ci: adopt the standards' pull-request, security, CodeQL and Scorecard gates #68

2026-10-09T14:59:58Z

KofTwentyTwo commented

2026-10-09 14:59:58 +00:00

(Migrated from github.com)

What

Workstream 1 of #62: the KofTwentyTwo standards' reusable gates (pr-gates, security, codeql, scorecard), root scanner configs, global.json, pre-commit, the standard PSScriptAnalyzer settings, and a hardened ci / release / nuget-updates trio (no persisted credentials, no release cache, no ${{ }} in run:, locked restores). Releases gain a CycloneDX SBOM per artifact, SHA256SUMS (renamed, channel feed included), LICENSE inside the assets, and release notes generated from Conventional Commit subjects.

Why

K22-CI-01, 12, 14, 15, 18, 20-24, 31; K22-REL-02..07; K22-DEP-20, 30; K22-REPO-01. Closes #63.

The old job names (Build and test (x64), Format (style gate), Dependency review) and dependency-review.yml are kept until protect-main lists the new contexts (#66); a follow-up removes them.

How it was tested

Locally: gitleaks over full history (clean), trivy fs (clean), zizmor --min-severity medium (clean; one low "self-repository" hint), actionlint (clean), YAML parse of every workflow.
New-ReleaseNotes.ps1 run against the real v1.0.1-beta.1 tag (26 entries, grouped), PSScriptAnalyzer clean with the standard settings.
dotnet CycloneDX run on the CLI project with the exact release flags (spec 1.6, 4 components).
dotnet restore --force-evaluate regenerated the lock files (the CLI lock now has the win-x64 graph); solution builds, Engine 422 and CLI 129 tests pass, dotnet format clean.
The new checks on this PR are the first live run of the reusable workflows against this repository.

Checklist

Commits are signed and signed off (git commit -S -s)
Zero build warnings; format and lint are clean
Tests added or updated; the coverage gate still passes
Docs updated for user-visible changes (README/RELEASING mention SHA256SUMS and SBOMs)
No secrets, credentials, or personal data
New dependencies are justified: CycloneDX 6.2.0 (release-time tool, pinned) and the standards' reusable workflows (pinned by SHA)
Substantial AI assistance is noted: authored with Claude Code, reviewed by the maintainer

🤖 Generated with Claude Code

## What Workstream 1 of #62: the KofTwentyTwo standards' reusable gates (`pr-gates`, `security`, `codeql`, `scorecard`), root scanner configs, `global.json`, pre-commit, the standard PSScriptAnalyzer settings, and a hardened `ci` / `release` / `nuget-updates` trio (no persisted credentials, no release cache, no `${{ }}` in `run:`, locked restores). Releases gain a CycloneDX SBOM per artifact, `SHA256SUMS` (renamed, channel feed included), LICENSE inside the assets, and release notes generated from Conventional Commit subjects. ## Why K22-CI-01, 12, 14, 15, 18, 20-24, 31; K22-REL-02..07; K22-DEP-20, 30; K22-REPO-01. Closes #63. The old job names (`Build and test (x64)`, `Format (style gate)`, `Dependency review`) and `dependency-review.yml` are kept until `protect-main` lists the new contexts (#66); a follow-up removes them. ## How it was tested - Locally: gitleaks over full history (clean), `trivy fs` (clean), `zizmor --min-severity medium` (clean; one low "self-repository" hint), `actionlint` (clean), YAML parse of every workflow. - `New-ReleaseNotes.ps1` run against the real `v1.0.1-beta.1` tag (26 entries, grouped), PSScriptAnalyzer clean with the standard settings. - `dotnet CycloneDX` run on the CLI project with the exact release flags (spec 1.6, 4 components). - `dotnet restore --force-evaluate` regenerated the lock files (the CLI lock now has the `win-x64` graph); solution builds, Engine 422 and CLI 129 tests pass, `dotnet format` clean. - The new checks on this PR are the first live run of the reusable workflows against this repository. ## Checklist - [x] Commits are signed and signed off (`git commit -S -s`) - [x] Zero build warnings; format and lint are clean - [x] Tests added or updated; the coverage gate still passes - [x] Docs updated for user-visible changes (README/RELEASING mention `SHA256SUMS` and SBOMs) - [x] No secrets, credentials, or personal data - [x] New dependencies are justified: CycloneDX 6.2.0 (release-time tool, pinned) and the standards' reusable workflows (pinned by SHA) - [x] Substantial AI assistance is noted: authored with Claude Code, reviewed by the maintainer 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#68