Skip to content

ci(org): add reusable security and artifact-evidence baseline - #1

Open
coinsecuritiescompany wants to merge 1 commit into
mainfrom
ci/reusable-security-baseline
Open

ci(org): add reusable security and artifact-evidence baseline#1
coinsecuritiescompany wants to merge 1 commit into
mainfrom
ci/reusable-security-baseline

Conversation

@coinsecuritiescompany

Copy link
Copy Markdown

Scope: Section G — org-wide reusable CI proposal

Adds a reusable workflow for AiFinPay repositories:

  • full-history gitleaks scan
  • generic OSV source scan with high/critical gate
  • optional SHA-256 artifact evidence output/upload

This is a proposal PR, not an assertion that all repos use it yet. Individual repositories must adopt it through their own reviewed workflow PRs.

Evidence limitation

Do not extrapolate this to “all 37 repos have a clean history scan”. That claim remains unverified until every relevant repo actually invokes/passes the workflow with full history.

No production deployment, keys, governance or payment activation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant