Repository navigation
Require PR security scans and full dependency auditing - #3
Open
dotmantissa wants to merge 2 commits into
Open
dotmantissa wants to merge 2 commits into
dotmantissa wants to merge 2 commits into
Conversation
dotmantissa
enabled auto-merge
November 3, 2026 17:21
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR validation lacked mandatory static analysis and excluded build/development dependencies from advisory checks. Require strict pinned Semgrep scanning, parsed workflow privilege/secret policy tests, full JS auditing and weekly validation. Expand sensitive source/test/configuration CODEOWNERS and npm/pip Dependabot updates. Production remains gated behind CI on trusted main events.
Vendor licensed security rules with immutable commit/per-file hashes and prove the real analyzer rejects SQL/eval injections. The pinned analyzer cannot parse the SDK's type-namespace barrel: validate that index.ts contains only local SDK re-exports before excluding that file. Executable or external/parent-path additions fail closed; SDK source and archive provenance remain unchanged. CI_SECURITY.md records scope and maintenance.
Validation: full audit reports no known vulnerabilities; build and all type checks, eight API units, 38 SDK tests, 18 actual PostgreSQL integration tests, deployment-record checks, ten release-policy tests, strict SAST, Gitleaks, Actionlint and immutable sibling/SDK/WASM compatibility pass locally. Protected main still requires an independent code-owner approval.