WIP: fix(template): complete onboarding and pinned scanner policy #1

2026-10-10T23:53:38Z

KofTwentyTwo commented

2026-10-10 23:53:38 +00:00

(Migrated from github.com)

The bootstrap now also corrects the selected-actions policy for the two exact digest-pinned Gitleaks/Trivy container actions used by the published shared security builder. GitHub had rejected them at workflow startup; current policy verification and hosted security now succeed. The three onboarding guides also explain local installable-package trials, initial NuGet lock creation and actual standalone required-check names.

Validation: 55 source and generated Windows application script cases, full configured analysis of changed module/tests, Markdown/diff checks and signed/DCO hooks pass. Initial main CI 38096509791 and fac10a7 CI 38096578936 passed build/coverage, format, UI, actual generated variants and installed stable/dev update acceptance. Current scripts 38097053573 and security 38097053934/38097129462 succeed; current CI/CodeQL must still finish. Runtime application code is unchanged in this PR.

The owner authorized repository creation, initial push and restrictive configuration. The public template now has 17 app-bound contexts, protected main/release tags, selected actions, security controls and tag-only release environment. Repository Validate returns SettingsVerified=true. Full baseline review, current-head human acknowledgement, standards inventory, new NuGet trusted-publishing policy and release verification remain outstanding. This PR is a draft; no merge, tag or release is authorized by this description. Substantial AI assistance: Codex (GPT-6).

The bootstrap now also corrects the selected-actions policy for the two exact digest-pinned Gitleaks/Trivy container actions used by the published shared security builder. GitHub had rejected them at workflow startup; current policy verification and hosted security now succeed. The three onboarding guides also explain local installable-package trials, initial NuGet lock creation and actual standalone required-check names. Validation: 55 source and generated Windows application script cases, full configured analysis of changed module/tests, Markdown/diff checks and signed/DCO hooks pass. Initial main CI 38096509791 and fac10a7 CI 38096578936 passed build/coverage, format, UI, actual generated variants and installed stable/dev update acceptance. Current scripts 38097053573 and security 38097053934/38097129462 succeed; current CI/CodeQL must still finish. Runtime application code is unchanged in this PR. The owner authorized repository creation, initial push and restrictive configuration. The public template now has 17 app-bound contexts, protected main/release tags, selected actions, security controls and tag-only release environment. Repository Validate returns SettingsVerified=true. Full baseline review, current-head human acknowledgement, standards inventory, new NuGet trusted-publishing policy and release verification remain outstanding. This PR is a draft; no merge, tag or release is authorized by this description. Substantial AI assistance: Codex (GPT-6).

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/template-onboarding:fix/template-onboarding

git checkout fix/template-onboarding

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/windows-app-template#1