akanealw
eec8c28fb3
Go Benchmark / Performance Regression Check (push) Has been cancelled
Cerberus Integration / Cerberus Security Stack Integration (push) Has been cancelled
Upload Coverage to Codecov / Backend Codecov Upload (push) Has been cancelled
Upload Coverage to Codecov / Frontend Codecov Upload (push) Has been cancelled
CodeQL - Analyze / CodeQL analysis (go) (push) Has been cancelled
CodeQL - Analyze / CodeQL analysis (javascript-typescript) (push) Has been cancelled
CrowdSec Integration / CrowdSec Bouncer Integration (push) Has been cancelled
Docker Build, Publish & Test / build-and-push (push) Has been cancelled
Quality Checks / Auth Route Protection Contract (push) Has been cancelled
Quality Checks / Codecov Trigger/Comment Parity Guard (push) Has been cancelled
Quality Checks / Backend (Go) (push) Has been cancelled
Quality Checks / Frontend (React) (push) Has been cancelled
Rate Limit integration / Rate Limiting Integration (push) Has been cancelled
Security Scan (PR) / Trivy Binary Scan (push) Has been cancelled
Supply Chain Verification (PR) / Verify Supply Chain (push) Has been cancelled
WAF integration / Coraza WAF Integration (push) Has been cancelled
Docker Build, Publish & Test / Security Scan PR Image (push) Has been cancelled
Repo Health Check / Repo health (push) Has been cancelled
History Rewrite Dry-Run / Dry-run preview for history rewrite (push) Has been cancelled
Prune Renovate Branches / prune (push) Has been cancelled
Renovate / renovate (push) Has been cancelled
Nightly Build & Package / sync-development-to-nightly (push) Has been cancelled
Nightly Build & Package / Trigger Nightly Validation Workflows (push) Has been cancelled
Nightly Build & Package / build-and-push-nightly (push) Has been cancelled
Nightly Build & Package / test-nightly-image (push) Has been cancelled
Nightly Build & Package / verify-nightly-supply-chain (push) Has been cancelled
Update GeoLite2 Checksum / update-checksum (push) Has been cancelled
Container Registry Prune / prune-ghcr (push) Has been cancelled
Container Registry Prune / prune-dockerhub (push) Has been cancelled
Container Registry Prune / summarize (push) Has been cancelled
Supply Chain Verification / Verify SBOM (push) Has been cancelled
Supply Chain Verification / Verify Release Artifacts (push) Has been cancelled
Supply Chain Verification / Verify Docker Image Supply Chain (push) Has been cancelled
Monitor Caddy Major Release / check-caddy-major (push) Has been cancelled
Weekly Nightly to Main Promotion / Verify Nightly Branch Health (push) Has been cancelled
Weekly Nightly to Main Promotion / Create Promotion PR (push) Has been cancelled
Weekly Nightly to Main Promotion / Trigger Missing Required Checks (push) Has been cancelled
Weekly Nightly to Main Promotion / Notify on Failure (push) Has been cancelled
Weekly Nightly to Main Promotion / Workflow Summary (push) Has been cancelled
Weekly Security Rebuild / Security Rebuild & Scan (push) Has been cancelled
56 lines
1.3 KiB
YAML
Executable File
56 lines
1.3 KiB
YAML
Executable File
version: 1
|
|
effective_date: 2026-02-25
|
|
scope:
|
|
- local pre-commit manual security hooks
|
|
- github actions security workflows
|
|
|
|
defaults:
|
|
blocking:
|
|
- critical
|
|
- high
|
|
medium:
|
|
mode: risk-based
|
|
default_action: report
|
|
require_sla: true
|
|
default_sla_days: 14
|
|
escalation:
|
|
trigger: high-signal class or repeated finding
|
|
action: require issue + owner + due date
|
|
low:
|
|
action: report
|
|
|
|
codeql:
|
|
severity_mapping:
|
|
error: high_or_critical
|
|
warning: medium_or_lower
|
|
note: informational
|
|
blocking_levels:
|
|
- error
|
|
warning_policy:
|
|
default_action: report
|
|
escalation_high_signal_rule_ids:
|
|
- go/request-forgery
|
|
- js/missing-rate-limiting
|
|
- js/insecure-randomness
|
|
|
|
trivy:
|
|
blocking_severities:
|
|
- CRITICAL
|
|
- HIGH
|
|
medium_policy:
|
|
action: report
|
|
escalation: issue-with-sla
|
|
|
|
grype:
|
|
blocking_severities:
|
|
- Critical
|
|
- High
|
|
medium_policy:
|
|
action: report
|
|
escalation: issue-with-sla
|
|
|
|
enforcement_contract:
|
|
codeql_local_vs_ci: "local and ci block on codeql error-level findings only"
|
|
supply_chain_medium: "medium vulnerabilities are non-blocking by default and require explicit triage"
|
|
auth_regression_guard: "state-changing routes must remain protected by auth middleware"
|