ci: supply-chain hardening to raise OSSF Scorecard / HVTrust - #684

Merged

blove merged 13 commits into

mainfrom

blove/infallible-moser-8f116e

Jun 18, 2026

Commits on Jun 18, 2026

docs(spec): HVTrust supply-chain hardening design

blove
and
claude
committed
ed52bc1
docs(plan): HVTrust supply-chain hardening implementation plan

blove
and
claude
committed
ab044bf
docs(security): add SECURITY.md vulnerability disclosure policy
blove
committed
36099c3
ci: set least-privilege top-level token permissions on publish workflows
blove
committed
1557777
ci: add CodeQL SAST for javascript-typescript and python
blove
committed
6686c0b
ci: add OSSF Scorecard workflow with public results + README badge
blove
committed
3ca7e3b
ci: add Renovate config with GitHub Action digest pinning
blove
committed
5afe2b1
ci: pin all GitHub Actions to commit SHAs
blove
committed
3f93da0
docs(contributing): document required SSH commit signing
blove
committed
d78e0fd
ci: generate SLSA provenance for GitHub Release artifacts
blove
committed
2966e74
ci: enable PyPI build provenance attestations on middleware publish
blove
committed
98f7432
fix(ci): grant release-provenance build job write perms; pin pypa publish action

blove
and
claude
committed
965cc93
Merge branch 'main' into blove/infallible-moser-8f116e
blove
authored
7e88ad6