Install GuardSpine CodeGuard

[m1el]

GuardSpine CodeGuard

This PR installs the GuardSpine CodeGuard governance workflow for this repository.

What it does

Every pull request will be automatically analyzed for:

• Security Baseline: OWASP top 10, dependency vulnerabilities, hardcoded secrets
• PII Shield: PII detection, secret scanning, entropy analysis

Files added

• .github/workflows/codeguard.yml -- GitHub Action that runs on every PR
• .guardspine/config.yml -- Configuration for rubric packs and evidence

Setup required

1. Add GUARDSPINE_API_KEY as a repository secret
2. Merge this PR
3. Open a new PR to see CodeGuard in action

Links

• Project Dashboard
• GuardSpine Documentation

---

Generated by GuardSpine onboarding

[github-actions]

[XX] GuardSpine: BLOCKED - Cannot merge

Policy: standard | Findings: 5

Hard Blocks (provable failures)

• CRITICAL [crypto] (.guardspine/config.yml:14): Sensitive crypto code modified

Reviewer Action Required (max 2)

1. HIGH [auth] (.github/workflows/codeguard.yml:23): Sensitive auth code modified

   Review sensitive-auth

2. HIGH [auth] (.github/workflows/codeguard.yml:24): Sensitive auth code modified

   Review sensitive-auth

Advisory (2 items)

• [medium] Sensitive config code modified
• [high] Sensitive security code modified

---

GuardSpine Decision Engine | Removing reviewer decisions, not just effort