mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-11 23:49:01 +02:00
8c75496391
The repo owned a redaction engine and had zero CI-side secret scanning. quality-gate.yml now pipes every PR diff's ADDED lines through our own bin/gstack-redact (gate-secret-scan.mjs, taken from the fork — it dogfoods the engine): HIGH findings fail the check, MEDIUM prints an advisory count only (no human in CI to confirm), planted-bug fixtures excluded by pathspec. Live-verified both directions: PEM key fails, clean diff and MEDIUM shapes pass; ShellCheck (errors) covers the setup/build shell boundary and passes today; bun audit gates critical advisories. Trigger is pull_request, never pull_request_target. dependency-review.yml adopts the hardened never-merged prior-art branch (fail-on-severity high, workflow paths watched, tight perms) — verify the dependency graph parses bun.lock with a canary bump before trusting the gate. dependabot: weekly, grouped per ecosystem, capped PR counts; and evals.yml image build/push now skips dependabot actors, whose read-only GITHUB_TOKEN made every lockfile bump a permanently red check. OSV scans weekly with a reasoned ignore file. All new workflow actions SHA-pinned. Scorecard deliberately not taken (no consumer for the score). The PR template front-loads the evidence bar (live proof, liveness screenshot, no-ETHOS/voice-changes checklist); the unenforced DCO line is dropped. bin/gstack-verify-gate ships OPT-IN (never registered by ./setup — a Stop hook running the project's verify command after every turn is the user's call), with the fork's tests adapted to pin exactly that. Ported from time-attack/gstack (GStack 2) + our own prior-art branch. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
16 lines
941 B
TOML
16 lines
941 B
TOML
# OSV-Scanner configuration.
|
|
# Direct/transitive dependency versions are pinned to their fixed releases via
|
|
# the `overrides` block in package.json; this file only records advisories we
|
|
# have assessed as not-reachable or not-fixable without disproportionate risk.
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-frvp-7c67-39w9"
|
|
# @hono/node-server 1.19.x. Reachable only through @modelcontextprotocol/sdk,
|
|
# which is an unused transitive dependency (no source file imports it) and never
|
|
# starts a Hono HTTP server, so the advisory's request path is not exercised.
|
|
# The only fix is @hono/node-server 2.0.5, a major bump the MCP SDK pins against
|
|
# (^1.19.9); forcing it via override risks breaking the SDK at runtime for a
|
|
# vulnerability we do not expose. Re-evaluate if the MCP SDK becomes a direct,
|
|
# server-hosting dependency.
|
|
reason = "Unreachable transitive (unused @modelcontextprotocol/sdk); fix requires a risky major override on a pinned peer dep."
|