James MaesandCodex
06f083af39
Generate the GUI-only AppKit foundation, lock published dependencies and record the Windows feature requirements against the pinned original. The greeting is still scaffold content; no Markdown viewer or release is claimed. Validation: zero-warning solution build; 20 core tests; 100% core coverage; formatting and documentation checks. Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <jmaes@dmdbrands.com>
28 lines
815 B
YAML
28 lines
815 B
YAML
# Security scans (K22-CI-20, K22-CI-21, K22-CI-23): gitleaks over full history,
|
|
# Trivy + OSV-Scanner over the lock files, zizmor + actionlint over the workflows.
|
|
# Runs on every pull request, every push to main, and weekly.
|
|
name: security
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "23 6 * * 1"
|
|
workflow_dispatch:
|
|
|
|
workflow_call:
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: security-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
security:
|
|
uses: KofTwentyTwo/standards/.github/workflows/security.yml@fdf5ed029603c938615a32b1beca3628b8787945 # v0.1.2
|
|
permissions:
|
|
contents: read # check out the code and its history
|
|
security-events: write # upload Trivy and zizmor SARIF to code scanning
|