.
+  - name: Questions and usage support
+    url: https://github.com/TheStreamCode/agentic-rd-skill/discussions
+    about: Ask questions and share usage feedback in GitHub Discussions.

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,11 +4,10 @@
 
 ## Validation
 
-- [ ] `npm test`
-- [ ] `npm run validate`
-- [ ] `npm run benchmark` when CLI, templates, or package size changes
+- [ ] `npm run check`
 - [ ] `agentskills validate <absolute-skill-path>`
 - [ ] `gh skill publish --dry-run`
+- [ ] Documentation, changelog, and evaluation cases are updated when public behavior changes
 
 ## Compatibility And Safety Notes
 

.github/workflows/ci.yml

@@ -9,20 +9,25 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  # Produces the `validate` check that branch protection requires. The script
-  # existed but was never run in CI, so the required context never appeared and
-  # every pull request stayed blocked on a check that could not arrive.
+  # Fast structural feedback; the final quality job aggregates every required gate.
   validate:
     name: validate
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
 
@@ -32,6 +37,7 @@ jobs:
   test:
     name: Node ${{ matrix.node }} on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix:
@@ -49,10 +55,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: ${{ matrix.node }}
 
@@ -62,20 +70,25 @@ jobs:
   specification:
     name: Agent Skills specification and discovery
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
 
       - name: Install official reference validator
-        run: python -m pip install skills-ref
+        run: >-
+          python -m pip install --disable-pip-version-check --only-binary=:all:
+          --require-hashes -r requirements-validation.txt
 
       - name: Validate Agent Skill specification
         run: agentskills validate "$GITHUB_WORKSPACE/skills/agentic-rd-skill"
@@ -88,15 +101,42 @@ jobs:
   performance:
     name: CLI performance guardrail
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
 
       - name: Run realistic workflow benchmark
         run: npm run benchmark
+
+  quality:
+    name: quality
+    if: always()
+    needs:
+      - validate
+      - test
+      - specification
+      - performance
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+
+    steps:
+      - name: Require every quality job to pass
+        env:
+          VALIDATE_RESULT: ${{ needs.validate.result }}
+          TEST_RESULT: ${{ needs.test.result }}
+          SPECIFICATION_RESULT: ${{ needs.specification.result }}
+          PERFORMANCE_RESULT: ${{ needs.performance.result }}
+        run: |
+          test "$VALIDATE_RESULT" = success
+          test "$TEST_RESULT" = success
+          test "$SPECIFICATION_RESULT" = success
+          test "$PERFORMANCE_RESULT" = success

.gitignore

@@ -1,8 +1,11 @@
 node_modules/
+.venv/
 /work/
 /project-brief.md
 .DS_Store
 Thumbs.db
 *.log
+coverage/
+*.lcov
 .env
 .env.*

CHANGELOG.md

@@ -19,13 +19,22 @@
 - Added GitHub CLI installation guidance alongside the manual installation path.
 - Added discoverability-focused README sections for real use cases, workflow steps, Agent Laboratory comparison, FAQs, maintainer attribution, and search intent coverage.
 - Expanded repository and package metadata for GitHub, traditional search, and AI search discovery without keyword stuffing.
+- Added a single `npm run check` quality gate, pinned validation dependencies, CODEOWNERS, and guided issue routing.
 
 ### Changed
 
 - Replaced post-hoc collaboration with orchestrator-owned handoffs after every wave.
 - Replaced the heading-based validator with stateful behavior and repository tests.
 - Removed broad host-specific `allowed-tools` pre-approval from skill frontmatter.
 - Improved CLI UX with lazy phase templates, readable phase aliases, actionable status output, and explicit stale-final recovery.
+- Pinned GitHub Actions to immutable commits, disabled persisted checkout credentials, bounded job runtimes, and added an aggregate CI quality check.
+- Removed the obsolete writable Dependabot auto-merge workflow after version updates were disabled.
+
+### Security
+
+- Made workflow-state updates atomic so interrupted writes preserve the previous valid state.
+- Rejected symlinked Markdown artifacts and non-file template conflicts instead of following or silently keeping them.
+- Rejected numeric CLI values outside JavaScript's safe integer range.
 
 ## 0.3.0
 

CONTRIBUTING.md

@@ -2,6 +2,17 @@
 
 Contributions should preserve portability, deterministic safety checks, and progressive disclosure.
 
