fix(ci): make the lint gate read-only

.dagger/pyproject.toml

@@ -64,7 +64,7 @@ branch = true
 omit = ["src/ci/fleet_cli.py"]
 
 [tool.poe.tasks]
-lint = { shell = "ruff check --fix src tests && ruff format src tests" }
+lint = { shell = "ruff check src tests && ruff format --check src tests" }
 typecheck = "mypy --strict src tests"
 complexity = "xenon --max-absolute A --max-modules A --max-average A src"
 test = "pytest tests --cov=ci --cov-branch --cov-fail-under=90"

CHANGELOG.md

@@ -4,6 +4,10 @@
 
 ### Fixed
 
+- `poe lint` is now read-only. It ran `ruff check --fix` and `ruff format` in place, so
+  `dagger call ci` could rewrite a dirty tree and still exit 0; the gate now runs
+  `ruff check` and `ruff format --check`, matching the three module gates. A formatting
+  regression fails the gate instead of being silently repaired inside the container.
 - The image mirror now publishes to `ghcr.io/gainratio/mirror/...`. Since the org move, ci's
   `GITHUB_TOKEN` cannot create packages under the `hseshadr` user account
   (`DENIED: The requested installation does not exist`, run 37993357418, 12/16 proven).

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+`gainratio/ci` is the shared CI control plane for the public `gainratio` repositories. It
+holds no application data, but it does read repository state with a GitHub token, builds
+artifacts, and pushes OCI images to GHCR. A bypass of its source guard, secret scan, or
+release-lineage checks affects every consumer.
+
+## Reporting a vulnerability
+
+Please do not open a public issue, pull request, or discussion for a security
+vulnerability. Report it privately to:
+
+> **harish.seshadri@gmail.com**
+
+Include the affected workflow or module, the commit, the impact on a consumer repository,
+and a minimal reproduction if you have one. You can expect an acknowledgement within a few
+days.
+
+## Scope
+
+In scope:
+
+- A way to make `guard` accept a workspace that is not the claimed commit, or to make the
+  generated envelope describe different bytes than the artifact.
+- A way to make the full-history secret scan miss a credential, or to make a canary pass
+  without being detected.
+- A way to make `fleet` report green for a repository that is not green, or to skip a
+  repository that pins a module from here.
+- A workflow injection, expression injection, or permission escalation in
+  `.github/workflows/`.
+
+Out of scope: findings in a consumer repository's own code (report those to that
+repository), and the design choice that consumers pin this repository at a commit SHA.
+
+## Supported versions
+
+Consumers pin an exact commit; fixes land on `main` and consumers upgrade by changing the
+pin. There is no supported-version table because there are no floating releases.