Dylan M. Taylor 644a5d76b9 ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191) ...

* ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown

- Add persist-credentials: false across all actions/checkout invocations
- Eliminate template injection by mapping matrix and input variables to env: in freebsd.yml, release.yml, and sonarcloud.yml
- Add 7-day cooldown to dependabot.yml to protect against supply-chain compromise of recently published releases
- Update test suite to validate hardened environment mappings

* ci: allow static.crates.io and registry endpoints in gate and windows-arm64 runners

2026-11-10 18:07:38 -05:00

..

ast-grep

ast-grep: a reusable structural-lint workflow driven by the app's sgconfig.yml (#80)

2026-10-24 19:29:21 -04:00

test_arch.py

feat: allow additional Arch runtime dependencies (#161)

2026-11-06 19:33:10 -05:00

test_ast_grep.py

fix(ast-grep): end option parsing before the scanned paths

2026-11-02 22:17:40 -05:00

test_changed_paths.py

test: account for Harden-Runner step in workflow assertions

2026-11-10 08:26:20 -05:00

test_check_git_sources.py

test: account for Harden-Runner step in workflow assertions

2026-11-10 08:26:20 -05:00

test_contributor_generator.py

Build model titles only from each provider's known words

2026-11-04 13:49:44 +01:00

test_contributor_refresh.py

test: account for Harden-Runner step in workflow assertions

2026-11-10 08:26:20 -05:00

test_craft_fonts.py

Shared quality-gate workflow for the craft apps (gate.yml) (#69)

2026-10-23 12:15:49 -04:00

test_craft_i18n.py

fix(release): drop the i18n gate; missing translations never block (storytold/craft-i18n#20) (#79)

2026-10-23 17:06:45 -04:00

test_docker_build.py

fix(docker-build): scope packages: write to the pushing jobs

2026-11-10 11:10:27 +01:00

test_export_app_build_env.py

release.yml: export each app's build variables from its env.sh, so a new app needs no change here (#148)

2026-11-06 07:36:30 -05:00

test_freebsd_cache.py

fix(freebsd-cache): fall back to a compatible cache when manifests move (#41)

2026-10-22 15:00:48 -04:00

test_freebsd_release.py

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

test_freebsd.py

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

test_gate.py

gate.yml: optional gate-timeout-minutes stops a hung gate with a process list and a clear error (#143)

2026-11-05 11:27:56 +01:00

test_house_rules.py

test: account for Harden-Runner step in workflow assertions

2026-11-10 08:26:20 -05:00

test_import_macos_certificate.py

Add import-macos-certificate: the shared macOS signing certificate import (#140)

2026-11-05 09:08:39 -05:00

test_install_apt_packages.py

Harden contributor consent identities and preference preflight

2026-11-03 12:53:38 +00:00

test_linux_glibc.py

fix(release): give riscv64 packages the glibc floor of their runner (#62)

2026-10-22 17:10:08 -04:00

test_nextest_versions.py

test: cover nextest installer aliases

2026-10-26 16:20:05 -06:00

test_nix.py

security(nix): prevent shell injection through extra-args (#52)

2026-10-22 14:37:49 -04:00

test_packaging_lint.py

fix(packaging-lint): retry transient actionlint downloads (#176)

2026-11-08 14:16:10 +01:00

test_python_coverage.py

Provision fonts and optional Python coverage for Sonar (#88)

2026-10-25 23:37:12 -04:00

test_release_flatpak_oci.py

feat(release): dual-push Flatpak OCI layouts to Docker Hub (#178)

2026-11-08 19:11:04 -05:00

test_release_inputs.py

security(release): prevent app-name shell injection in FreeBSD and server jobs (#55)

2026-10-22 14:47:14 -04:00

test_release_retain.py

feat: allow uploading assets to an existing published release (#164) (#165)

2026-11-06 20:40:48 -05:00

test_release_tag_prefix.py

feat: allow a custom draft release tag prefix (#159)

2026-11-06 16:06:01 -05:00

test_resolve_version.py

test(resolve-version): add test for CRLF sanitization in app-title

2026-10-24 22:46:59 -04:00

test_scaffold_flatpak_oci.py

Keep development builds off stable OCI tags

2026-11-03 00:01:47 -05:00

test_setup_windows_signing.py

Add setup-windows-signing: the shared Authenticode signing script (#144)

2026-11-05 09:10:10 -05:00

test_sign_linux_fixture.py

fix(sonar): reduce sharded coverage disk usage (#174)

2026-11-08 14:15:27 +01:00

test_sign_linux.py

fix(sonar): reduce sharded coverage disk usage (#174)

2026-11-08 14:15:27 +01:00

test_sonarcloud_disk.py

fix(sonar): reduce sharded coverage disk usage (#174)

2026-11-08 14:15:27 +01:00

test_sonarcloud.py

ci: harden workflows with credential isolation, template injection defenses, and dependabot cooldown (#191)

2026-11-10 18:07:38 -05:00

test_supply_chain.py

ci: replace anchore/sbom-action with step-security/sbom-action

2026-11-10 08:26:20 -05:00

test_unit_test_triggers.py

ci: honor negated path patterns in the trigger test

2026-10-26 17:47:48 -07:00

test_windows_arm64.py

ci(windows-arm64): only main saves the packaging cache (#116)

2026-11-01 01:39:08 +01:00

test_windows_install_contract.py

fix(ci): separate ARM64 install paths and scope (#100)

2026-10-27 15:45:39 -04:00

test_windows_release.py

feat: drop Windows 32-bit builds (#163)

2026-11-06 21:27:06 -05:00