All pull requests

Pull requests

• feat(#64): build-provenance reusable workflow for SLSA and SBOM attestations

  #160·ms280690 opened Oct 9, 2026Collaborator·

  ·
  

• feat(#15): cosign image signing and verification composite and workflows

  #159·ms280690 opened Oct 9, 2026Collaborator·

  ·
  1

  

• feat(#63): grype SBOM scan composite and sbom-scan reusable workflow

  #158·ms280690 opened Oct 8, 2026Collaborator·

  ·
  1

  

• feat(#62): syft SBOM composite and sbom-generate reusable workflow

  #157·ms280690 opened Oct 8, 2026Collaborator·

  ·
  1

  1

  

• ci: Bump github/codeql-action/upload-sarif from 4.35.5 to 4.38.2

  dependenciesgithub_actions
  #156·dependabot[bot] opened Oct 8, 2026Bot·

  ·

• ci: Bump step-security/harden-runner from 2.19.4 to 2.21.1

  dependenciesgithub_actions
  #155·dependabot[bot] opened Oct 8, 2026Bot·

  ·

• docs(#112): threat feed reference, expiry policy, quality log, MISP graduation

  #154·ms280690 opened Oct 7, 2026Collaborator·3 tasks done·

  ·
  

• feat(#109): daily threat-feeds mirror and threat-feeds composite

  #153·ms280690 opened Oct 7, 2026Collaborator·5 tasks done·

  ·
  

• docs(#81): finding-to-SLA mapping, exception issue form and label set

  #152·ms280690 opened Oct 7, 2026Collaborator·3 tasks done·

  ·
  1

  

• feat(#77): org policy gate on rendered manifests with conftest

  #151·ms280690 opened Oct 7, 2026Collaborator·4 of 5 tasks·

  ·
  1

  

• feat(#7): Helm/Kustomize scan gate — trivy misconfig, secrets and image CVEs

  #150·ms280690 opened Oct 7, 2026Collaborator·3 of 4 tasks·

  ·
  1

  2

  

• feat(#73): Go test gate — go test -race reusable workflow

  #148·ms280690 opened Oct 7, 2026Collaborator·4 of 5 tasks·

  ·
  1

  

• feat(#72): Node test gate — vitest / jest reusable workflow

  #147·ms280690 opened Oct 7, 2026Collaborator·4 of 5 tasks·

  ·
  1

  

• feat(#71): Python test gate — pytest + coverage reusable workflow

  #146·ms280690 opened Oct 7, 2026Collaborator·4 of 5 tasks·

  ·
  1

  

• feat(#19): SAST deep tier reusable workflow — CodeQL with a blocking gate

  #145·ms280690 opened Oct 7, 2026Collaborator·4 tasks done·

  ·
  1

  6

  

• feat(#18): SAST pre-commit tier reusable workflow — semgrep

  #144·ms280690 opened Oct 7, 2026Collaborator·4 tasks done·

  ·
  1

  2

  

• feat(#14): container image scan reusable workflow — trivy

  #143·ms280690 opened Oct 7, 2026Collaborator·4 tasks done·

  ·
  1

  1

  

• feat(#13): Dockerfile lint reusable workflow — hadolint + digest-pin check

  #142·ms280690 opened Oct 7, 2026Collaborator·5 tasks done·

  ·
  1

  1

  

• feat(#6): IaC misconfiguration scan reusable workflow — checkov

  #141·ms280690 opened Oct 7, 2026Collaborator·5 tasks done·

  ·
  1

  2

  

• feat(#87): Dependabot owns github-actions; grouped weekly PRs; reference config and docs

  #140·ms280690 opened Oct 7, 2026Collaborator·4 tasks done·

  ·
  1

  

• feat(#83): harden-runner block mode with per-job egress allowlists

  #139·ms280690 opened Oct 7, 2026Collaborator·

  ·
  1

  

• feat(#79): one severity vocabulary across scan gates; shared severity-gate composite

  #135·ms280690 opened Oct 7, 2026Collaborator·

  ·
  1

  

• feat: dependency scan reusable workflow — osv-scanner (#5)

  #54·ms280690 opened Jul 16, 2026Collaborator·3 tasks done·

  ·
  1

  2