PR 6/6: enforce least-privilege CI and release governance#37
Merged
Conversation
aksOps
force-pushed
the
codex/remediation-pr6
branch
from
5a1c0bb to
8473f7f
Compare
aksOps
force-pushed
the
codex/remediation-pr5
branch
from
64abecc to
3d14715
Compare
aksOps
force-pushed
the
codex/remediation-pr6
branch
from
8473f7f to
fb1b326
Compare
aksOps
force-pushed
the
codex/remediation-pr5
branch
from
12b2c6e to
fa6925e
Compare
aksOps
force-pushed
the
codex/remediation-pr6
branch
from
fb1b326 to
2f18f66
Compare
aksOps
force-pushed
the
codex/remediation-pr5
branch
from
fa6925e to
5b938d1
Compare
aksOps
force-pushed
the
codex/remediation-pr6
branch
from
2f18f66 to
5b94e78
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements remediation PR 6 code/workflow changes: five stable read-only checks, trusted-only Sonar, pinned actions, gated release verification, protected publish environment, tag ancestry verification, and documented default-yolo trust model. Also incorporates review fixes for hard PR-pass deadlines and final terminal-title sanitization.
Stack: 6 of 6; base is PR 5.
Final local gate: race coverage 88.6%; vet/staticcheck/lint/gosec clean; no reachable vulnerabilities under Go 1.25.12; Darwin amd64/arm64 compile; four release archives smoke-tested.
Repository settings will be applied only after these replacement checks are observed green, per the rollout plan.