Merge remote-tracking branch 'origin/chatgpt/release-hygiene-20260830'

.gitea/workflows/quality.yml

@@ -9,7 +9,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
       - name: Secret scan
         shell: bash
         run: |
@@ -23,8 +23,8 @@ jobs:
     # Browser quality runs against the dedicated bounded Windows 11 VM runner.
     runs-on: windows-native
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
@@ -38,7 +38,7 @@ jobs:
       - run: npm run test:browser:ci
       - name: Preserve browser failure evidence
         if: failure()
-        uses: actions/upload-artifact@v3.2.2-node20
+        uses: https://gitea.com/actions/upload-artifact@v3.2.2-node20
         with:
           name: forgeflow-browser-failure-evidence
           path: artifacts/

.gitea/workflows/release.yml

@@ -15,10 +15,10 @@ jobs:
   release:
     runs-on: windows-native
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@v4
         with:
           fetch-depth: 2
-      - uses: actions/setup-node@v4
+      - uses: https://gitea.com/actions/setup-node@v4
         with:
           node-version: 22
           cache: npm

SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+ForgeFlow's detailed security model is documented in [`docs/SECURITY.md`](docs/SECURITY.md).
+
+Report suspected vulnerabilities privately to the repository owner. Do not publish Gitea tokens, SSH credentials, update-signing material, private server addresses, support bundles containing sensitive data or other operational secrets in a public issue.
+
+For a useful report, include the affected ForgeFlow version/commit, component, minimal reproduction steps, expected and observed behaviour and security impact. Use sanitized or synthetic repository/server data whenever possible.
+
+The current release model requires exact-commit verification, origin-constrained credential use, signed update manifests, redacted diagnostics and bounded deployment adapters. Changes must not silently weaken those guarantees.