Lock reviewed CI and release dependencies #10

Closed

clawlter wants to merge 1 commit from audit/locked-ci-dependencies into main

pull from: audit/locked-ci-dependencies

merge into: clawlter:main

clawlter:main

Conversation 2 Commits 1 Files changed 9 +1585 -21

clawlter commented 2026-07-11 08:44:14 -04:00

Owner

Copy link

Summary

• update test constraint to pytest >=9.0.3,<10
• commit hash-checked runtime and development dependency locks
• make CI, release, and docs workflows install the reviewed locks; pin the smoke uv tool
• add structural lock/hash drift validation and document the regeneration/review process

Validation

• lock verification and hash-checked installation
• Ruff, mypy, pytest (36 passed; 99.10% coverage)
• strict MkDocs, no-isolation sdist/wheel, twine metadata, installed-wheel CLI smoke
• pip-audit --strict: no known vulnerabilities
• signed commit and git diff --check

Review and merge gate

Independent technical review completed for exact signed head 6a3ca5c8806ef8cbf0b2aa773a2cfa18f67d5175. Awaiting approval by a different Forgejo account before rebase/linear merge. No release, tag, or publish is requested.

## Summary - update test constraint to `pytest >=9.0.3,<10` - commit hash-checked runtime and development dependency locks - make CI, release, and docs workflows install the reviewed locks; pin the smoke `uv` tool - add structural lock/hash drift validation and document the regeneration/review process ## Validation - lock verification and hash-checked installation - Ruff, mypy, pytest (36 passed; 99.10% coverage) - strict MkDocs, no-isolation sdist/wheel, twine metadata, installed-wheel CLI smoke - `pip-audit --strict`: no known vulnerabilities - signed commit and `git diff --check` ## Review and merge gate Independent technical review completed for exact signed head `6a3ca5c8806ef8cbf0b2aa773a2cfa18f67d5175`. Awaiting approval by a different Forgejo account before rebase/linear merge. No release, tag, or publish is requested.

clawlter added 1 commit 2026-07-11 08:44:14 -04:00

ci: lock automation dependencies 6a3ca5c880

clawlter changed title from WIP: Lock reviewed CI and release dependencies to Lock reviewed CI and release dependencies 2026-07-11 09:28:43 -04:00

clawlter requested review from mehalter 2026-07-11 09:29:03 -04:00

mehalter approved these changes 2026-07-11 17:16:05 -04:00

clawlter force-pushed audit/locked-ci-dependencies from 6a3ca5c880 to 9123c7b357 2026-07-11 17:30:51 -04:00 Compare

clawlter commented 2026-07-14 08:15:08 -04:00

Author

Owner

Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.

clawlter closed this pull request 2026-07-14 08:15:08 -04:00

All checks were successful

Hide checks

CI / Validate lint, typing, tests, docs, and build (pull_request) Successful in 6m48s

Required

Details

Docs site / Validate docs build (pull_request) Successful in 1m46s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

mehalter

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawlter/policyglass!10

No description provided.