Add the seven OpenClaw findings from the AI SAST campaign #11

	name: Validate records

	# Regeneration only happens on main, so nothing used to check a record before
	# merge. An invalid record merged to main fails build.yml at Test or Generate,
	# which means the README is never rewritten and _site is never uploaded: the
	# public site keeps serving stale content while main already holds new data.
	# This job moves that failure to the pull request, where it costs nothing.

	on:
	pull_request:

	permissions:
	contents: read

	concurrency:
	group: validate-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	validate:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.13'
	cache: pip
	- run: pip install -r requirements.txt
	- name: Test
	run: python -m pytest -q
	# Plain generation, deliberately not --check: a PR that adds a finding
	# legitimately changes the README, so --check would fail by design and
	# every such PR would arrive red.
	- name: Validate generation
	run: python -m tools.generate --root . --out "$RUNNER_TEMP/site"

Navigation Menu