ci: close the scanner findings, gate three analysers, and pin the supply chain - #133

Merged

donislawdev merged 22 commits into

masterfrom

fix/semgrep-hardening

Aug 19, 2026

Commits on Aug 18, 2026

fix(ci): keep a branch name out of the shell it is used in

donislawdev
and
claude
committed
f9c35c5
ci: pin every action to a commit, and let a new release cool down

donislawdev
and
claude
committed
eddaa6f
chore: answer the last three scanner findings, two by fixing one thing

donislawdev
and
claude
committed
74cbd24
chore: adopt ruff, and close the 56 findings it opens with

donislawdev
and
claude
committed
3c9a94e
ci: run ruff on every pull request, blocking on F and B

donislawdev
and
claude
committed
aaf941c
chore: adopt mypy, and answer the thirty things it says

donislawdev
and
claude
committed
61a328e
ci: type check the package on every pull request

donislawdev
and
claude
committed
eae348c
ci: scan with semgrep on every pull request, and gate it ourselves

donislawdev
and
claude
committed
2327d33

Commits on Aug 19, 2026

feat(release): sign where the download came from, not just what is in it

donislawdev
and
claude
committed
ede3333
feat(deps): pin the bytes of the runtime dependencies, not just the version

donislawdev
and
claude
committed
f8701c5
feat(build): pin the freezer's whole chain, not just the freezer

donislawdev
and
claude
committed
e5e49be
ci: audit the pinned dependencies weekly, and open an issue on a finding

donislawdev
and
claude
committed
1af3127
ci: let an outside grader look at the supply chain, weekly

donislawdev
and
claude
committed
5ddc177
feat(ci): block a dependency nobody can license, and pin the driver's bytes

donislawdev
and
claude
committed
e2291da
ci: run the mutation registry instead of quoting it

donislawdev
and
claude
committed
adbf02e
chore: put a ceiling on branching, and stop the CI prose drifting

donislawdev
and
claude
committed
40d810e
chore(types): make three modules strict, and make the list one-way

donislawdev
and
claude
committed
cf818aa
ci: gate the coverage of what a pull request changes

donislawdev
and
claude
committed
f9fbd61
fix(ci): skip actions in the licence gate, and stop asking git for depth zero

donislawdev
and
claude
committed
4b80d7e
fix(tests): give the scanner guard something to guard on a runner

donislawdev
and
claude
committed
0d001ce
fix(ci): stop a dead package mirror eating the whole test job

donislawdev
and
claude
committed
eb1d5ed
fix(ci): rewrite the mirror where it actually lives, and skip apt when it can

donislawdev
and
claude
committed
50ae9eb

Navigation Menu

Uh oh!

ci: close the scanner findings, gate three analysers, and pin the supply chain - #133

ci: close the scanner findings, gate three analysers, and pin the supply chain#133
donislawdev merged 22 commits into
masterfrom
fix/semgrep-hardening

Commits on Aug 18, 2026

fix(ci): keep a branch name out of the shell it is used in

ci: pin every action to a commit, and let a new release cool down

chore: answer the last three scanner findings, two by fixing one thing

chore: adopt ruff, and close the 56 findings it opens with

ci: run ruff on every pull request, blocking on F and B

chore: adopt mypy, and answer the thirty things it says

ci: type check the package on every pull request

ci: scan with semgrep on every pull request, and gate it ourselves

Commits on Aug 19, 2026

feat(release): sign where the download came from, not just what is in it

feat(deps): pin the bytes of the runtime dependencies, not just the version

feat(build): pin the freezer's whole chain, not just the freezer

ci: audit the pinned dependencies weekly, and open an issue on a finding

ci: let an outside grader look at the supply chain, weekly

feat(ci): block a dependency nobody can license, and pin the driver's bytes

ci: run the mutation registry instead of quoting it

chore: put a ceiling on branching, and stop the CI prose drifting

chore(types): make three modules strict, and make the list one-way

ci: gate the coverage of what a pull request changes

fix(ci): skip actions in the licence gate, and stop asking git for depth zero

fix(tests): give the scanner guard something to guard on a runner

fix(ci): stop a dead package mirror eating the whole test job

fix(ci): rewrite the mirror where it actually lives, and skip apt when it can