feat(cli): add audit — repo Zenodo config-hygiene check#20
Merged
Conversation
Codifies the manual monitored-repo audit as a first-class command, the config-hygiene sibling of `doctor` (which covers webhook/competing-concept/ drift). For one repo or an entire monitored.json (`--monitored`), it checks: - the standard files (CITATION.cff, .zenodo.json) are present - both reusable workflows are pinned at the floating @vn — a @vX.Y.Z or SHA pin silently freezes a consumer on old code, so this directly protects the moving-major-tag strategy - .zenodo.json creators AND title match the published Zenodo record (both hard problems: the title is what people see on the DOI landing page, so drive it to consistency; a curated repo whose record shows a per-version title flags until its .zenodo.json title is reconciled) Deliberately does NOT diff .zenodo.json against CITATION.cff: that needs a YAML parser this stdlib-only tool avoids, and is cffconvert's job. The published record is the ground truth, and it's pure JSON. Tokenless against public APIs, but reads $GH_TOKEN/$GITHUB_TOKEN when set — GitHub's 60-req/hour unauthenticated limit is blown by a multi-repo fan-out that fetches every workflow file. Exits non-zero on problems (CI/monitor gate). - api: github_file/github_dir (public, optional token), reusable_refs and is_major_pin (pure, unit-tested) - cli: cmd_audit + _audit_one; new `audit` subcommand with `--monitored` - tests: reusable_refs / is_major_pin - README + SKILL: document the command monitor.yml wiring left as a follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BZx7w9BexQc9wWU5JoHYaF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a first-class
auditsubcommand that codifies the manual monitored-repo audit — the config-hygiene sibling ofdoctor(which covers webhook / competing-concept / drift).Per repo it checks:
CITATION.cffand.zenodo.jsonpresent@vN. A@vX.Y.Zor SHA pin silently freezes a consumer on old code, so this is the check that protects the moving-major-tag strategy (nothing else catches it today)..zenodo.jsoncreators and title match the published Zenodo record. Both are hard problems: the title is what people see on the DOI landing page, so we drive it to consistency.Design decisions
.zenodo.jsontoCITATION.cffneeds a YAML parser this stdlib-only tool deliberately avoids, and is reallycffconvert's job. Instead we compare.zenodo.jsonto the published record — the ground truth, and pure JSON.$GH_TOKENwhen set. Tokenless works, but GitHub's 60-req/hour unauthenticated limit is blown by a multi-repo fan-out that fetches every workflow file. Reads$GH_TOKEN/$GITHUB_TOKENlikedoctordoes.Live run (all 12 monitored repos)
Surfaces 9 problems:
vcell-solversunonboarded (×4),biosimulationsmissing.zenodo.json(its PR is open), and 4 title mismatches —pyvcell→pyVCell,platform,runutils(casing), andvcell(Virtual Cell (VCell)vs the curatedVirtual Cell 8.0). The vcell case is the curated-title pattern: it flags until its.zenodo.jsontitle is reconciled with what should be displayed.Tests / checks
ruff+mypy --strictclean; 34 unit tests pass (addedreusable_refs/is_major_pin).apihelpersgithub_file/github_dirare thin public-API readers; the pinning logic is pure and unit-tested.monitor.ymlwiring left as a follow-up, as agreed.🤖 Generated with Claude Code
https://claude.ai/code/session_01BZx7w9BexQc9wWU5JoHYaF