chore: repo hygiene — pin actions, dependabot, SBOM, security docs #14

Merged

ochenstarik-ui merged 2 commits from antigravity/repo-hygiene into main

2026-08-09 12:08:02 +00:00

ochenstarik-ui commented

2026-08-07 04:42:57 +00:00

(Migrated from github.com)

Summary

Closes supply-chain and documentation gaps for a tool that installs root-level binaries and manages firewall rules.

Changes

1. GitHub Actions pinned to commit SHA

All 23 action uses across 5 workflow files now reference a 40-character commit SHA.

Action	Tag	SHA
\ctions/checkout\	v6.1.0	\d23441a48e516b6c34aea4fa41551a30e30af803\
\ctions/setup-dotnet\	v5.4.0	\26b0ec14cb23fa6904739307f278c14f94c95bf1\
\ctions/upload-artifact\	v6.0.0	\7c566a772e6b6bfb58ed0dc250532a479d7789f\
\ctions/download-artifact\	v8.0.1	\3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\
\softprops/action-gh-release\	v2.6.2	\3bb12739c298aeb8a4eeaf626c5b8d85266b0e65\

SHAs obtained from upstream via \gh api repos///git/ref/tags/. All tags resolve to commit objects directly (no annotated-tag dereference required).

2. Dependabot

.github/dependabot.yml\ added: \github-actions\ and
uget, weekly, max 5 open PRs each.

3. Narrowed workflow permissions

\linux-release.yml\ and \windows-release.yml: removed \permissions: contents: write\ from the workflow level (replaced with \permissions: contents: read). The \contents: write\ permission is now declared inline on the \softprops/action-gh-release\ step only.

\linux-control-agent.yml, \linux-platform-matrix.yml, \windows-build.yml: already had \permissions: contents: read\ at workflow level — left unchanged.

4. SECURITY.md

Private advisory channel (GitHub Security Advisories), 72-hour acknowledgement SLA, supported versions, threat model scope, and documented known alpha limitations (unsigned release manifest, untrusted Windows MSIX — both tracked in \docs/roadmap.md).

5. CHANGELOG.md

Keep a Changelog format, populated from real git history and tag dates. Covers all 6 tags (\0.1.0-alpha.1\ through \0.1.0-alpha.6) plus [Unreleased]\ (PRs #10–#12).

6. Contribution infrastructure

\CONTRIBUTING.md\ — build instructions, test requirements, explicit note that Control suite tests must run on Linux (\OperatingSystem.IsLinux()\ guard silently skips them on Windows).
\CODEOWNERS\ — all paths assigned to @ochenstarik.
.github/ISSUE_TEMPLATE/bug_report.md\ and \eature_request.md.
.github/PULL_REQUEST_TEMPLATE.md\ — mandatory three-section verification checklist (local / CI / not verified).

7. SBOM

\dotnet CycloneDX\ step added to \linux-release.yml\ (bootstrap and publish jobs) and \windows-release.yml.

8. Deleted merged branches

\gent/remove-lightweight-server-references\ and \codex/ttl-backup-acceptance\ removed from origin.

Verification checklist

✅ Verified locally

\git diff --name-only main\ — only the 13 expected files changed; no files from the boundary list (\src/, \deploy/, \ ests/) are modified.
All 23 action references grep-confirmed to use 40-char SHA: \grep -rE 'uses: .+@[a-f0-9]{40}' .github/workflows/\ — 23 matches.
No floating tags remain: \grep -rE 'uses: .+@v[0-9]' .github/workflows/\ — 0 matches.
SHA provenance documented above; each SHA cross-referenced against GitHub API response.
Merged branches confirmed deleted on origin.

✅ Verified in CI

CI will run on this PR automatically (\linux-control-agent.yml\ triggers on \pull_request). Links will appear once the run starts.

❌ Not verified / out of scope

Physical three-server acceptance test (\SMM_ACCEPT_RESTORE=1 SMM_ACCEPT_REBOOT=1 tests/acceptance/three-server-mesh.sh) — SSH and topology parameters not available to this task.
SBOM generation end-to-end — requires a full publish run on a tag; cannot be triggered from a PR. The step is present and the tool invocation follows the \dotnet CycloneDX\ CLI convention; correctness depends on CI run on tag push.
Windows MSIX trust-signing — no production certificate available; test-signing path exercised in \windows-build.yml.

