From 957896249e5895d41c29a873331622ba88b967c3 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 23 May 2026 00:26:32 +0100 Subject: [PATCH 1/2] feat(security): fleet-wide workflow hardening (SHA pinning + permissions) --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e49a7b5..5ffa7ca 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -70,7 +70,7 @@ jobs: fi # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 + # - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 # with: # name: release-artifacts # path: target/release/ @@ -130,7 +130,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 + # - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 # with: # name: release-artifacts # path: artifacts/ From a532f317454c6b704993441a57ff312811d6cb9c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 31 May 2026 08:06:34 +0100 Subject: [PATCH 2/2] =?UTF-8?q?ci(codeql):=20cron=20weekly=E2=86=92monthly?= =?UTF-8?q?=20(cut=203,=20standards#233=20Option=20B)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per owner-decision Option B on hyperpolymath/standards#233 (2026-05-30): move scheduled CodeQL from weekly (`'0 6 * * 1'`) to monthly (`'0 6 1 * *'`). Same shape as canonical caller-template change in hyperpolymath/standards#286. ## Why - ~85% Actions-minute savings on scheduled CodeQL (12 runs/yr vs 52). - Bounded 30-day CVE-detection floor. - PR-trigger runs (push + pull_request) unchanged — every PR still gets CodeQL coverage. ## Sweep Part of estate-wide sweep tracked at hyperpolymath/standards#288. Refs hyperpolymath/standards#233 Refs hyperpolymath/standards#288 Refs hyperpolymath/standards#286 Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9e32d15..4d2b9d2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -7,7 +7,7 @@ on: pull_request: branches: [main, master] schedule: - - cron: '0 6 * * 1' + - cron: '0 6 1 * *' # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide