feat: central gap-filling security workflows (bandit/semgrep/gitleaks/pip-audit + periodic) + trivy/osv reconciliation - #374

Merged

seonghobae merged 23 commits into

mainfrom

feat/central-governance-gaps

Jul 11, 2026

Commits on Jul 11, 2026

feat: add central gap-filling security workflows + trivy/osv reconciliation

authored and
seonghobae
committed
bf61979
fix(security): hash-pin pip installs in central python-security & sast-semgrep gates

authored and
seonghobae
committed
5fabf12
fix(security): mark clean OSV SARIF comprehensive
seonghobae
committed
6ddc74f
fix(ci): scope PR workflow concurrency by PR number
seonghobae
committed
844b396
fix(noema): isolate workflow-run followup concurrency
seonghobae
committed
475c530
fix(security): preserve OSV scan analysis category
seonghobae
committed
8b469c5
fix(security): upload OSV clean SARIF to PR merge ref
seonghobae
committed
271dfcd
fix(security): resolve PR merge SHA for OSV SARIF
seonghobae
committed
080cf35
fix(security): upload OSV SARIF against PR head
seonghobae
committed
9969744
fix(security): fetch PR merge ref before OSV SARIF upload
seonghobae
committed
2857aec
fix(security): upload OSV SARIF against PR head
seonghobae
committed
ab64e9d
fix(security): keep Strix status publishing least privilege
seonghobae
committed
963d979
test(strix): align smoke with read-only status token
seonghobae
committed
d142329
fix(security): checkout PR merge ref before OSV upload
seonghobae
committed
3308105
fix(strix): restore trusted smoke status contract
seonghobae
committed
ee343c0
fix(security): pin OSV SARIF upload to PR head
seonghobae
committed
eef23ee
fix: log concrete scheduler merge blockers
seonghobae
committed
d79e230
docs: record central ruleset approval gate
seonghobae
committed
2658edd
fix(coverage): restore governance and docstring evidence
seonghobae
committed
7597427
test: align scorecard governance contract
seonghobae
committed
3eab19e
ci: bound opencode model pool queue stalls
seonghobae
committed
8c19679
Merge remote-tracking branch 'origin/main' into codex-pr374-osv-sarif-fix
seonghobae
committed
cb89e0b
fix(strix): keep scan token status read-only
seonghobae
committed
35366b7

Navigation Menu

Uh oh!

feat: central gap-filling security workflows (bandit/semgrep/gitleaks/pip-audit + periodic) + trivy/osv reconciliation - #374

feat: central gap-filling security workflows (bandit/semgrep/gitleaks/pip-audit + periodic) + trivy/osv reconciliation#374
seonghobae merged 23 commits into
mainfrom
feat/central-governance-gaps

Commits on Jul 11, 2026

feat: add central gap-filling security workflows + trivy/osv reconciliation

fix(security): hash-pin pip installs in central python-security & sast-semgrep gates

fix(security): mark clean OSV SARIF comprehensive

fix(ci): scope PR workflow concurrency by PR number

fix(noema): isolate workflow-run followup concurrency

fix(security): preserve OSV scan analysis category

fix(security): upload OSV clean SARIF to PR merge ref

fix(security): resolve PR merge SHA for OSV SARIF

fix(security): upload OSV SARIF against PR head

fix(security): fetch PR merge ref before OSV SARIF upload

fix(security): upload OSV SARIF against PR head

fix(security): keep Strix status publishing least privilege

test(strix): align smoke with read-only status token

fix(security): checkout PR merge ref before OSV upload

fix(strix): restore trusted smoke status contract

fix(security): pin OSV SARIF upload to PR head

fix: log concrete scheduler merge blockers

docs: record central ruleset approval gate

fix(coverage): restore governance and docstring evidence

test: align scorecard governance contract

ci: bound opencode model pool queue stalls

Merge remote-tracking branch 'origin/main' into codex-pr374-osv-sarif-fix

fix(strix): keep scan token status read-only