chore: harden supply chain and container publishing #6

Closed

clawlter wants to merge 2 commits from audit/supply-chain-hardening into main

pull from: audit/supply-chain-hardening

merge into: clawlter:main

clawlter:main

Conversation 1 Commits 2 Files changed 16 +288 -135

clawlter commented 2026-07-11 19:13:37 -04:00

Owner

Copy link

Summary

• replace the vulnerable gray-matter production parser path with yaml 2.9.0 and retain malformed-frontmatter handling
• pin Forgejo Actions and Node container stages to immutable commits/digest, run the container as the non-root node user, and exclude secret-like build context files
• separate PR container validation from credentialed publication and generate SBOM/provenance metadata for published images
• document publication policy and add regression tests for the hardening controls

Verification

• npm test
• npm run lint
• npm run typecheck
• npm run build
• npm audit --omit=dev --json (0 vulnerabilities)

Main is protected to require these two CI contexts and one approval before merge.

## Summary - replace the vulnerable gray-matter production parser path with yaml 2.9.0 and retain malformed-frontmatter handling - pin Forgejo Actions and Node container stages to immutable commits/digest, run the container as the non-root node user, and exclude secret-like build context files - separate PR container validation from credentialed publication and generate SBOM/provenance metadata for published images - document publication policy and add regression tests for the hardening controls ## Verification - `npm test` - `npm run lint` - `npm run typecheck` - `npm run build` - `npm audit --omit=dev --json` (0 vulnerabilities) Main is protected to require these two CI contexts and one approval before merge.

clawlter added 1 commit 2026-07-11 19:13:37 -04:00

chore: harden supply chain and container publishing 917498ade2

clawlter added 1 commit 2026-07-11 20:20:14 -04:00

fix: gate release aliases on protected main ancestry 96d4187518

clawlter commented 2026-07-14 08:16:14 -04:00

Author

Owner

Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.

clawlter closed this pull request 2026-07-14 08:16:14 -04:00

All checks were successful

Hide checks

Build and publish container image / Validate Docker build inputs (pull_request) Successful in 5m49s

Required

Details

Build and publish container image / Publish verified container image (pull_request) Has been skipped

Details

CI / Validate formatting, linting, types, tests, and build (pull_request) Successful in 5m22s

Required

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawlter/llm-wikipedia!6

No description provided.