dev-rig¶

Shared Python CI workflows, pre-commit config, and audit harness for LegionForge projects.

What it does¶

dev-rig is the shared CI/CD substrate used across LegionForge repos. It provides:

Reusable GitHub Actions workflows — lint, test, SAST, dependency audit, secrets scan, SBOM generation, container scan (Trivy), and dynamic app scan (DAST), each with Python and Node/TypeScript variants, plus a growing set of Rust workflows (lint, test, audit, SBOM)
Pre-commit configuration — individual hooks for ruff, ruff-format, bandit, and mypy
Audit harness — Python checks when applicable, OSV Scanner, gitleaks, ShellCheck, Semgrep packs, and LegionForge risky-exec rules

The goal is that every project under the LegionForge org has a clear security/quality baseline without copy-pasting workflow files between repos.

Status¶

Active. Public. Internal tooling — most useful if you're contributing to a LegionForge project or want to use the same baseline in your own.

Using it in a LegionForge project¶

In a project repo's .github/workflows/ci.yml:

name: CI

on:
  pull_request:
  push:
    branches: [main]

jobs:
  lint:
    uses: LegionForge/dev-rig/.github/workflows/lint.yml@main

  test:
    uses: LegionForge/dev-rig/.github/workflows/test.yml@main
    with:
      python-version: "3.11"

  sast:
    uses: LegionForge/dev-rig/.github/workflows/sast.yml@main

  audit:
    uses: LegionForge/dev-rig/.github/workflows/audit.yml@main

  secrets:
    uses: LegionForge/dev-rig/.github/workflows/secrets.yml@main

  sbom:
    uses: LegionForge/dev-rig/.github/workflows/sbom.yml@main

That's the entire CI config for a Python project — every workflow is sourced from dev-rig. Updating dev-rig updates the CI across all projects that reference @main.

Local audit¶

Run the local harness against any repo:

LegionForge-dev-rig/scripts/audit.sh /path/to/repo

The harness is intentionally repo-shape aware:

Python checks run only when Python files or dependency manifests exist.
Static repos still receive applicable checks: OSV Scanner, gitleaks working-tree/history scans, ShellCheck when shell scripts exist, Semgrep packs when Docker is available, and the LegionForge risky-exec rules.
A skipped tool is not automatically a failure. It means the tool was not applicable or not available in the current environment.

The current coverage map lives in Security → Project security inventory.

Pre-commit¶

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/LegionForge/dev-rig
    rev: v0.1.0
    hooks:
      - id: ruff
      - id: ruff-format
      - id: bandit
      - id: mypy

Each hook is pinned to a tag, not main, so projects only adopt new rules deliberately.

When to use it outside LegionForge¶

If you maintain multiple Python repos and want a consistent security baseline, dev-rig is a good template. The workflows are MIT-licensed and the configuration is intentionally vanilla — they don't assume LegionForge-specific structure.