Skip to content
attack

Workflows

  • Build and test (main.yaml) nobody has checked this yet, still a draft
    The Build and test workflow, .github/workflows/main.yaml: on a push to main and on every pull request, its test job runs just test on Python 3.10 to 3.14, and on 3.13 also just lint and just lokf-adapt-check; its attack-data job fetches the pinned bundles and validates every object.

  • Knowledge Librarian (knowledge-librarian.yaml) nobody has checked this yet, still a draft
    The Knowledge Librarian workflow, .github/workflows/knowledge-librarian.yaml: on Mondays it runs the ktl-librarian skill, pinned to v0.59.0, in a job with no write token, and a separate job opens a pull request with the patch; inert until KNOWLEDGE_LIBRARIAN_ENABLED is true.

  • Knowledge Registrar (knowledge-registrar.yaml) nobody has checked this yet, still a draft
    The Knowledge Registrar workflow, .github/workflows/knowledge-registrar.yaml: on a pull request that touches .lokf/ and on Mondays it validates the bundle with lokf validate --check-refs and the conventions script, and checks that each person’s confirmation is backed by a review or a signed commit.

  • Knowledge Release (knowledge-release.yaml) nobody has checked this yet, still a draft
    The Knowledge Release workflow, .github/workflows/knowledge-release.yaml: on a published release, once KNOWLEDGE_RELEASE_ENABLED is true, or by hand, it attaches the bundle zip, the Copilot skill zip and the domain schema as schema-<tag>-attack.yaml, each with its .sha256 and an attestation.

  • Knowledge sync (knowledge-sync.yaml) nobody has checked this yet, still a draft
    The Knowledge sync workflow, .github/workflows/knowledge-sync.yaml: on Mondays it compares the skills pin with the newest Knowledge Trust Ladder release and, when the pin is behind, opens one pull request that copies the release’s templates and moves the pin.

  • Knowledge website (knowledge-website.yaml) nobody has checked this yet, still a draft
    The Knowledge website workflow, .github/workflows/knowledge-website.yaml: it builds the site in website/ on a push to main, on a pull request that touches its inputs, and on Mondays, and deploys it to GitHub Pages once KNOWLEDGE_WEBSITE_ENABLED is true.

  • Lint and docs (lint-and-docs.yaml) nobody has checked this yet, still a draft
    The Lint & docs workflow, .github/workflows/lint-and-docs.yaml: on a push to main, on every pull request and on Mondays, it runs ShellCheck, actionlint, the word budgets of CONTRIBUTING.md (1000) and SECURITY.md (900), markdownlint, the lychee link check and codespell.

  • Semantic release (semantic-release.yml) nobody has checked this yet, still a draft
    The Semantic release workflow, .github/workflows/semantic-release.yml: on a pull request its plan job previews the release and checks the title, the changelog and the baseline tag; on a push to main its release job, in the release Environment, releases and dispatches the knowledge release.

  • Upstream watch (upstream-watch.yaml) nobody has checked this yet, still a draft
    The Upstream watch workflow, .github/workflows/upstream-watch.yaml: every Monday it runs scripts/check_upstream_release.py against MITRE’s attack-stix-data and attack-data-model repositories and opens or updates the issue “Upstream watch: MITRE ATT&CK has changed” when the check fails.