From 0d47ae3a9f330ed6066d65f5d970c1b2ca2958e9 Mon Sep 17 00:00:00 2001
From: Cathryn Lavery <cathryn@bestself.co>
Date: Tue, 11 Aug 2026 21:25:22 -0700
Subject: [PATCH] fix(ci): harden validation and verify generated assets

---
 .github/workflows/ci.yml | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19030da..f73b626 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,14 +6,20 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Lint & Verify
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -21,14 +27,17 @@ jobs:
           python-version: "3.11"
 
       - name: Run skin linter
-        run: python scripts/lint-skin.py --all --baseline
+        run: python3 scripts/lint-skin.py --all --baseline
 
       - name: Verify sequence OAuth specs
-        run: python scripts/verify-sequence-oauth.py
+        run: python3 scripts/verify-sequence-oauth.py
 
       - name: Verify draw.io import script
-        run: python scripts/verify-drawio-import.py
-
-      - name: Verify icon build script
-        run: python scripts/build-icons.py
+        run: python3 scripts/verify-drawio-import.py
 
+      - name: Verify generated icon assets
+        run: |
+          python3 scripts/build-icons.py
+          git diff --ignore-space-at-eol --exit-code -- \
+            skills/diagram-design/assets/icons.html \
+            skills/diagram-design/references/primitive-icons.md