style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
a5154ee884
commit
ec27228a8e
@@ -1,4 +1,4 @@
|
||||
name: compliance — review (advisory)
|
||||
name: compliance: review (advisory)
|
||||
|
||||
# Lightweight LLM-only review on every PR. ~90s, no Docker scanners.
|
||||
# Posts a sticky comment with reasoned findings across all 5 frameworks.
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
name: compliance — full swarm
|
||||
name: compliance: full swarm
|
||||
|
||||
# Full hybrid audit: deterministic scanners + LLM-driven deep_audit checks
|
||||
# (RoPA drift, AGPL §13 evaluation, IDOR/access-control reasoning, ISMS clause
|
||||
|
||||
@@ -14,7 +14,7 @@ jobs:
|
||||
- name: Verify skill bodies are in sync with the seed migration
|
||||
# Fails if a .claude/skills/**/SKILL.md changed without regenerating the
|
||||
# seed migration (npm run skills:generate). Keeps prod skill content from
|
||||
# silently drifting out of sync. No DB needed — reads files + manifest.
|
||||
# silently drifting out of sync. No DB needed: reads files + manifest.
|
||||
run: npm run skills:check
|
||||
- name: Verify taxonomy registry is in sync with the element lists
|
||||
# Fails if dev_docs/bokslut/taxonomi/** changed without regenerating
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
name: Scheduled Image Vulnerability Scan
|
||||
|
||||
# The build pipeline (docker-publish.yml) builds and publishes the image but
|
||||
# does NOT fail on CVEs — it stays green so deploys are deterministic. This
|
||||
# does NOT fail on CVEs: it stays green so deploys are deterministic. This
|
||||
# workflow is the actual vulnerability gate: it re-scans the published `latest`
|
||||
# image and fails (notifying repo admins) plus raises a Security-tab alert on a
|
||||
# fixable CRITICAL/HIGH CVE, prompting a dependency or base-image bump.
|
||||
#
|
||||
# It fires on three triggers:
|
||||
# 1. workflow_run — the moment "Build and Push Docker Image" completes, so a
|
||||
# 1. workflow_run: the moment "Build and Push Docker Image" completes, so a
|
||||
# freshly published image is gated within the scan's own duration (minutes)
|
||||
# rather than waiting up to 24h for the cron. This is what shrinks the
|
||||
# vulnerable-image exposure window after every publish.
|
||||
# 2. schedule (daily) — catches CVEs newly disclosed against an already-
|
||||
# 2. schedule (daily): catches CVEs newly disclosed against an already-
|
||||
# published image even when nothing was republished.
|
||||
# 3. workflow_dispatch — run on demand from the Actions tab after a patch to
|
||||
# 3. workflow_dispatch: run on demand from the Actions tab after a patch to
|
||||
# confirm clean.
|
||||
#
|
||||
# NOTE: GitHub only runs `schedule` and `workflow_run` triggers from the default
|
||||
@@ -23,7 +23,7 @@ on:
|
||||
workflows: ['Build and Push Docker Image']
|
||||
types: [completed]
|
||||
schedule:
|
||||
# 06:17 UTC daily — off the hour to dodge cron congestion on GitHub.
|
||||
# 06:17 UTC daily: off the hour to dodge cron congestion on GitHub.
|
||||
- cron: '17 6 * * *'
|
||||
workflow_dispatch: {}
|
||||
|
||||
@@ -34,7 +34,7 @@ env:
|
||||
jobs:
|
||||
scan:
|
||||
runs-on: ubuntu-latest
|
||||
# workflow_run fires even when the publish FAILED — there's no new image to
|
||||
# workflow_run fires even when the publish FAILED: there's no new image to
|
||||
# gate in that case, so skip. schedule/workflow_dispatch carry no
|
||||
# workflow_run payload, so the `!= 'workflow_run'` arm lets them through.
|
||||
if: >-
|
||||
@@ -59,7 +59,7 @@ jobs:
|
||||
uses: aquasecurity/trivy-action@v0.36.0
|
||||
with:
|
||||
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
|
||||
# Block on fixable CRITICAL/HIGH — the same policy the build pipeline
|
||||
# Block on fixable CRITICAL/HIGH: the same policy the build pipeline
|
||||
# used to enforce inline. It is safe to block here: a red scheduled
|
||||
# run is a "go patch" notification, not a blocked deploy. ignore-unfixed
|
||||
# keeps it actionable (only CVEs we can resolve by rebuilding fail).
|
||||
|
||||
@@ -85,15 +85,15 @@ jobs:
|
||||
id: trivy
|
||||
# Decoupled from the publish gate on purpose: this pipeline must stay
|
||||
# green so builds are deterministic. The image is already pushed and
|
||||
# signed above, so failing here would only redden the run — it would not
|
||||
# signed above, so failing here would only redden the run: it would not
|
||||
# unship a vulnerable image. exit-code:0 + continue-on-error keep CVEs
|
||||
# (and even a Trivy/DB outage) from failing the build; findings still
|
||||
# flow to the Security tab below. The real blocking gate is
|
||||
# docker-image-scan.yml, which re-scans the published image and fails
|
||||
# (notifying admins) on a fixable CRITICAL/HIGH CVE. It runs on a
|
||||
# workflow_run trigger the moment THIS workflow completes — so the gap
|
||||
# workflow_run trigger the moment THIS workflow completes (so the gap
|
||||
# between publish and the blocking scan is the scan's own duration
|
||||
# (minutes), not a 24h cron window — plus a daily cron as a safety net.
|
||||
# (minutes), not a 24h cron window) plus a daily cron as a safety net.
|
||||
# Accepted residual risk: an image is live for that short scan window
|
||||
# before the gate fires; see SELF-HOSTING.md / the risk register.
|
||||
continue-on-error: true
|
||||
@@ -107,7 +107,7 @@ jobs:
|
||||
output: trivy-results.sarif
|
||||
|
||||
- name: Upload Trivy results to GitHub Security tab
|
||||
# if: always() — evidence must reach the Security tab regardless of the
|
||||
# if: always(), evidence must reach the Security tab regardless of the
|
||||
# scan step's exit status. With the previous `outcome == 'success'` guard,
|
||||
# a Trivy/DB outage that errored the scan would silently drop findings.
|
||||
# Kept non-fatal (continue-on-error) so a missing SARIF or a Security-tab
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
name: PR Agent
|
||||
|
||||
# AI pull-request review (PR-Agent, the original open-source reviewer — repo id
|
||||
# AI pull-request review (PR-Agent, the original open-source reviewer: repo id
|
||||
# 662766482, same repo the qodo-ai/Codium-ai names redirect to). Replaces the
|
||||
# Greptile bot that went silent after #682.
|
||||
#
|
||||
@@ -8,7 +8,7 @@ name: PR Agent
|
||||
# * Pinned to an immutable commit SHA (v0.36.0), NOT a movable tag, because the
|
||||
# repo now sits under a recently-created, unverified org (The-PR-Agent).
|
||||
# * Runs on a DEDICATED, minimal IAM key (bedrock:InvokeModel only) supplied via
|
||||
# PR_AGENT_AWS_* secrets — never the app's general AWS credentials. A leaked
|
||||
# PR_AGENT_AWS_* secrets: never the app's general AWS credentials. A leaked
|
||||
# PR-Agent key can do nothing but invoke the one Bedrock model.
|
||||
#
|
||||
# Scope: ONLY /review runs automatically. /describe and /improve are disabled so
|
||||
@@ -25,7 +25,7 @@ on:
|
||||
# a superseded review. The event_name suffix is critical: without it, the
|
||||
# pull_request and issue_comment triggers share a group, so a bot comment
|
||||
# (Vercel/Supabase/compliance preview bots fire within ~2s of opening a PR)
|
||||
# queues an issue_comment run that cancel-in-progress kills the real review with —
|
||||
# queues an issue_comment run that cancel-in-progress kills the real review with,
|
||||
# before the job-level `if: sender.type != 'Bot'` ever gets to skip it. Keeping the
|
||||
# groups separate lets comment runs cancel only each other (all skipped, harmless)
|
||||
# and never the open/push review.
|
||||
@@ -46,12 +46,12 @@ jobs:
|
||||
name: The PR Agent
|
||||
steps:
