Repository navigation
Audit readiness: SECURITY.md, AUDIT_SCOPE.md, CI hygiene (draft) - #121
Draft
aien-spark wants to merge 2 commits into
Draft
aien-spark wants to merge 2 commits into
aien-spark wants to merge 2 commits into
Conversation
…ecurity policy with private reporting and response targets, audit scope for outside reviewers, Dependabot configuration and lockfile advisory fixes where present. Draft for maintainer review.
…nWorkflow edits only (BLOCKED_OPERATOR for the verification gate); separate commit so the maintainer can take or leave them. Crumbs recompiled here so the branch head verifies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares this repository for an outside, independent security audit. Draft on purpose: nothing here changes a gate, a trust anchor or a receipt, and no label is set.
Changes
SECURITY.md: private reporting (GitHub private advisory where enabled, else email drake@aienos.com), response targets, scope, supported versions, honest status.AUDIT_SCOPE.md: what to review in priority order, trust boundaries, threat model summary, build from source at a pinned revision, how to run every test, known limitations and NOT_RUN items.uses:pinned by full commit sha with the tag in a comment (was a mutable tag).adapters/aien8 advisories,provenance2,rust6, all to 0 (cargo update -pon the affected crates only).SECURITY.mdupdated to the org template (response targets, scope)..github/workflows/sbom.yml(new): SPDX SBOM artifact on push tomainand on pull requests; read-only token, actions pinned by full sha..github/dependabot.yml(new): monthly GitHub Actions updates and Cargo lockfile updates (lockfile-only); pull requests only, nothing merges itself.The
.github/workflows/edits are in a separate commit because the AIEN verification gate marks workflow changes BLOCKED_OPERATOR; the first commit carries everything else.Evidence
mainbefore this change: 4.2 (commit 1de1b00); the after score is recorded in the lane status once the branch is scanned.cargo auditbefore/after per lockfile recorded in the lane log (EXERCISED).Levels: IMPLEMENTED = in this branch; EXERCISED = run locally with the command shown; nothing here is QUALIFIED or MERGED.