Skip to content

mono - chore: defense - record the lockdown audit #1737

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaredwray merged 4 commits into from
Oct 6, 2026
Merged

mono - chore: defense - record the lockdown audit #1737

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e5fb71d
chore: record the lockdown audit
cursoragent Oct 6, 2026
40561be
chore: record the lockdown pull request number
cursoragent Oct 6, 2026
5900172
chore: retrigger CI after a pre-existing cache-manager flake
cursoragent Oct 6, 2026
7068800
chore: qualify lifecycle scripts and the pending status
cursoragent Oct 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion DEFENSE_IN_DEPTH.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,4 +52,4 @@ Profile: npm library · public
## 7. Repository lockdown
- [x] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts (manual) — PR #1706
- [x] Recovery codes stored offline in a password manager (manual) — PR #1706
- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #1705, required checks updated PR #1707
- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #1705, required checks updated PR #1707, admin --check passed 2026-10-06 (PR #1737 is pending)
11 changes: 6 additions & 5 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,10 @@ hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_D
- CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; workflows are security-linted with zizmor on every PR.
- npm publishing authenticates with OIDC trusted publishing configured **stage-only** on each published package (GitHub Actions → `jaredwray/cacheable` → workflow `release.yml`). There are no npm tokens in Actions secrets, and packages disallow tokens. CI packs tarballs and stages them with `pnpm stage publish`; Drydock reviews staged releases; a maintainer promotes with 2FA. The release job `needs` a passing Aikido `scan-release`.
- GitHub and npm maintainer accounts use phishing-resistant 2FA (passkeys / hardware keys).
- pnpm is pinned via `packageManager` (`pnpm@11.5.1`), and the lockfile is committed.
- Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, and `trustPolicy: no-downgrade`.
- `packageManager` pins pnpm at 12.8.1. The lockfile is committed.
- pnpm installs dependencies with a 7-day cooldown, blocks lifecycle scripts by default, and sets `trustPolicy` to `no-downgrade`.
- There is no `.github/dependabot.yml`.
- Codespaces and Cursor Cloud Agents install through Aikido Safe Chain; package-manager shims must not be bypassed.
- Socket reviews every dependency change; Aikido scans every build.
- `.github/CODEOWNERS` names owners for `/.github/`, `/.cursor/`, `/.devcontainer/`, and `/scripts/`.
- Codespaces, Cursor Cloud Agents, and Claude Code on the web install through Aikido Safe Chain. Do not bypass the package-manager shims.
- The Dev Container image uses a digest pin. The tag is not `latest`.
- Socket reviews every dependency change. Aikido scans every build.
- `.github/CODEOWNERS` names owners for `/.github/`, `/.vscode/`, `/.cursor/`, `/.devcontainer/`, `/.claude/`, `/.codex/`, and `/scripts/`.
Loading