From 8ee4e0869657ebadde2219142ea21d5e9e2aa39f Mon Sep 17 00:00:00 2001
From: ProtocolWarden <32967198+ProtocolWarden@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:13:43 -0400
Subject: [PATCH] ci(audit): add custodian-audit workflow (R2-in-CI via B64
 boundary artifact)

Brings this repo in line with the 12 audit-CI repos: installs custodian@main,
materializes the boundary artifact from the REPOGRAPH_BOUNDARY_ARTIFACT_B64
content secret (graceful skip if absent), sets core.hooksPath, runs
custodian-multi --fail-on-findings. Closes the R2-enforcement gap where this
repo only enforced via local pre-push.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/custodian-audit.yml | 48 +++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/custodian-audit.yml

diff --git a/.github/workflows/custodian-audit.yml b/.github/workflows/custodian-audit.yml
new file mode 100644
index 0000000..4e8931e
--- /dev/null
+++ b/.github/workflows/custodian-audit.yml
@@ -0,0 +1,48 @@
+name: custodian-audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Custodian
+        run: |
+          python -m pip install --upgrade pip
+          pip install "custodian[tools] @ git+https://github.com/ProtocolWarden/Custodian.git@main"
+          pip install ruff vulture ty
+
+      - name: Install repo (best-effort, for adapter passes)
+        run: |
+          if [ -f pyproject.toml ]; then
+            pip install -e . || true
+          fi
+
+      - name: Materialize boundary artifact file
+        # Decode the boundary disclosure artifact from the base64 CONTENT secret
+        # REPOGRAPH_BOUNDARY_ARTIFACT_B64 (the older *_FILE path secret cannot resolve
+        # on a CI runner). Graceful: skip if absent (B2 flags it if required).
+        env:
+          REPOGRAPH_BOUNDARY_ARTIFACT_B64: ${{ secrets.REPOGRAPH_BOUNDARY_ARTIFACT_B64 }}
+        run: |
+          if [ -z "${REPOGRAPH_BOUNDARY_ARTIFACT_B64:-}" ]; then
+            echo "REPOGRAPH_BOUNDARY_ARTIFACT_B64 not set — skipping (B2 flags if required)."
+            exit 0
+          fi
+          dest="$(mktemp "${RUNNER_TEMP:-/tmp}/repograph-boundary-XXXXXX.json")"
+          printf '%s' "$REPOGRAPH_BOUNDARY_ARTIFACT_B64" | base64 -d > "$dest"
+          echo "REPOGRAPH_BOUNDARY_ARTIFACT_FILE=$dest" >> "$GITHUB_ENV"
+      - name: Run Custodian audit
+        run: |
+          git config core.hooksPath .hooks
+          custodian-multi --repos . --fail-on-findings --no-color