security: scan the supply chain, publish an SBOM, and type-check the build (Phase 2) - #322

Merged

cevheri merged 13 commits into

mainfrom

security/phase-2-supply-chain

Aug 9, 2026

Commits on Aug 9, 2026

feat(security): classify the repository's secret-scanning history and pin the allowlist
cevheri
committed
5b183c4
feat(security): add security-scan.yml with a blocking incremental secret scan
cevheri
committed
0af070b
feat(security): scan lockfiles on every pull request and gate critical fixable advisories on main
cevheri
committed
ca20160
feat(security): scan the published container image daily and report its OS findings
cevheri
committed
62dbf38
feat(security): attach an attested CycloneDX SBOM to every release
cevheri
committed
d20acf6
fix(security): type-check the production build instead of ignoring its errors
cevheri
committed
80951f7
docs(security): document the supply-chain scans, the SBOM and the Phase 2 deferrals
cevheri
committed
6876515
fix(security): close the guard-not-scanner gaps the Phase 2 review found
cevheri
committed
f7b8dca
fix(security): correct the round-1 explainer regression and two guard blind spots
cevheri
committed
b6ea012
fix(security): fingerprint the secret-scan allowlist and close two scanner gaps
cevheri
committed
94dfe1e
fix(security): resolve a ReDoS, correct BACKLOG's CVE mapping, and close two more scanner gaps
cevheri
committed
4b48fc8
docs(security): resolve BACKLOG C7 - the next bump landed via #323
cevheri
committed
2c90972
fix(security): run the release SBOM's Trivy container as the invoking user, not root
cevheri
committed
7aa94c8