|
||||
- name: The PR Agent
|
||||
# Pinned to the v0.36.0 commit SHA (immutable) — do not switch to @v0.36.0.
|
||||
# Pinned to the v0.36.0 commit SHA (immutable): do not switch to @v0.36.0.
|
||||
uses: The-PR-Agent/pr-agent@bd09b6cf89c6d6f3d16b159fa7603fa0e7768cf2 # v0.38.0
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# ── DEDICATED Bedrock IAM key (bedrock:InvokeModel only) — NOT the
|
||||
# ── DEDICATED Bedrock IAM key (bedrock:InvokeModel only): NOT the
|
||||
# app's AWS_* secrets. litellm reads AWS_REGION_NAME; AWS_REGION is
|
||||
# set too for safety. Create these three repo/org secrets:
|
||||
# PR_AGENT_AWS_ACCESS_KEY_ID, PR_AGENT_AWS_SECRET_ACCESS_KEY,
|
||||
@@ -78,7 +78,7 @@ jobs:
|
||||
# (NOT a command list). Default omits 'synchronize', so pushes are
|
||||
# skipped; we add it so every push is reviewed too.
|
||||
GITHUB_ACTION_CONFIG.PR_ACTIONS: '["opened", "reopened", "ready_for_review", "review_requested", "synchronize"]'
|
||||
# ── Which commands actually run on a handled event. Only review —
|
||||
# ── Which commands actually run on a handled event. Only review:
|
||||
# describe/improve off so the bot never rewrites the PR body or
|
||||
# pushes code suggestions.
|
||||
GITHUB_ACTION_CONFIG.AUTO_REVIEW: "true"
|
||||
|
||||
@@ -4,7 +4,7 @@ name: Compliance diff
|
||||
#
|
||||
# This runs on the untrusted PR head, but is SAFE because it has NO secrets and
|
||||
# only a read-only token: it computes the diff and uploads it as an artifact.
|
||||
# It never runs project code (no `npm install`, no `node`) — only git plumbing,
|
||||
# It never runs project code (no `npm install`, no `node`): only git plumbing,
|
||||
# which does not execute repository hooks. The privileged half (model call +
|
||||
# comment) lives in stage 2, which never checks out fork code.
|
||||
|
||||
@@ -25,7 +25,7 @@ jobs:
|
||||
fetch-depth: 0
|
||||
- name: Compute diff vs base
|
||||
# Pass GitHub context via env, never interpolate ${{ }} into the shell
|
||||
# body — expression substitution happens before bash parses the script,
|
||||
# body: expression substitution happens before bash parses the script,
|
||||
# so a value with shell metacharacters would be a code-execution sink.
|
||||
env:
|
||||
BASE_REF: ${{ github.base_ref }}
|
||||
|
||||
@@ -2,11 +2,11 @@ name: Swedish Accounting Compliance Review
|
||||
|
||||
# Stage 2 of the fork-safe compliance review (stage 1 is swedish-compliance-diff.yml).
|
||||
#
|
||||
# SECURITY: this is the privileged half — it has the AWS Bedrock secrets and a
|
||||
# SECURITY: this is the privileged half: it has the AWS Bedrock secrets and a
|
||||
# write token. It is triggered by `workflow_run` (NOT pull_request_target) and
|
||||
# checks out ONLY the base repo, so it never executes fork PR code. The untrusted
|
||||
# input (the PR diff) arrives as a downloaded artifact and is fed to the model
|
||||
# as DATA — never run. This is the pattern GitHub recommends instead of
|
||||
# as DATA: never run. This is the pattern GitHub recommends instead of
|
||||
# `pull_request_target` + checking out the PR head.
|
||||
|
||||
on:
|
||||
@@ -27,8 +27,8 @@ jobs:
|
||||
github.event.workflow_run.event == 'pull_request' &&
|
||||
github.event.workflow_run.conclusion == 'success'
|
||||
steps:
|
||||
# Base repo only — the TRUSTED copy of the script and .claude/skills/.
|
||||
# persist-credentials: false — no later step needs git push creds, so don't
|
||||
# Base repo only: the TRUSTED copy of the script and .claude/skills/.
|
||||
# persist-credentials: false, no later step needs git push creds, so don't
|
||||
# leave the token in .git/config for the steps that handle untrusted input.
|
||||
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
||||
with:
|
||||
|
||||
Reference in New Issue
Block a user