Skip to content
cis-controls

Workflows

  • Build and test (main.yaml) nobody has checked this yet, still a draft
    The Build and test workflow, .github/workflows/main.yaml: on a push to main and on every pull request, its test job runs just test on Python 3.10 to 3.14, and on 3.13 also just lint and just lokf-adapt-check, the check that .lokf/cis-controls.yaml is current.

  • Knowledge Librarian (knowledge-librarian.yaml) nobody has checked this yet, still a draft
    The Knowledge Librarian workflow, .github/workflows/knowledge-librarian.yaml: every Monday at 05:00 UTC and by hand, once KNOWLEDGE_LIBRARIAN_ENABLED is true, it runs an agent with the ktl-librarian skill (pinned by TRUST_LADDER_SKILLS_REF at v0.59.0) in a read-only job and opens a review pull request from a separate job that runs no agent.

  • Knowledge Registrar (knowledge-registrar.yaml) nobody has checked this yet, still a draft
    The Knowledge Registrar workflow, .github/workflows/knowledge-registrar.yaml: the gate on the knowledge bundle, run on pull requests that touch .lokf/ or knowledge_bundle/, every Monday at 06:00 UTC and by hand; it validates the bundle and its relation targets against the domain schema, runs the conventions script, and checks that each new confirmation by a person is backed by an approval or a signed commit.

  • Knowledge Release (knowledge-release.yaml) nobody has checked this yet, still a draft
    The Knowledge Release workflow, .github/workflows/knowledge-release.yaml: dispatched with a release’s tag, or started by a published release once KNOWLEDGE_RELEASE_ENABLED is true, it attaches the bundle zip, the domain schema as schema-<tag>-cis-controls.yaml with its checksum, and the Copilot skills to the release, when the bundle or the schema changed or force is set.

  • Knowledge sync (knowledge-sync.yaml) nobody has checked this yet, still a draft
    The Knowledge sync workflow, .github/workflows/knowledge-sync.yaml: every Monday at 04:10 UTC and by hand, it moves the sidecar’s copies and the skills pin to the newest Knowledge Trust Ladder release through one pull request, opened with the KNOWLEDGE_SYNC_TOKEN secret, and holds the workflow changes for a person to approve.

  • Knowledge website (knowledge-website.yaml) nobody has checked this yet, still a draft
    The Knowledge website workflow, .github/workflows/knowledge-website.yaml: on pushes and pull requests that touch the site’s sources, every Monday at 05:23 UTC and by hand, its build job builds website/ and checks its links read-only, and its deploy job publishes the default branch’s build to GitHub Pages once KNOWLEDGE_WEBSITE_ENABLED is true.

  • Lint & docs (lint-and-docs.yaml) nobody has checked this yet, still a draft
    The Lint & docs workflow, .github/workflows/lint-and-docs.yaml: on a push to main, every pull request, a Monday 06:00 UTC schedule and by hand, four jobs run ShellCheck, actionlint, the word budgets of CONTRIBUTING.md (1000) and SECURITY.md (900), and markdownlint, lychee and codespell over the Markdown.

  • Semantic release (semantic-release.yml) nobody has checked this yet, still a draft
    The Semantic release workflow, .github/workflows/semantic-release.yml: on a pull request into main, its plan job checks that the commits, the changelog and the title would release and previews the release; on a push to main, its release job in the release Environment tags vX.Y.Z, publishes the GitHub release and dispatches Knowledge Release.

  • Upstream watch (upstream-watch.yaml) nobody has checked this yet, still a draft
    The Upstream watch workflow, .github/workflows/upstream-watch.yaml: every Monday at 07:00 UTC and by hand, its cis-pages job runs scripts/check_upstream_release.py against CIS’s pages for the CIS Controls, and on a finding opens or updates the issue titled Upstream watch: the CIS Controls have changed.