+## Development Setup
+
+Use Node.js 20 or newer for the dependency-free test suite. Release validation also requires Python 3.11 or newer and GitHub CLI 2.96 or newer.
+
+Install the pinned Agent Skills reference validator into an isolated Python environment:
+
+```powershell
+python -m venv .venv
+.\.venv\Scripts\python.exe -m pip install --disable-pip-version-check --only-binary=:all: --require-hashes -r requirements-validation.txt
+```
+
 ## Guidelines
 
 - Keep the installable package under `skills/agentic-rd-skill/`.
@@ -17,10 +28,8 @@ Contributions should preserve portability, deterministic safety checks, and prog
 Run:
 
 ```powershell
-npm test
-npm run validate
-npm run benchmark
-agentskills validate (Resolve-Path '.\skills\agentic-rd-skill').Path
+npm run check
+.\.venv\Scripts\agentskills.exe validate (Resolve-Path '.\skills\agentic-rd-skill').Path
 gh skill publish --dry-run
 ```
 

README.md

@@ -168,9 +168,7 @@ Legal, medical, financial, compliance, employment, insurance, credit, security,
 Run the local deterministic suite:
 
 ```powershell
-npm test
-npm run validate
-npm run benchmark
+npm run check
 npm run smoke:hosts
 # Optional model-backed activation checks:
 npm run smoke:hosts:model
@@ -179,7 +177,9 @@ npm run smoke:hosts:model
 Release preparation also uses the official Agent Skills reference validator and GitHub CLI discovery:
 
 ```powershell
-agentskills validate (Resolve-Path '.\skills\agentic-rd-skill').Path
+python -m venv .venv
+.\.venv\Scripts\python.exe -m pip install --disable-pip-version-check --only-binary=:all: --require-hashes -r requirements-validation.txt
+.\.venv\Scripts\agentskills.exe validate (Resolve-Path '.\skills\agentic-rd-skill').Path
 gh skill publish --dry-run
 ```
 

package.json

@@ -13,6 +13,7 @@
   },
   "type": "module",
   "scripts": {
+    "check": "npm run validate && npm test && npm run benchmark",
     "test": "node --test",
     "validate": "node scripts/validate-repo.mjs",
     "benchmark": "node scripts/benchmark.mjs",
@@ -40,5 +41,6 @@
     "agent-laboratory"
   ],
   "author": "Michael Gasperini (https://mikesoft.it)",
+  "funding": "https://github.com/sponsors/TheStreamCode",
   "license": "MIT"
 }

requirements-validation.txt

@@ -0,0 +1,7 @@
+# Reproducible tools for Agent Skills specification validation.
+click==8.4.2 --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
+colorama==0.4.6 --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+python-dateutil==2.9.0.post0 --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
+six==1.17.0 --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274
+skills-ref==0.1.1 --hash=sha256:d35db5bb8de71ae301daf5ca9cb71f8a555e8c6f83a6d40e46a5bc09f8f461b5
+strictyaml==1.7.3 --hash=sha256:fb5c8a4edb43bebb765959e420f9b3978d7f1af88c80606c03fb420888f5d1c7

scripts/validate-repo.mjs

@@ -42,13 +42,16 @@ const REQUIRED_ROOT_FILES = [
   '.gitattributes',
   '.gitignore',
   '.github/FUNDING.yml',
+  '.github/CODEOWNERS',
   '.github/PULL_REQUEST_TEMPLATE.md',
+  '.github/ISSUE_TEMPLATE/config.yml',
   '.github/ISSUE_TEMPLATE/bug_report.yml',
   '.github/ISSUE_TEMPLATE/documentation.yml',
   '.github/ISSUE_TEMPLATE/skill_improvement.yml',
   '.github/workflows/ci.yml',
   'evals/manifest.json',
   'evals/usability-review.md',
+  'requirements-validation.txt',
   'scripts/benchmark.mjs',
   'scripts/smoke-hosts.mjs',
   'tests/package.test.mjs',
@@ -150,6 +153,9 @@ export function validateRepository(root = repositoryRoot) {
     if (packageJson.version !== '1.0.0') fail('package.json version must be 1.0.0');
     if (packageJson.engines?.node !== '>=20') fail('package.json must require Node.js >=20');
     if (packageJson.scripts?.test !== 'node --test') fail('package.json test script must run node --test');
+    if (packageJson.scripts?.check !== 'npm run validate && npm test && npm run benchmark') {
+      fail('package.json check script must run validation, tests, and benchmark');
+    }
     if (packageJson.scripts?.benchmark !== 'node scripts/benchmark.mjs') {
       fail('package.json benchmark script must run scripts/benchmark.mjs');
     }
@@ -160,6 +166,17 @@ export function validateRepository(root = repositoryRoot) {
     }
   }
 
+  for (const workflowPath of ['.github/workflows/ci.yml']) {
+    const fullPath = path.join(root, workflowPath);
+    if (!existsSync(fullPath)) continue;
+    const workflow = readText(fullPath);
+    for (const match of workflow.matchAll(/^\s*-?\s*uses:\s*[^@\s]+@([^\s#]+)/gm)) {
+      if (!/^[0-9a-f]{40}$/.test(match[1])) {
+        fail(`${workflowPath} must pin actions to full commit SHAs`);
+      }
+    }
+  }
+
   const citationPath = path.join(root, 'CITATION.cff');
   if (existsSync(citationPath) && !/^version:\s*"1\.0\.0"\s*$/m.test(readText(citationPath))) {
     fail('CITATION.cff version must be 1.0.0');