docs: point consumers at saw guard for installing & verifying the gate - #24
Merged
Conversation
saw guard (shipped in the stayawakebot package) now installs and verifies THIS gate, so wire it into the docs instead of leaving install/verify entirely manual: - README Usage: a note that `saw guard setup` installs the gate SHA-pinned to the latest release (and opens pin-bump PRs), and `saw guard check` verifies it's present, SHA-pinned, current, and a required check — across one repo or an account. - HARDENING checklist: a callout that saw guard automates most of the checklist (install / SHA-pin / required-check / freshness), while being honest that CODEOWNERS review and fetch-depth: 0 remain yours to set. Posture is UNCHANGED and already correct — the least-privilege `contents: read` default and remediation-as-deliberate-opt-in (scoped write, prefer a push trigger, keep PR runs report-only) already match what stayAwakeBot's `saw guard setup` emits. This only connects the shipped tooling; no workflow/permission changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
saw guard(now shipped in thestayawakebotpackage) installs and verifies this gate, so this wires it into the docs instead of leaving install/verify entirely manual:saw guard setupinstalls the gate SHA-pinned to the latest Strix release (and opens pin-bump PRs), andsaw guard checkverifies it's present, SHA-pinned, current, and a required check — across one repo or a whole account/org.saw guardautomates most of the checklist (install / SHA-pin / required-check / freshness), while being honest that CODEOWNERS review andfetch-depth: 0remain yours to set.[Unreleased]bullet.Posture is unchanged (and already correct)
No workflow/permission changes. The least-privilege
contents: readdefault and remediation-as-deliberate-opt-in (scoped write, prefer a push trigger, keep PR runs report-only) already match whatsaw guard setupemits — so this only connects the shipped tooling, it doesn't re-litigate the posture.