Repository navigation
Sync ess- items verbatim and add ess-scan hook - #143
Merged
Merged
Conversation
- Add ess-django-docs, ess-env-credentials, ess-gh-repo-mirror, ess-git-commits, ess-postgres-docs, and ess-shell-flags-literal. - Replace summarize-change-log with ess-summarize-change-log. - Replace pr-address-comments and pr-address-comments-all with ess-pr-address-comments, which handles one PR or many. - Add portable rules under instructions/ess/.
- Scanners and the verbatim copy share one file list from git ls-files, so ignore rules in parent directories count (a root-ignored .env is neither scanned nor copied). TruffleHog and secretlint get that list. - The PII check accepts subdomains of example.com, .net, and .org. - Add read-only `scan <path>...` and `status --source-repo --target-repo`. - Publish `scan` as the ess-scan pre-commit hook.
Domains are case-insensitive, so Alice.Smith@Example.COM is a placeholder too. Tests that check case handling no longer need to lowercase their domains.
IANA reserves example.edu for documentation alongside example.com, .net, and .org, so the PII scanner now allows it too. Registrable lookalikes such as example.io are still flagged.
secretlint ran from the tool directory and rejected every path outside it with exit 2, which the scanner read as no findings, so it never scanned another repo. It now runs in the scanned directory on relative paths, and any exit code other than 0 or 1 is reported as a scanner error.
A root package.json lets the ess-scan hook use pre-commit's node language. It carries only the scanners' dependencies, so the hook no longer installs @cursor/sdk, and a scan-only entry point replaces the shell launcher that built the whole tool on first run.
Every ess- item now matches its source repo byte for byte, and essentials-sync status reports 30 of 30 identical in both directions. - Add ess-load-test, the ess-cli-write-safety and ess-docs-example-urls instructions, and the ess-gh-copilot-review and ess-my-groups skills. - Rename git-tidy, mcp-hide-secrets, and pr-review to their ess- names. - Update ess-auth, ess-browser, ess-langsmith-client, ess-outlook, ess-passwords, ess-service-now-incident, ess-messages, ess-hello-jwt-auth-code, and ess-summarize-change-log. ess-browser no longer ships company IdP defaults. - Replace the cli-write-safety rule with ess-cli-write-safety and register ess-load-test in the uv workspace.
keys create now confirms before creating a key, offers --dry-run, and takes --yes, which --format json and non-interactive runs require. ess-auth comments now state the general failure mode instead of a specific incident.
v0.8.6 formats asserts differently from v0.15.6, so files synced from a repo on the newer version were reformatted on push. The ruff hook id is now ruff-check.
Long strings are wrapped, and the remaining ruff waivers are noqa comments in the files rather than per-file ignores in a root config, so the package lints the same wherever it is copied.
The JSON report embeds each file's source, and secretlint exited before a report over 64 KiB had drained from the stdout pipe on macOS. The cut-off JSON failed to parse and was read as a clean scan. The report is now written with --output and read from a file, and an unparseable report is an error.
secretlint's basic-auth rule flagged the user:password URL that the _safe_origin test strips. The credentials are fake, so the line carries a secretlint-disable-next-line directive.
Internal team, platform, and tool names that a source repo kept in its own override file are now built in, so a source repo needs no override file to keep them out of synced items.
status already skipped each item's LICENSE, since the open-source copy carries the license text and a source repo may not. Sync copied it anyway, so a sync from this repo would add LICENSE files to the source. Both now share REPO_OWNED_ITEM_FILES.
Each ess- skill states its license in SKILL.md frontmatter as well as carrying the LICENSE file, so the source copies, which have no LICENSE, still name it.
Names under .example, .invalid, and .test are reserved and never resolve, so they are as safe for placeholder emails as the example.* documentation domains. A reserved name must still end the address, so x@test.com is flagged.
