Skip to content

Commit 032173b

Browse files
CodeMonkeyCybersecurityCodeMonkeyCybersecurity
authored
Merge pull request #10 from CodeMonkeyCybersecurity/fix/add-governance-guardrails
feat: add governance guardrails to prevent unauthorized changes
2 parents be8da40 + e1059ac commit 032173b

5 files changed

Lines changed: 171 additions & 2 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# CODEOWNERS - Require human approval for critical files
2+
#
3+
# These patterns require explicit human review before merging.
4+
# AI agents (Claude, etc.) cannot approve changes to these files.
5+
6+
# Project identity and module path - NEVER change without owner approval
7+
go.mod @CodeMonkeyCybersecurity/owners
8+
go.sum @CodeMonkeyCybersecurity/owners
9+
10+
# Repository configuration
11+
.github/ @CodeMonkeyCybersecurity/owners
12+
.gitignore @CodeMonkeyCybersecurity/owners
13+
14+
# Build and deployment
15+
Makefile @CodeMonkeyCybersecurity/owners
16+
Dockerfile* @CodeMonkeyCybersecurity/owners
17+
docker-compose*.yml @CodeMonkeyCybersecurity/owners
18+
19+
# Documentation that defines project identity
20+
README.md @CodeMonkeyCybersecurity/owners
21+
CLAUDE.md @CodeMonkeyCybersecurity/owners
22+
LICENSE* @CodeMonkeyCybersecurity/owners
23+
24+
# Configuration files
25+
*.yaml @CodeMonkeyCybersecurity/owners
26+
*.yml @CodeMonkeyCybersecurity/owners

‎CLAUDE.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,41 @@ When looking for context, Claude should:
5151
- **Actionable**: Every criticism includes a concrete fix
5252
- **Human-focused**: Remember this tool serves security researchers who need reliable results
5353

54+
### AI Agent Boundaries (MANDATORY)
55+
56+
**NEVER do these without explicit human authorization:**
57+
58+
1. **Project Identity Changes**
59+
- NEVER rename the project, module path, or executable
60+
- NEVER change `go.mod` module path
61+
- NEVER rename the GitHub repository
62+
- The project is called `shells` - this is final
63+
64+
2. **Architectural Decisions**
65+
- NEVER restructure the entire codebase
66+
- NEVER change the primary language or framework
67+
- NEVER migrate to different infrastructure (e.g., Kubernetes)
68+
- ASK before making changes that affect >50 files
69+
70+
3. **External Dependencies**
71+
- NEVER add major new dependencies without asking
72+
- NEVER remove existing dependencies that are in use
73+
- NEVER upgrade to major versions (e.g., v1 → v2)
74+
75+
4. **Configuration and Deployment**
76+
- NEVER modify CI/CD pipelines without asking
77+
- NEVER change deployment targets or methods
78+
- NEVER modify security-sensitive configurations
79+
80+
**ALWAYS do these:**
81+
82+
1. **Ask before major changes** - If a change affects project identity, architecture, or >20 files, ask first
83+
2. **Verify builds** - Run `go build ./...` before committing
84+
3. **Follow existing patterns** - Match the style and structure of existing code
85+
4. **Document decisions** - Add inline comments explaining non-obvious choices
86+
87+
**Incident Reference**: PR #4 renamed the project from `shells` to `artemis` without authorization, causing divergent branches and build failures. This section exists to prevent similar incidents.
88+
5489
## Common Development Commands
5590

5691
### Build and Test

‎Makefile‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.PHONY: all deps build install test clean fmt vet
1+
.PHONY: all deps build install test clean fmt vet install-hooks
22

33
# Default target
44
all: build
@@ -37,4 +37,12 @@ check: fmt vet test
3737

3838
# Development build with race detection
3939
dev:
40-
go build -race -o shells .
40+
go build -race -o shells .
41+
42+
# Install git hooks for development
43+
install-hooks:
44+
@echo "Installing git hooks..."
45+
@cp scripts/git-hooks/pre-commit .git/hooks/pre-commit
46+
@cp scripts/git-hooks/pre-push .git/hooks/pre-push
47+
@chmod +x .git/hooks/pre-commit .git/hooks/pre-push
48+
@echo "Git hooks installed successfully."

