This policy covers the build pipeline scripts in this repository (build.sh, test.sh, Containerfile, CI workflows, and related automation).

Neovim itself is an upstream project with its own security reporting process at https://github.com/neovim/neovim/security.

The latest release is the only supported version. Older releases are not backported — upgrade to the latest to receive fixes.

If you discover a security issue in the pipeline or generated artifacts, please report it via GitHub's private vulnerability reporting:

1. Go to https://github.com/CodeSigils/neovim-latest-ubuntu/security
2. Click "Report a vulnerability"
3. Provide a description, steps to reproduce, and impact

Reports are acknowledged within 72 hours. You should receive a timeline for review within 5 business days.

All .deb artifacts are built inside a containerised, pinned build environment:

• Pinned base image — Containerfile uses a specific Ubuntu LTS image pinned via SHA256 digest, with repo-level variables able to override UBUNTU_VERSION, UBUNTU_CODENAME, and UBUNTU_SHA256 in CI. This pins the base image; apt-installed packages are still resolved from Ubuntu repositories at image-build time.
• Parameterised base image — UBUNTU_VERSION, UBUNTU_CODENAME, and UBUNTU_SHA256 are governed by repo-level variables in CI, with public hardcoded fallbacks for fork compatibility.
• Container isolation — compilation and packaging run inside docker build then docker run. The host runner never executes untrusted code directly.
• Verification inside the container — test.sh runs inside the same container that built the .deb, ensuring runtime library versions match the build environment. The 7-check test suite covers install, version match, smoke test, runtime health, library dependencies, update-alternatives registration, and clean uninstall.
• Integrity attestation — every release publishes SHA256SUMS alongside the .deb. Build provenance is attested via actions/attest (Sigstore-backed OIDC).
• Non-blocking lintian audit — Debian package policy checks run on every build. Findings are logged but do not block the build (this is a CPack convenience package, not a Debian archive submission).

• No apt repository mixing — this project does not instruct users to add third-party apt sources, PPAs, or Debian Sid repositories to their system. The .deb is downloaded over HTTPS and installed via dpkg -i.
• Single self-contained package — LuaJIT, libuv, tree-sitter and other bundled dependencies are statically linked at build time. No runtime dependency on external library packages beyond standard glibc/libgcc.
• No distro interference — the package uses the name neovim (matching Ubuntu's archive package) so apt-mark can hold/pin it cleanly. It does not overwrite or shadow system files outside Neovim's installation path.
• Tagged releases only — GitHub Releases are created exclusively from pushed tags matching v*. Branch pushes, schedule triggers, and manual dispatch produce workflow artifacts only (no Release page). Tags are immutable once published.
• HTTPS-only distribution — all artifacts are served via TLS from GitHub Releases or Actions artifacts. There is no plain-HTTP mirror, no PPA, no custom repository endpoint.
• Fork compatibility — all CI expressions have hardcoded fallbacks so forks work without configuring repo-level variables. No secrets or privileged credentials are baked into the pipeline.

The full build pipeline is defined in this repository and readable by anyone:

• build.sh — parameterised build script
• Containerfile — reproducible build environment
• test.sh — 7-check verification
• .github/workflows/build.yml — CI/CD orchestration

Build dependencies (CMake, Ninja, gettext, curl, git, GCC) are installed from the configured Ubuntu LTS apt repositories inside the pinned base image — not downloaded from ad-hoc sources. Neovim source is cloned from the official GitHub repository at a specific tag or master branch.