chore(security): automated monthly SBOM & VEX report - #199

Open

Gustavohsdp wants to merge 8 commits into

developmentfrom

chore/security-monthly

Commits on Jul 27, 2026

chore(security): automated monthly SBOM & VEX report

Gustavohsdp
and
claude
committed
a51a3f3

Commits on Jul 31, 2026

ci(security): PR gate v2 (reads-only + sticky comment) + archive on merge

Gustavohsdp
and
claude
committed
ce2204f

Commits on Aug 4, 2026

fix(security): address PR review — close 6 gate/report bugs

Gustavohsdp
and
claude
committed
972213c
fix(security): 2nd review pass + drop AI triage on this public repo

Gustavohsdp
and
claude
committed
c9bed1b
fix(security): report from live scan + archive to orphan branch + PR-token fallback (public: no AI)

Gustavohsdp
and
claude
committed
13e3cfd
docs(security): report methodology says OSV/osv-scanner, not npm audit

Gustavohsdp
and
claude
committed
d049c80

Commits on Aug 6, 2026

fix(security): no false attestation, live register count, gate runs from base

Gustavohsdp
and
claude
committed
5e5a053
fix(security): dedupe PYSEC/GHSA groups in the gate (ci-sync with #158)

Gustavohsdp
and
claude
committed
7854d40