Repository navigation
Agent/issue 6 - #20
Merged
Merged
Conversation
…terfaces Add proto/touchstone/v1/scan.proto matching the design's Contracts section verbatim, plus buf.yaml/buf.gen.yaml wiring buf generate to produce the Go, TypeScript (protobuf-es), OpenAPI and JSON Schema outputs it names. Add the fetch.Fetcher, vuln.Source, vuln.Enricher, repo.Forge and pipeline.EvidenceSource interfaces with in-memory fakes and unit tests, so later slices can be written and tested against stable seams. This sandbox has no go/node/buf/protoc toolchain and no way to install one (no sudo, outbound installs beyond git are blocked), so `buf generate` could not actually be run here: gen/, web/src/gen/, openapi/ and schema/ are intentionally left uncommitted rather than hand-faking generated output. The stub ScanService and `touchstone scan` CLI from the issue's AC depend on those generated types and are left for a follow-up with the real toolchain. Tests could not be run locally for the same reason. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…, CI gates Commit the buf-generated Go, TypeScript (protobuf-es, now target=ts with include_imports so google/api annotations resolve), OpenAPI and JSON Schema outputs, with schema/scan-report.v1.json as the published ScanReport schema. buf.gen.yaml uses clean: true and buf.lock pins googleapis, so `make generate` is reproducible and CI fails on a regeneration diff. Add internal/service.Stub, a ScanService returning a canned report, and cmd/touchstone `scan <url>` printing it as protojson. The CLI test validates the output against the generated JSON Schema and checks it against testdata/report.golden.json, which web/src/report.test.ts decodes with fromJson(ScanReportSchema, ...) so Go/TS drift fails a test. CI (.github/workflows/ci.yml) runs go vet, staticcheck, go test, buf lint, buf breaking (skipped while main has no buf module), the generated-code check, tsc --noEmit and vitest run. Closes #6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6.
S0: contract first.
scan.protoand the buf wiring, generated Go / TS / OpenAPI / JSON Schema outputs, a stubScanServicethat returns a canned report, thetouchstone scan <url>CLI, and the CI workflow.Produced by the coding agent on a member's box, then landed by hand: the commits were re-authored to a GitHub noreply identity, and the workflow file is here because the platform never publishes
.githubpaths.Not yet verified: GitHub Actions has never run on this. This PR is its first run.
Known follow-up: no
package-lock.jsonis committed, so CI usesnpm install --no-package-lock. Commit a lockfile and switch tonpm ci.