fix(ci): restore central review, security, snapshots, and hourly repair - #731

Closed

seonghobae wants to merge 38 commits into

mainfrom

fix/strix-python-security-cves

Commits on Aug 4, 2026

fix(security): update Strix Python dependency locks
seonghobae
committed
77910ff
fix(ci): restore central security baseline
seonghobae
committed
60b6dd9
fix(ci): let dependency upgrades self-heal coverage
seonghobae
committed
c73ee47
fix(deps): constrain patched aiohttp floor in Strix lock
seonghobae
committed
880486b
test(ci): reject mixed fatal pip preflight evidence
seonghobae
committed
bb5e436
fix(ci): keep mixed pip integrity failures fatal
seonghobae
committed
b326f65
fix(ci): restore coverage contract wording
seonghobae
committed
5b4929a
fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base (#736)

seonghobae
and
claude
authored
0b6a188
ci: run securely pinned review repair every hour (#745)
seonghobae
authored
69fc4d2
test(ci): fail closed on mixed unknown pip errors
seonghobae
committed
6b705b3
fix(ci): reject mixed unknown pip failures
seonghobae
committed
83b9d50
test(ci): preserve pip stale-pin context lines
seonghobae
committed
ced08de
docs(doctoring): record central security baseline evidence
seonghobae
committed
98dc0b5
fix(ci): preserve verified pip stale-pin context
seonghobae
committed
5c5c032
fix(ci): recognize pip incompatible-version context
seonghobae
committed
a0a84f7
docs(doctoring): correct APA 7 standards provenance
seonghobae
committed
4aefeb1
docs(automation): correct APA 7 dates for living GitHub documentation
seonghobae
committed
cfa6893
test(ci): prove exact-pair stale-pin classification
seonghobae
committed
03a95a4
chore(ci): remove branch-pushing one-shot workflow
seonghobae
committed
3e92ae9
build(ci): add bounded stale-pin patch helper
seonghobae
committed
0160d65
test(ci): require exact-pair stale-pin evidence
seonghobae
committed
a900f51
fix(ci): simplify one-shot stale-pin verification
seonghobae
committed
0d22ee8
fix(security): remove branch-controlled write workflow
seonghobae
committed
98ef79e
fix(ci): require paired exact-requirement stale-pin diagnostics
seonghobae
committed
044030b
chore(ci): remove completed one-shot patch helper
seonghobae
committed
b61878f
docs(doctoring): record paired stale-pin evidence contract
seonghobae
committed
f2c5333
ci(security): advance CodeQL baseline to v4.37.5
seonghobae
committed
13e8d72
ci(security): use latest immutable CodeQL v4.37.5
seonghobae
committed
2ad1fc0
test(ci): reject non-version index evidence
seonghobae
committed
c61bdd7
fix(ci): require concrete version evidence before deferral
seonghobae
committed
d20072a
docs(doctoring): define concrete stale-pin version evidence
seonghobae
committed
13c12cc
test(ci): reject duplicate malformed resolver evidence
seonghobae
committed
3dff404
fix(ci): validate every paired resolver line independently
seonghobae
committed
c3b16d0
docs(doctoring): require concrete evidence on every resolver line
seonghobae
committed
60f6009
test(ci): require fail-closed scheduler source resolution
seonghobae
committed
4e0fc8b
fix(ci): fail closed on unresolved scheduler source identity
seonghobae
committed
95bb78a
docs(doctoring): cite called-workflow identity contract
seonghobae
committed
e672f23
fix(ci): run hourly review autofix through NVIDIA NIM (#752)

seonghobae
and
opencode-agent[bot]
authored
32ac926