ba833e53c0
Merge remote-tracking branch 'origin/main'
...
Change-source: pulse-maintainer
2026-09-01 11:00:03 +01:00
4e22a49f02
Add native PVE action qualification harness
2026-09-01 10:43:35 +01:00
faf69f76e6
Keep workflow outputs out of generated shell
...
Change-source: pulse-maintainer
2026-09-01 10:16:41 +01:00
6962b096de
Merge remote-tracking branch 'origin/main'
...
Change-source: pulse-maintainer
2026-09-01 10:05:53 +01:00
f313882a7b
Pin container provenance workflow revision
...
Change-source: pulse-maintainer
2026-09-01 09:56:14 +01:00
cbd95d0141
Make Go module security floors real floor checks
...
The dependency-floor smoke test asserted exact go list output, so the
maintainer lane's legitimate x/crypto v0.55.0 bump (which moved x/net to
v0.57.0) failed the Script smoke tests job on main even though both
versions clear the advisory floor. Compare versions with sort -V against
the advisory-safe minimum instead: upgrades pass, only a downgrade below
the floor fails. Verified the failing direction and the equal-version
case locally.
2026-09-01 09:54:59 +01:00
fc691c3a05
Require hosted provenance for release containers
...
Change-source: pulse-maintainer
2026-09-01 09:36:24 +01:00
f12c4007ab
Serialize stable demo operations
...
Change-source: pulse-maintainer
2026-09-01 08:47:52 +01:00
ba727edf12
Refresh trusted checkout action
...
Change-source: pulse-maintainer
2026-09-01 02:31:08 +01:00
e1bce8b77f
Build release payloads on ephemeral runners
...
Change-source: pulse-maintainer
2026-09-01 01:41:09 +01:00
2222c5ce37
Make security review baseline fail closed
2026-09-01 01:02:17 +01:00
f967857928
Harden secure agent recovery transports
2026-08-31 23:12:00 +01:00
2aece859a5
Harden safe rootless runtime recovery
2026-08-31 22:17:07 +01:00
72d3ebb501
Keep hot-dev build temp on the configured Go temp volume
...
The Go linker's dsymutil step writes DWARF output under TMPDIR rather
than GOTMPDIR, so backend builds failed with ENOSPC on the
space-constrained boot volume even with GOCACHE and GOTMPDIR already on
the Development SSD. hot-dev now exports TMPDIR from the machine's
configured GOTMPDIR when one exists, keeping every build temp file on
the same volume as the rest of the build state.
2026-08-31 22:11:38 +01:00
bd146586e8
Make release continuity failures actionable
...
Change-source: pulse-maintainer
2026-08-31 21:20:30 +01:00
83cc5e5642
Give stable backend qualification full completion headroom
2026-08-31 19:05:32 +01:00
0f7a8683c2
Block privileged workflow code ingress
...
Change-source: pulse-maintainer
2026-08-31 18:21:45 +01:00
5754d924d7
Add rootful Docker secure-runtime qualification
2026-08-31 18:13:22 +01:00
ed6f429674
Make action runner authority state crash-safe
2026-08-31 17:34:30 +01:00
8f877bee14
Bind privileged workflow runs to canonical code
...
Change-source: pulse-maintainer
2026-08-31 17:09:53 +01:00
da36bcd482
Keep subsystem lookup tests checkout-independent
...
Change-source: pulse-maintainer
2026-08-31 16:00:47 +01:00
cdfcac5756
Refresh v6.4.2 final cutoff
2026-08-31 13:46:43 +01:00
69cbe5f3b8
Enforce protected GitHub checkout baseline
2026-08-31 13:21:25 +01:00
164b747e83
Make contract audit tests checkout-independent
2026-08-31 12:26:33 +01:00
ee881d4849
Refresh v6.4.2 release cutoff
2026-08-31 12:14:12 +01:00
2ddd12cb31
Repair v6.4.2 Helm provenance
2026-08-31 11:59:11 +01:00
d5945f824d
Preserve Pulse severity in systemd journal
2026-08-31 11:46:51 +01:00
f47ac1f020
Define beta and RC release maturity
2026-08-31 11:42:03 +01:00
70c1d0a178
Authenticate RC artifacts before qualification
2026-08-31 09:49:41 +01:00
da62890d82
Refresh v6.4.2 release packet
2026-08-31 09:45:27 +01:00
2ff027a743
Bind release candidate version explicitly
2026-08-31 09:37:28 +01:00
240adaa5e4
Authenticate every published installer
2026-08-31 04:55:15 +01:00
a190703fe5
Reject ambiguous release checksum manifests
2026-08-31 04:40:34 +01:00
445ebacf24
Restore delivery qualification trust
...
Harden release workflow input transport and make native lifecycle proof honor each platform security boundary. Refresh stale telemetry and delivery qualifications.
Contract-Neutral: Formatting-only catalog updates and browser-verified alert copy; release compiler and native lifecycle changes update their owning contracts.
2026-08-31 03:02:13 +01:00
fda955627f
Bound GitHub Actions job runtimes
2026-08-31 02:00:09 +01:00
7650fdaba3
Wire secure runtime RC qualification
2026-08-31 01:50:48 +01:00
d3884d64db
Prepare v6.4.2 security patch
2026-08-31 01:03:09 +01:00
eb0d17c282
Restore trustworthy governance signals
2026-08-31 00:55:44 +01:00
22fd662fb7
Match secure runtime revoke protocol
2026-08-31 00:33:49 +01:00
b1028a23af
Align secure runtime lifecycle fixture auth
2026-08-31 00:22:22 +01:00
f87308fb63
Fix secure runtime qualification admission
2026-08-31 00:15:43 +01:00
08f7c5f0d5
Harden secure agent runtime boundaries
2026-08-31 00:06:24 +01:00
47c1cee895
Enforce least-privilege job tokens
2026-08-30 22:11:40 +01:00
a8bc2e044b
Qualify helper-backed agent update recovery
2026-08-30 21:54:46 +01:00
e094a55b45
Integrate typed helper container summaries
2026-08-30 21:29:11 +01:00
cb079c9de0
Publish portable candidate build provenance
2026-08-30 20:34:04 +01:00
defc24af83
Bind receipt completion to final evidence event
2026-08-30 19:06:37 +01:00
b369dc5410
Accept canonical schema-v4 runtime evidence
2026-08-30 18:58:49 +01:00
77afff4f60
Bind action runner to enrolled agent identity
2026-08-30 18:49:12 +01:00
65bec55229
Exercise pending runner activation in systemd lab
2026-08-30 18:24:29 +01:00
pulse-triage[bot]