ci: guard every inherited workflow to upstream, and enforce it in CI by brentyates-swx · Pull Request #22 · swxtchio/swx-opencode

ci: add a check that every inherited workflow job is guarded to upstream

brentyates-swx

committed

2f1891f

ci: guard every inherited workflow to upstream, and refuse cross-repo writes

brentyates-swx

committed

83184e9

ci: make the workflow-guard allowlist per-job and detect stale entries

brentyates-swx

committed

49af58e

ci: require the repository guard to be the leading top-level conjunct

brentyates-swx

committed

7b09e6a

ci: pin allowlisted job contents, and test that enforcement is wired

brentyates-swx

committed

8f6138a

ci: make the guard scanner string-literal aware, and stop test debris

brentyates-swx

committed

961448d

ci: fail closed on an uncheckable condition, and tolerate any && spacing

brentyates-swx

committed

91ea52d

ci: enforce the audit's own delivery path, and accept a bracketed guard

brentyates-swx

committed

85917b4

ci: assert branch coverage, pair envelope pins, and see nested workflows

brentyates-swx

committed

655939a

test: correct the comment overstating one assertion as decisive

brentyates-swx

committed

c57531d

ci: stop treating a quoted 'false' as disabled, and attest the audit's wiring

brentyates-swx

committed

bae94a2

ci: read the default branch from GitHub, and pin the actions allowlisted jobs run

brentyates-swx

committed

e10d635

ci: check that the audit steps RUN, not that they are named

brentyates-swx

committed

01c5c9d

ci: fail when the audit runs without gating, and pin the checks themselves

brentyates-swx

committed

2473ff5

ci: require the audit's own job to be allowlisted, never guarded

brentyates-swx

committed

77f2f5e

ci: require the audit's own job to be unconditional, not merely unguarded

brentyates-swx

committed

a547b4d

ci: test the audit's command line, and catch `|| exit 0`

brentyates-swx

committed

9f98a00

ci: pin the audit steps' scripts exactly, and reject every way its job skips

brentyates-swx

committed

a95c2df

ci: opt out of Turborepo telemetry in the two workflows this fork runs

brentyates-swx

committed

35733b2

Navigation Menu

Repository navigation

ci: guard every inherited workflow to upstream, and enforce it in CI - #22

ci: guard every inherited workflow to upstream, and enforce it in CI#22
brentyates-swx merged 19 commits into
swxtchfrom
fix/9-workflow-repository-guard

Commits on Sep 22, 2026

ci: add a check that every inherited workflow job is guarded to upstream

ci: guard every inherited workflow to upstream, and refuse cross-repo writes

ci: make the workflow-guard allowlist per-job and detect stale entries

ci: require the repository guard to be the leading top-level conjunct

ci: pin allowlisted job contents, and test that enforcement is wired

ci: make the guard scanner string-literal aware, and stop test debris

ci: fail closed on an uncheckable condition, and tolerate any && spacing

ci: enforce the audit's own delivery path, and accept a bracketed guard

ci: assert branch coverage, pair envelope pins, and see nested workflows

test: correct the comment overstating one assertion as decisive

ci: stop treating a quoted 'false' as disabled, and attest the audit's wiring

ci: read the default branch from GitHub, and pin the actions allowlisted jobs run

ci: check that the audit steps RUN, not that they are named

ci: fail when the audit runs without gating, and pin the checks themselves

ci: require the audit's own job to be allowlisted, never guarded

ci: require the audit's own job to be unconditional, not merely unguarded

ci: test the audit's command line, and catch `|| exit 0`

ci: pin the audit steps' scripts exactly, and reject every way its job skips

ci: opt out of Turborepo telemetry in the two workflows this fork runs