security-allowlist.yml

# Security audit allowlist.
# Each entry explicitly permits a specific audit finding for a specific
# release artifact.  Exceptions must be narrowly scoped.
#
# Required fields:
#   repository   - "owner/repo" (lowercase GitHub repo path)
#   release      - exact version string matching the catalog entry
#   artifact_sha256 - exact lowercase SHA-256 of the release ZIP for every rule
#                 named in security-policy.yml blockable_rules. Non-blockable
#                 rules may use "any" only with every other exact scope below.
#   rule         - exact rule_id being allowlisted (no wildcards)
#   reason       - human-readable explanation
#   approved_by  - GitHub username of the reviewer who approved this entry
#   expires      - ISO 8601 date after which the entry is no longer valid
#
# Prohibited: no blockable rule may use a missing, "any", malformed, uppercase,
# or non-matching artifact hash. The requirement follows the live policy set.
# No global "ignore all" switch exists.
version: "1"

exceptions: []

# Example entry (commented out):
# exceptions:
#   - repository: owner/example-plugin
#     release: "1.2.3"
#     artifact_sha256: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"
#     rule: ROOT_ACCESS
#     reason: >
#       Hardware-control plugin requires a documented privileged helper binary
#       to access GPU registers.  The binary is audited separately.
#     approved_by: zany130
#     expires: "2026-12-31"
# test comment
# test comment
# test comment
# temporary comment