Search results

Add actions/dependency-review-action to actions/scan (PR-time blocking layer)

Status: Open.

#209 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

v0.2: npm/pnpm/yarn workspaces support (N-tarball artifact model)

Status: Open.

#208 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

Tighten user-facing docs for one-pass readability

Status: Open.

#206 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

When pnpm/Yarn support lands, do NOT enable pnpm-store / yarn cache (Mini Shai-Hulud lesson)

Status: Open.

#205 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

Surface Scorecard findings as actionable remediations, not informational warnings

Status: Open.

#203 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

Refuse pull_request_target invocations in every reusable workflow

Status: Open.

#202 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

Integrate SLSA Source Track via slsa-framework/source-tool into check_source_change.yml

Status: Open.

#201 In TomHennen/wrangle;

· TomHennen opened on May 13, 2026

Stable showcase workflow on wrangle-test for example artifacts (SBOM, L3 provenance, dist)

Status: Open.

#200 In TomHennen/wrangle;

· TomHennen opened on May 12, 2026

Ship a wrangle verify-artifact action for adopters' publish jobs and downstream consumers

Status: Open.

#198 In TomHennen/wrangle;

· TomHennen opened on May 12, 2026

osv adapter: output.md reports 0 vulnerabilities while SARIF contains findings

Status: Open.

#197 In TomHennen/wrangle;

· TomHennen opened on May 12, 2026

Wire npm into actions/scan (ESLint, tsc, npm-specific source-scan signals)

Status: Open.

#194 In TomHennen/wrangle;

· TomHennen opened on May 4, 2026

verify job has no retry on slsa-verifier installer; transient 5xx flakes the whole workflow

Status: Open.

#190 In TomHennen/wrangle;

· TomHennen opened on May 4, 2026