Repository navigation
Enforce explained security checks with reviewed evidence and CI gates - #1
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security operations previously had no enforced, explained evidence contract or persistent note at commit/push boundaries. Add nine canonical SEC areas, stage-bound report validation, safe append-only private notes, reviewed snapshot checks and project hooks. Missing/stale evidence blocks the stage.
CI verifies administrator-pinned policy/review bytes before executing project code. Supply-chain packaging/lifecycle use the same reviewed PR head, and release packaging/publication depend on security gates. Sanitized security notes are retained as narrowly selected artifacts, including their hidden .yam path.
Validation: independent runtime audit and doctor scan; security/integration/project snapshot smoke; real commit and push hooks; actionlint and action commit pins. Hosted Security check and the reusable security gate passed on commit 0ae317f. The retained artifact was downloaded and verified: nine explained SEC rows, PASS, exact head SHA and eleven actual snapshot checks. Supply-chain packaging and all three lifecycle jobs (Linux, macOS, Windows) passed. The downloaded exact tarball matches its recorded SHA256.
Rollout: main requires the GitHub Actions Security check plus code-owner approval. CODEOWNERS/workflows need to land on the base branch; a second authorized code owner is still required because the sole owner cannot approve their own PR. No bypass or automatic merge is enabled.
The operator will publish npm manually. This rollout never dispatches publication. Manual publication must first pass the deploy gate against the exact tarball/configuration and recent real environment inspection; direct npm clients remain outside repository-hook enforcement.