ci(af01): add dependency and workflow security gates - #44

Merged

TheHalfMoon merged 30 commits into

mainfrom

feat/af01-stack-b-dependency-security

Aug 27, 2026

Commits on Aug 27, 2026

chore(af01): add deterministic dependency inventory
TheHalfMoon
committed
bcc807c
ci(af01): inspect exact dependency metadata
TheHalfMoon
committed
90705aa
fix(af01): restore pinned Rust toolchain ref
TheHalfMoon
committed
8a92a54
ci(af01): add dependency security evidence workflow
TheHalfMoon
committed
025e179
ci(af01): authorize security evidence workflow
TheHalfMoon
committed
6f0fa6f
docs(af01): record dependency policy intent
TheHalfMoon
committed
4322e99
ci(af01): define dependency trust policy
TheHalfMoon
committed
07a7000
ci(af01): enforce cargo-deny policy
TheHalfMoon
committed
288fa36
ci(af01): authorize cargo-deny job
TheHalfMoon
committed
e33e0f4
fix(af01): allow private workspace path edge
TheHalfMoon
committed
3dcef46
fix(af01): avoid Cargo token false positive
TheHalfMoon
committed
ce63625
ci(af01): add pinned cargo-audit gate
TheHalfMoon
committed
33f00f5
fix(af01): complete pinned cargo-audit gate
TheHalfMoon
committed
d3ad899
ci(af01): authorize cargo-audit job
TheHalfMoon
committed
a5b1f52
docs(af01): define security waiver requirements
TheHalfMoon
committed
5b764e9
ci(af01): add pinned zizmor gate
TheHalfMoon
committed
bfd4792
ci(af01): authorize zizmor job
TheHalfMoon
committed
e89928f
test(af01): lock Stack B security gate coverage
TheHalfMoon
committed
fc49c0c
fix(af01): harden Stack B scanner execution
TheHalfMoon
committed
66ba48f
fix(af01): bind Stack B evidence to exact source
TheHalfMoon
committed
7d4dcaa
docs(af01): record Stack B policy calibration
TheHalfMoon
committed
0667067
docs(af01): reconcile Stack A and Stack B task state
TheHalfMoon
committed
e8e71ac
fix(af01): preserve exact resolved dependency graph
TheHalfMoon
committed
7386ef1
test(af01): regress exact dependency inventory failures
TheHalfMoon
committed
55a0a1e
test(af01): wire dependency graph regressions
TheHalfMoon
committed
59df818
docs(af01): record resolved graph remediation
TheHalfMoon
committed
4562912
fix(af01): pin workspace path dependency
TheHalfMoon
committed
7086a1a
fix(af01): remove global path wildcard bypass
TheHalfMoon
committed
fde6f63
test(af01): lock path wildcard boundary
TheHalfMoon
committed
7604211
docs(af01): record wildcard boundary remediation
TheHalfMoon
committed
cc5607b

Navigation Menu

ci(af01): add dependency and workflow security gates - #44

ci(af01): add dependency and workflow security gates#44
TheHalfMoon merged 30 commits into
mainfrom
feat/af01-stack-b-dependency-security

Commits on Aug 27, 2026

chore(af01): add deterministic dependency inventory

ci(af01): inspect exact dependency metadata

fix(af01): restore pinned Rust toolchain ref

ci(af01): add dependency security evidence workflow

ci(af01): authorize security evidence workflow

docs(af01): record dependency policy intent

ci(af01): define dependency trust policy

ci(af01): enforce cargo-deny policy

ci(af01): authorize cargo-deny job

fix(af01): allow private workspace path edge

fix(af01): avoid Cargo token false positive

ci(af01): add pinned cargo-audit gate

fix(af01): complete pinned cargo-audit gate

ci(af01): authorize cargo-audit job

docs(af01): define security waiver requirements

ci(af01): add pinned zizmor gate

ci(af01): authorize zizmor job

test(af01): lock Stack B security gate coverage

fix(af01): harden Stack B scanner execution

fix(af01): bind Stack B evidence to exact source

docs(af01): record Stack B policy calibration

docs(af01): reconcile Stack A and Stack B task state

fix(af01): preserve exact resolved dependency graph

test(af01): regress exact dependency inventory failures

test(af01): wire dependency graph regressions

docs(af01): record resolved graph remediation

fix(af01): pin workspace path dependency

fix(af01): remove global path wildcard bypass

test(af01): lock path wildcard boundary

docs(af01): record wildcard boundary remediation