Names under .example, .invalid, and .test are reserved by RFC 2606 and never resolve, so they are as safe for placeholders as the example.* domains. .invalid suits a value that must never resolve, such as a throwaway git identity.
Every ess- Python package now declares license = "Apache-2.0", as ess-langsmith-client already did, and requires hatchling>=1.27, which reads the SPDX expression (PEP 639).
Each Python package and tool, docs-docusaurus, and essentials-sync now carries the Apache-2.0 LICENSE, so a built wheel or npm package includes the text, as the JavaScript packages already did. The non-ess Python projects also declare license = "Apache-2.0" and require hatchling>=1.27.
Every default jargon pattern now reports "References company systems." instead of a sentence describing each internal system, so the published source no longer explains what each term is. Findings still name the matched term. The compound org term is dropped because its two parts already match.
mattnorris
added a commit
that referenced
this pull request
Nov 3, 2026
- **feat(ess-sync): scan files git would ship** — Scanners and the verbatim copy share one git ls-files list, so a root-ignored file is neither scanned nor copied. secretlint runs in the scan root and its report is read from a file, and any exit other than 0 or 1 is a scanner error. scan is the ess-scan pre-commit hook, installed from a root package.json that carries only scanner dependencies. - **feat(ess-sync): allow safe placeholder emails** — The PII check accepts example.com, .net, .org, and .edu in any case, plus names that end in .example, .invalid, or .test. Built-in jargon covers internal names with one message, so a source repo needs no override file, and the docs allow those reserved names in examples. - **feat(ess): sync items byte for byte** — Every ess- item matches its source, including renamed ess- skills and new instructions, and status reports them identical both ways. Sync skips each item's LICENSE, ruff is pinned to v0.15.6 with hook id ruff-check, and lint waivers stay in the files so a push does not reformat synced source. - **build(ess): ship Apache-2.0 license text** — Python packages and tools declare license = "Apache-2.0" and require hatchling>=1.27, and each package carries the LICENSE so wheels and npm packages include it. ess- skills name Apache-2.0 in SKILL.md frontmatter. - **feat(cli): confirm before creating keys** — keys create confirms before creating a key, offers --dry-run, and requires --yes for JSON output and non-interactive runs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ess-skill, instruction, and package byte for byte from the source repo. This addsess-load-testto the uv workspace, replacesskills/ess/{git-tidy,mcp-hide-secrets,pr-review}with theiress-versions, and renames the write-safety rule toess-cli-write-safety.mdc.ess-scanpre-commit hook (rootpackage.json,src/ess-scan.ts) that runs the deterministic scanners on changedess-*items, so a source repo can block secrets, jargon, and PII before it syncs.essentials-sync scanpassed without scanning:--outputand read from a file, and an unparseable report is an error.essentials-sync statuscompares only the files git would ship, and the PII scanner accepts emails on example.com, example.net, example.org, and example.edu, or under the reserved.example,.invalid, and.testTLDs, in any case. Look-alikes such asx@test.comare still flagged.status, which already skipped it. The open-source copies keep their LICENSE, and a source repo can go without one. Eachess-skill also declareslicense: Apache-2.0in itsSKILL.mdfrontmatter, which syncs verbatim.license = "Apache-2.0"(withhatchling>=1.27) and ships a LICENSE, which its wheel bundles.docs-docusaurusandessentials-syncgain the LICENSE their npm packages lacked.ess-langsmith-client:keys createandkeys deletegain--dry-run, prompt on stderr by default, and require--yesfor JSON or non-interactive writes.ruff-check) so synced files are not reformatted on push.Test plan
essentials-sync statusagainst the source repo: 30 of 30 items identical. A reverse dry-run from this repo changes no files.npm testintools/typescript/essentials-syncpasses.pytestpasses for eachess-package and the skill scripts.pre-commit run --hook-stage pre-push --from-ref origin/main --to-ref HEADpasses.pre-commit try-repowithess-scan: passes on clean files, and fails on planted jargon, a non-example email, a GitHub token, and a private key.