23 Commits

Author	SHA1	Message	Date
pulse-triage[bot]	5b204cdc75	Close mirrored workflow scalar syntax gaps ... Recognize bare sequence entries and every valid block scalar header across executable action inputs, run scripts, and step environment boundaries. Change-source: pulse-maintainer	2026-09-01 22:13:37 +01:00
pulse-triage[bot]	22cc59cc2c	Reject template injection in executable action inputs ... Change-source: pulse-maintainer	2026-09-01 21:35:35 +01:00
pulse-triage[bot]	a869475bf1	Reject flow-nested YAML trust aliases ... Change-source: pulse-maintainer	2026-09-01 21:21:45 +01:00
pulse-triage[bot]	8cd5c2cae5	Reject hidden workflow trust structure ... Change-source: pulse-maintainer	2026-09-01 21:18:26 +01:00
pulse-triage[bot]	028ccbd35f	Keep OIDC attestations on hosted runners ... Change-source: pulse-maintainer	2026-09-01 20:17:13 +01:00
pulse-triage[bot]	c10e93943b	Parse workflow job trust boundaries structurally ... Change-source: pulse-maintainer	2026-09-01 19:46:57 +01:00
pulse-triage[bot]	5c26a8f6d1	Close privileged workflow cache audit bypasses ... Change-source: pulse-maintainer	2026-09-01 19:31:06 +01:00
pulse-triage[bot]	f61815839f	Keep unsigned caches out of privileged workflows ... Change-source: pulse-maintainer	2026-09-01 19:29:37 +01:00
pulse-triage[bot]	de41ea1883	Preserve workflow taint across branches ... Change-source: pulse-maintainer	2026-09-01 17:34:30 +01:00
pulse-triage[bot]	7fd93457f1	Harden workflow alias taint tracking ... Change-source: pulse-maintainer	2026-09-01 16:58:55 +01:00
pulse-triage[bot]	4f7a3d0006	Close runner output alias bypasses ... Change-source: pulse-maintainer	2026-09-01 16:54:07 +01:00
pulse-triage[bot]	c55db584c1	Harden GitHub command file data boundaries ... Change-source: pulse-maintainer	2026-09-01 16:32:15 +01:00
pulse-triage[bot]	97a39e8819	Block dispatch payload shell injection ... Change-source: pulse-maintainer	2026-09-01 14:35:07 +01:00
pulse-triage[bot]	faf69f76e6	Keep workflow outputs out of generated shell ... Change-source: pulse-maintainer	2026-09-01 10:16:41 +01:00
pulse-triage[bot]	0f7a8683c2	Block privileged workflow code ingress ... Change-source: pulse-maintainer	2026-08-31 18:21:45 +01:00
pulse-triage[bot]	8f877bee14	Bind privileged workflow runs to canonical code ... Change-source: pulse-maintainer	2026-08-31 17:09:53 +01:00
pulse-triage[bot]	69cbe5f3b8	Enforce protected GitHub checkout baseline	2026-08-31 13:21:25 +01:00
pulse-triage[bot]	fda955627f	Bound GitHub Actions job runtimes	2026-08-31 02:00:09 +01:00
pulse-triage[bot]	47c1cee895	Enforce least-privilege job tokens	2026-08-30 22:11:40 +01:00
pulse-triage[bot]	a0dfdadc5e	Close workflow trust policy gaps	2026-08-30 15:06:00 +01:00
pulse-triage[bot]	21007a8662	Isolate private governance from pull requests	2026-08-30 15:02:41 +01:00
pulse-triage[bot]	d8986c139a	Enforce workflow data trust boundaries ... Contract-Neutral: Moves workflow expressions into environment data flow without changing deployment interfaces or behavior.	2026-08-30 04:56:34 +01:00
pulse-triage[bot]	a2bfadba7b	Enforce workflow execution trust boundaries	2026-08-30 04:44:25 +01:00