Dylan M. Taylor 644a5d76b9 ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191) ...

* ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown

- Add persist-credentials: false across all actions/checkout invocations
- Eliminate template injection by mapping matrix and input variables to env: in freebsd.yml, release.yml, and sonarcloud.yml
- Add 7-day cooldown to dependabot.yml to protect against supply-chain compromise of recently published releases
- Update test suite to validate hardened environment mappings

* ci: allow static.crates.io and registry endpoints in gate and windows-arm64 runners

2026-11-10 18:07:38 -05:00

..

ast-grep.yml

ci: address review findings for Harden-Runner egress policy

2026-11-10 08:26:20 -05:00

changed-paths.yml

ci: address review findings for Harden-Runner egress policy

2026-11-10 08:26:20 -05:00

docker-build.yml

Merge branch 'main' into sonar/docker-build-job-permissions

2026-11-10 18:23:14 +01:00

flatpak-oci.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

freebsd.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

gate.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

git-sources.yml

ci: address review findings for Harden-Runner egress policy

2026-11-10 08:26:20 -05:00

house-rules.yml

ci: add allowed-endpoints to packaging-lint and house-rules workflows

2026-11-10 08:26:20 -05:00

nix.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

packaging-lint.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

refresh-contributors.yml

ci: address review findings for Harden-Runner egress policy

2026-11-10 08:26:20 -05:00

release.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

sonar-scan.yml

ci(sonar): skip SonarCloud scan on fork pull requests (#48)

2026-10-21 19:04:08 -04:00

sonarcloud.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

supply-chain.yml

ci: address review findings for Harden-Runner egress policy

2026-11-10 08:26:20 -05:00

test-ast-grep.yml

ci: specify allowed-endpoints for block mode in workflows

2026-11-10 08:26:20 -05:00

test-freebsd.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

test-house-rules.yml

ci: address review findings for Harden-Runner egress policy

2026-11-10 08:26:20 -05:00

test-install-apt-packages.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

windows-arm64.yml

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00