diff --git a/.github/workflows/elixir-ci.yml.rej b/.github/workflows/elixir-ci.yml.rej deleted file mode 100644 index 8a6c1fa..0000000 --- a/.github/workflows/elixir-ci.yml.rej +++ /dev/null @@ -1,11 +0,0 @@ ---- .github/workflows/elixir-ci.yml -+++ .github/workflows/elixir-ci.yml -@@ -19,7 +19,7 @@ permissions: - - jobs: - elixir-ci: -- uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 -+ uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - with: - otp-version: "27.2.1" - elixir-version: "1.18.2" diff --git a/.github/workflows/governance.yml.orig b/.github/workflows/governance.yml.orig deleted file mode 100644 index 76a63ca..0000000 --- a/.github/workflows/governance.yml.orig +++ /dev/null @@ -1,34 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-guix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 diff --git a/.github/workflows/governance.yml.rej b/.github/workflows/governance.yml.rej deleted file mode 100644 index faf27ee..0000000 --- a/.github/workflows/governance.yml.rej +++ /dev/null @@ -1,7 +0,0 @@ ---- .github/workflows/governance.yml -+++ .github/workflows/governance.yml -@@ -31,4 +31,4 @@ permissions: - - jobs: - governance: -- uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9+ uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/mirror.yml.rej b/.github/workflows/mirror.yml.rej deleted file mode 100644 index c4879e9..0000000 --- a/.github/workflows/mirror.yml.rej +++ /dev/null @@ -1,9 +0,0 @@ ---- .github/workflows/mirror.yml -+++ .github/workflows/mirror.yml -@@ -11,5 +11,5 @@ permissions: - - jobs: - mirror: -- uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 -+ uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - secrets: inherit diff --git a/.github/workflows/scorecard.yml.orig b/.github/workflows/scorecard.yml.orig deleted file mode 100644 index 20a29ea..0000000 --- a/.github/workflows/scorecard.yml.orig +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Scorecards supply-chain security - -on: - branch_protection_rule: - schedule: - - cron: '23 4 * * 1' - -permissions: read-all - -jobs: - analysis: - permissions: - security-events: write - id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 - secrets: inherit diff --git a/.github/workflows/scorecard.yml.rej b/.github/workflows/scorecard.yml.rej deleted file mode 100644 index a3c95fb..0000000 --- a/.github/workflows/scorecard.yml.rej +++ /dev/null @@ -1,22 +0,0 @@ ---- .github/workflows/scorecard.yml -+++ .github/workflows/scorecard.yml -@@ -6,12 +6,14 @@ on: - schedule: - - cron: '23 4 * * 1' - --permissions: read-all -- -+permissions: -+ contents: read -+ security-events: write -+ id-token: write - jobs: - analysis: - permissions: -- security-events: write -- id-token: write -- uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 -+ contents: read -+ security-events: write -+ id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 - secrets: inherit \ No newline at end of file diff --git a/.github/workflows/secret-scanner.yml.orig b/.github/workflows/secret-scanner.yml.orig deleted file mode 100644 index 7ccae92..0000000 --- a/.github/workflows/secret-scanner.yml.orig +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - secrets: inherit diff --git a/.github/workflows/secret-scanner.yml.rej b/.github/workflows/secret-scanner.yml.rej deleted file mode 100644 index 30ff515..0000000 --- a/.github/workflows/secret-scanner.yml.rej +++ /dev/null @@ -1,9 +0,0 @@ ---- .github/workflows/secret-scanner.yml -+++ .github/workflows/secret-scanner.yml -@@ -17,5 +17,5 @@ jobs: - scan: - permissions: - contents: read -- uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 -+ uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - secrets: inherit \ No newline at end of file diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml index 458a29a..e805c50 100644 --- a/audits/assail-classifications.a2ml +++ b/audits/assail-classifications.a2ml @@ -1,37 +1,42 @@ %A2ML -- suppression: - file: 'assets/js/hooks/prompt_radar_hook.js' - rule: 'DynamicCodeExecution' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'assets/js/hooks/evidence_graph_hook.js' - rule: 'DynamicCodeExecution' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'assets/js/hooks/timeline_hook.js' - rule: 'DynamicCodeExecution' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'config/test.exs' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'config/dev.exs' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'test/evidence_graph/accounts_test.exs' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'lib/evidence_graph/zotero/client.ex' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'lib/evidence_graph/accounts.ex' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'lib/evidence_graph/lithoglyph/client.ex' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' +# SPDX-License-Identifier: MPL-2.0 +name: 'assail-classifications' +project: 'bofig' +version: '1.0.0' +suppressions: + - suppression: + file: 'assets/js/hooks/prompt_radar_hook.js' + rule: 'DynamicCodeExecution' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'assets/js/hooks/evidence_graph_hook.js' + rule: 'DynamicCodeExecution' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'assets/js/hooks/timeline_hook.js' + rule: 'DynamicCodeExecution' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'config/test.exs' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'config/dev.exs' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'test/evidence_graph/accounts_test.exs' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'lib/evidence_graph/zotero/client.ex' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'lib/evidence_graph/accounts.ex' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'lib/evidence_graph/lithoglyph/client.ex' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).'