‎scripts/git-hooks/pre-commit‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
# pre-commit hook - Validates critical files before commit
3+
#
4+
# Install: cp scripts/git-hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
5+
# Or run: make install-hooks
6+
7+
set -e
8+
9+
# Check if go.mod module path is being changed
10+
if git diff --cached --name-only | grep -q "^go.mod$"; then
11+
# Get the module path from staged go.mod
12+
staged_module=$(git show :go.mod | grep "^module " | awk '{print $2}')
13+
14+
# Verify it's still shells
15+
if [[ "$staged_module" != "github.com/CodeMonkeyCybersecurity/shells" ]]; then
16+
echo ""
17+
echo "ERROR: Module path change detected!"
18+
echo ""
19+
echo " Current: $staged_module"
20+
echo " Expected: github.com/CodeMonkeyCybersecurity/shells"
21+
echo ""
22+
echo "The project module path must remain 'github.com/CodeMonkeyCybersecurity/shells'."
23+
echo "If you need to change this, get explicit owner approval first."
24+
echo ""
25+
exit 1
26+
fi
27+
fi
28+
29+
# Run gofmt on staged Go files
30+
staged_go_files=$(git diff --cached --name-only --diff-filter=ACM | grep '\.go$' || true)
31+
if [[ -n "$staged_go_files" ]]; then
32+
unformatted=$(gofmt -l $staged_go_files 2>/dev/null || true)
33+
if [[ -n "$unformatted" ]]; then
34+
echo ""
35+
echo "WARNING: Some Go files are not formatted:"
36+
echo "$unformatted"
37+
echo ""
38+
echo "Run 'gofmt -w' on these files or 'make fmt'"
39+
echo ""
40+
# Warning only, don't block
41+
fi
42+
fi
43+
44+
exit 0

‎scripts/git-hooks/pre-push‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/bin/bash
2+
# pre-push hook - Prevents pushing when local and remote have diverged
3+
#
4+
# Install: cp scripts/git-hooks/pre-push .git/hooks/pre-push && chmod +x .git/hooks/pre-push
5+
# Or run: make install-hooks
6+
7+
set -e
8+
9+
remote="$1"
10+
url="$2"
11+
12+
# Only check pushes to origin
13+
if [[ "$remote" != "origin" ]]; then
14+
exit 0
15+
fi
16+
17+
# Get current branch
18+
branch=$(git rev-parse --abbrev-ref HEAD)
19+
20+
# Skip for new branches (no upstream)
21+
if ! git rev-parse --verify "origin/$branch" &>/dev/null; then
22+
exit 0
23+
fi
24+
25+
# Check for divergence
26+
local_only=$(git rev-list "origin/$branch..$branch" --count 2>/dev/null || echo "0")
27+
remote_only=$(git rev-list "$branch..origin/$branch" --count 2>/dev/null || echo "0")
28+
29+
if [[ "$local_only" -gt 0 ]] && [[ "$remote_only" -gt 0 ]]; then
30+
echo ""
31+
echo "ERROR: Branches have diverged!"
32+
echo ""
33+
echo " Local has $local_only commit(s) not on remote"
34+
echo " Remote has $remote_only commit(s) not on local"
35+
echo ""
36+
echo "To fix:"
37+
echo " 1. git fetch origin"
38+
echo " 2. git rebase origin/$branch # or git merge origin/$branch"
39+
echo " 3. Resolve any conflicts"
40+
echo " 4. git push"
41+
echo ""
42+
exit 1
43+
fi
44+
45+
# Verify build passes before push (optional - can be slow)
46+
if [[ -f "go.mod" ]]; then
47+
echo "Verifying build..."
48+
if ! go build ./... 2>/dev/null; then
49+
echo ""
50+
echo "ERROR: Build failed! Fix build errors before pushing."
51+
echo ""
52+
exit 1
53+
fi
54+
fi
55+
56+
exit 0

0 commit comments

Comments
 (0)