## Summary Closes supply-chain and documentation gaps for a tool that installs root-level binaries and manages firewall rules. ## Changes ### 1. GitHub Actions pinned to commit SHA All 23 action uses across 5 workflow files now reference a 40-character commit SHA. | Action | Tag | SHA | |---|---|---| | \ctions/checkout\ | v6.1.0 | \d23441a48e516b6c34aea4fa41551a30e30af803\ | | \ctions/setup-dotnet\ | v5.4.0 | \26b0ec14cb23fa6904739307f278c14f94c95bf1\ | | \ctions/upload-artifact\ | v6.0.0 | \7c566a772e6b6bfb58ed0dc250532a479d7789f\ | | \ctions/download-artifact\ | v8.0.1 | \3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c\ | | \softprops/action-gh-release\ | v2.6.2 | \3bb12739c298aeb8a4eeaf626c5b8d85266b0e65\ | SHAs obtained from upstream via \gh api repos/<owner>/<action>/git/ref/tags/<tag>\. All tags resolve to commit objects directly (no annotated-tag dereference required). ### 2. Dependabot \.github/dependabot.yml\ added: \github-actions\ and \ uget\, weekly, max 5 open PRs each. ### 3. Narrowed workflow permissions \linux-release.yml\ and \windows-release.yml\: removed \permissions: contents: write\ from the workflow level (replaced with \permissions: contents: read\). The \contents: write\ permission is now declared inline on the \softprops/action-gh-release\ step only. \linux-control-agent.yml\, \linux-platform-matrix.yml\, \windows-build.yml\: already had \permissions: contents: read\ at workflow level — left unchanged. ### 4. SECURITY.md Private advisory channel (GitHub Security Advisories), 72-hour acknowledgement SLA, supported versions, threat model scope, and documented known alpha limitations (unsigned release manifest, untrusted Windows MSIX — both tracked in \docs/roadmap.md\). ### 5. CHANGELOG.md Keep a Changelog format, populated from real git history and tag dates. Covers all 6 tags (\0.1.0-alpha.1\ through \0.1.0-alpha.6\) plus \[Unreleased]\ (PRs #10–#12). ### 6. Contribution infrastructure - \CONTRIBUTING.md\ — build instructions, test requirements, **explicit note** that Control suite tests must run on Linux (\OperatingSystem.IsLinux()\ guard silently skips them on Windows). - \CODEOWNERS\ — all paths assigned to \@ochenstarik\. - \.github/ISSUE_TEMPLATE/bug_report.md\ and \eature_request.md\. - \.github/PULL_REQUEST_TEMPLATE.md\ — mandatory three-section verification checklist (local / CI / not verified). ### 7. SBOM \dotnet CycloneDX\ step added to \linux-release.yml\ (bootstrap and publish jobs) and \windows-release.yml\. ### 8. Deleted merged branches \gent/remove-lightweight-server-references\ and \codex/ttl-backup-acceptance\ removed from origin. --- ## Verification checklist ### ✅ Verified locally - \git diff --name-only main\ — only the 13 expected files changed; no files from the boundary list (\src/\, \deploy/\, \ ests/\) are modified. - All 23 action references grep-confirmed to use 40-char SHA: \grep -rE 'uses: .+@[a-f0-9]{40}' .github/workflows/\ — 23 matches. - No floating tags remain: \grep -rE 'uses: .+@v[0-9]' .github/workflows/\ — 0 matches. - SHA provenance documented above; each SHA cross-referenced against GitHub API response. - Merged branches confirmed deleted on origin. ### ✅ Verified in CI CI will run on this PR automatically (\linux-control-agent.yml\ triggers on \pull_request\). Links will appear once the run starts. ### ❌ Not verified / out of scope - Physical three-server acceptance test (\SMM_ACCEPT_RESTORE=1 SMM_ACCEPT_REBOOT=1 tests/acceptance/three-server-mesh.sh\) — SSH and topology parameters not available to this task. - SBOM generation end-to-end — requires a full publish run on a tag; cannot be triggered from a PR. The step is present and the tool invocation follows the \dotnet CycloneDX\ CLI convention; correctness depends on CI run on tag push. - Windows MSIX trust-signing — no production certificate available; test-signing path exercised in \windows-build.yml\.