Repository navigation

fix(ci): unmask security scans and verify every download - #148

Merged

github-actions[bot] merged 17 commits into

mainfrom

fix/ci-scan-masks

Oct 27, 2026

Merged

fix(ci): unmask security scans and verify every download#148
github-actions[bot] merged 17 commits into
mainfrom
fix/ci-scan-masks

Commits on Oct 27, 2026
- docs(plan): add CI and release hardening spec and plan
  
  brujack
  and
  claude
  committed
  589439e
- test(ci): allow-list every continue-on-error site
  
  brujack
  and
  claude
  committed
  cc59295
- fix(ci): unmask gitleaks and Snyk, exclude Snyk false positives
  
  brujack
  and
  claude
  committed
  8fab7ff
- fix(test): reset site key at each step and job
  
  brujack
  and
  claude
  committed
  f6f43b1
- test(ci): require pinned, checksummed downloads
  
  brujack
  and
  claude
  committed
  6305850
- fix(ci): pin and checksum gitleaks, Snyk and mdbook
  
  brujack
  and
  claude
  committed
  3663cbe
- fix(test): close allow-list scanner bypasses
  
  brujack
  and
  claude
  committed
  2e5e434
- docs: record unmasked scans and pinned downloads
  
  brujack
  and
  claude
  committed
  9f455a5
- fix(security): drop env overrides from workflow tests
  
  brujack
  and
  claude
  committed
  77b54f6
- fix(review): close download scanner bypasses
  
  brujack
  and
  claude
  committed
  9e658f8
- docs(test): match allow-list docstrings to behaviour
  
  brujack
  and
  claude
  committed
  187a285
- fix(review): reject comment checksums, match ./ paths
  
  brujack
  and
  claude
  committed
  5565707
- test(ci): cover comment lines mentioning curl
  
  brujack
  and
  claude
  committed
  8873501
- test(ci): cover empty inputs for workflow scanners
  
  brujack
  and
  claude
  committed
  8d577e3
- fix(maintainability): split check_block below C901 10
  
  brujack
  and
  claude
  committed
  f2ade98
- docs(test): list the https rule in download scanner docstring
  
  brujack
  and
  claude
  committed
  628427c
- docs(spec): spec alignment verdict 2026-10-27
  
  brujack
  and
  claude
  committed
  c761064

Commits

Commits on Oct 27, 2026