clawlter/policyglass
Watch
1
0
Fork
You've already forked policyglass
 0
Code Issues Pull requests Projects Releases 1 Packages 1 Activity Actions

WIP: fix(ci): pin Forgejo Actions to immutable revisions #8

Closed
clawlter wants to merge 2 commits from audit/pin-forgejo-actions into main
pull from: audit/pin-forgejo-actions
merge into: clawlter:main
Conversation 1 Commits 2 Files changed 6 +153 -9
clawlter commented 2026-07-11 07:34:19 -04:00
Owner
Copy link

Summary

  • replace every external Forgejo Action tag/branch reference with a reviewed 40-character commit SHA
  • document provenance and a reviewer update procedure
  • add a behavior-focused policy probe that rejects mutable external Action refs

Verification

  • pytest -q (38 passed; 99.10% coverage)
  • ruff check ., ruff format --check ., and mypy src
  • policyglass check . --policy policies/repository.yml
  • YAML parsing for all Forgejo workflows; mkdocs build --strict
  • uv build, twine check dist/*, and isolated wheel smoke test

No tokens were changed or exposed. PACKAGE_TOKEN remains release-only; docs deployment retains its job token only.

## Summary - replace every external Forgejo Action tag/branch reference with a reviewed 40-character commit SHA - document provenance and a reviewer update procedure - add a behavior-focused policy probe that rejects mutable external Action refs ## Verification - `pytest -q` (38 passed; 99.10% coverage) - `ruff check .`, `ruff format --check .`, and `mypy src` - `policyglass check . --policy policies/repository.yml` - YAML parsing for all Forgejo workflows; `mkdocs build --strict` - `uv build`, `twine check dist/*`, and isolated wheel smoke test No tokens were changed or exposed. `PACKAGE_TOKEN` remains release-only; docs deployment retains its job token only.
fix(ci): pin Forgejo Actions to immutable revisions
All checks were successful
CI / Validate lint, typing, tests, docs, and build (pull_request) Successful in 8m54s
Details
Docs site / Validate docs build (pull_request) Successful in 1m40s
Details
259f156887
clawlter changed title from fix(ci): pin Forgejo Actions to immutable revisions to WIP: fix(ci): pin Forgejo Actions to immutable revisions 2026-07-11 07:35:31 -04:00
test(ci): cover Forgejo YAML workflow action pins
All checks were successful
CI / Validate lint, typing, tests, docs, and build (pull_request) Successful in 2m48s
Details
Docs site / Validate docs build (pull_request) Successful in 1m38s
Details
5c2c7ed703
clawlter commented 2026-07-14 08:15:10 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:15:10 -04:00
All checks were successful
CI / Validate lint, typing, tests, docs, and build (pull_request) Successful in 2m48s
Required
Details
Docs site / Validate docs build (pull_request) Successful in 1m38s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/policyglass!8
No description provided.