From ec9e559234d4fe914c7ce15b9fe8e471f7bd287f Mon Sep 17 00:00:00 2001 From: Alex Godoroja Date: Mon, 15 Jun 2026 18:57:22 -0700 Subject: [PATCH 1/2] ci: validate app-store catalogue entries on PR Adds a catalogue-validate workflow that runs the app-template verifier on any PR touching catalogue/catalogue.json (bundle sha, manifest validity + signature, .help discovery, id/version, downgrade guard), plus a reviewer PR template for the human half of the review gate. --- .github/PULL_REQUEST_TEMPLATE/catalogue.md | 24 ++++++++++++++++ .github/workflows/catalogue-validate.yml | 33 ++++++++++++++++++++++ 2 files changed, 57 insertions(+) create mode 100644 .github/PULL_REQUEST_TEMPLATE/catalogue.md create mode 100644 .github/workflows/catalogue-validate.yml diff --git a/.github/PULL_REQUEST_TEMPLATE/catalogue.md b/.github/PULL_REQUEST_TEMPLATE/catalogue.md new file mode 100644 index 00000000..38d5811f --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE/catalogue.md @@ -0,0 +1,24 @@ + + +## App-store catalogue change + +**App id:** `io.pilot.____` +**Version:** `____` (new app / version bump) +**Publisher:** `____` (must appear in `pilot-protocol/catalog` `publishers/registry.json`) + +### Automated gate +- [ ] `catalogue-validate` CI is green (sha, manifest, signature, `.help`, id/version, no downgrade). + +### Reviewer checklist (do not merge until all checked) +- [ ] Publisher is in `publishers/registry.json` (or added in a linked PR). +- [ ] **Grants are proportional** to the described function. Scrutinize any + `proc.exec`, `fs.write`, `key.sign`, or broad `net.dial` target. +- [ ] `description` accurately reflects what the app does. +- [ ] Backend host (for `net.dial`) is one the publisher controls. +- [ ] Bundle is released on **`pilot-protocol/catalog`**, not `TeoSlayer/pilotprotocol`. +- [ ] Existing catalogue entries are preserved (only the intended app changed). + +### Notes + diff --git a/.github/workflows/catalogue-validate.yml b/.github/workflows/catalogue-validate.yml new file mode 100644 index 00000000..950b31f3 --- /dev/null +++ b/.github/workflows/catalogue-validate.yml @@ -0,0 +1,33 @@ +# Deploy this to TeoSlayer/pilotprotocol/.github/workflows/catalogue-validate.yml +# Gates every PR that edits the app-store catalogue index (SPEC §7.1). +name: catalogue-validate + +on: + pull_request: + paths: + - "catalogue/catalogue.json" + +jobs: + validate: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 # need the base ref for the downgrade check + + - uses: actions/setup-go@v5 + with: + go-version: "1.25" + + - name: Extract base catalogue (for downgrade check) + run: | + git show "origin/${{ github.base_ref }}:catalogue/catalogue.json" > /tmp/base-catalogue.json 2>/dev/null || echo '{"apps":[]}' > /tmp/base-catalogue.json + + - name: Build verifier + run: | + git clone --depth 1 https://github.com/pilot-protocol/app-template /tmp/app-template + (cd /tmp/app-template && go build -o /tmp/pilot-app ./cmd/pilot-app) + + - name: Verify catalogue entries + run: | + PILOT_CATALOGUE_BASE=/tmp/base-catalogue.json /tmp/pilot-app verify catalogue/catalogue.json From 905619003a249a196670f79ea1ed5bedd2a5c75d Mon Sep 17 00:00:00 2001 From: TeoSlayer Date: Tue, 16 Jun 2026 12:16:44 +0300 Subject: [PATCH 2/2] ci(catalogue): pin app-template verifier to v0.1.0 This is a supply-chain trust gate; building the verifier from an unpinned upstream HEAD would let an app-template change flow straight into the gate. Pin to the released v0.1.0 tag. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/catalogue-validate.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/catalogue-validate.yml b/.github/workflows/catalogue-validate.yml index 950b31f3..a1e5d552 100644 --- a/.github/workflows/catalogue-validate.yml +++ b/.github/workflows/catalogue-validate.yml @@ -25,7 +25,9 @@ jobs: - name: Build verifier run: | - git clone --depth 1 https://github.com/pilot-protocol/app-template /tmp/app-template + # Pin app-template to a released tag — this is a supply-chain trust gate, + # so the verifier it builds must not float on an unpinned upstream HEAD. + git clone --depth 1 --branch v0.1.0 https://github.com/pilot-protocol/app-template /tmp/app-template (cd /tmp/app-template && go build -o /tmp/pilot-app ./cmd/pilot-app) - name: Verify catalogue entries