KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

ci: adopt the standards' pull-request, security, CodeQL and Scorecard gates and harden the release pipeline #63

New Issue
Closed
opened 2026-10-09 14:53:51 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-10-09 14:53:51 +00:00 (Migrated from github.com)
Copy link
Copy source

Part of #62 (workstream 1).

  • Call KofTwentyTwo/standards reusable workflows: pr-gates (title, DCO, dependency review), security (gitleaks over history, Trivy + OSV-Scanner, zizmor + actionlint), codeql (security-extended, csharp + actions, gated at high), scorecard.
  • Root scanner configs (.gitleaks.toml, trivy.yaml, zizmor.yml), global.json, .pre-commit-config.yaml, PSScriptAnalyzerSettings.psd1.
  • Harden ci.yml, release.yml, nuget-updates.yml: persist-credentials: false, no caches in the release job, no ${{ }} interpolation in run:, concurrency, locked restores.
  • Release: CycloneDX SBOM per artifact (attached + attested), SHA256SUMS (renamed; channel feed hashed), LICENSE inside assets, release notes generated from Conventional Commit titles, Conventional Commit titles for generated PRs; Dependabot cooldown 7 days with the ci prefix; NuGet update script honors a cooldown.
  • The old job names (Build and test (x64), Format (style gate), Dependency review) stay until the protect-main ruleset lists the new contexts (#66); a follow-up removes them.

K22-CI-01, 12, 14, 15, 18, 20-24, 31; K22-REL-02..07; K22-DEP-20, 30; K22-REPO-01, 04.

Part of #62 (workstream 1). - Call `KofTwentyTwo/standards` reusable workflows: `pr-gates` (title, DCO, dependency review), `security` (gitleaks over history, Trivy + OSV-Scanner, zizmor + actionlint), `codeql` (security-extended, csharp + actions, gated at high), `scorecard`. - Root scanner configs (`.gitleaks.toml`, `trivy.yaml`, `zizmor.yml`), `global.json`, `.pre-commit-config.yaml`, `PSScriptAnalyzerSettings.psd1`. - Harden `ci.yml`, `release.yml`, `nuget-updates.yml`: `persist-credentials: false`, no caches in the release job, no `${{ }}` interpolation in `run:`, concurrency, locked restores. - Release: CycloneDX SBOM per artifact (attached + attested), `SHA256SUMS` (renamed; channel feed hashed), LICENSE inside assets, release notes generated from Conventional Commit titles, Conventional Commit titles for generated PRs; Dependabot cooldown 7 days with the `ci` prefix; NuGet update script honors a cooldown. - The old job names (`Build and test (x64)`, `Format (style gate)`, `Dependency review`) stay until the `protect-main` ruleset lists the new contexts (#66); a follow-up removes them. K22-CI-01, 12, 14, 15, 18, 20-24, 31; K22-REL-02..07; K22-DEP-20, 30; K22-REPO-01, 04.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#63