7 Commits

Include renames

Author	SHA1	Message	Date
NuklearRabbit	acd8b82b09	M44: harden release integrity and assurance	2026-08-21 18:32:02 +02:00
NuklearRabbit	24dcb3494c	M41: harden trust boundaries and delivery	2026-08-21 17:06:59 +02:00
JensandClaude Fable 5	a830e8a2d0	ci(security): pin trivy-action to an existing tag (v0.30.0) so the gate can resolve on Gitea Actions ... The first real platform runs (2026-08-17, new instance runner) failed at 'Unable to resolve 0.30.0: reference not found' - the tag exists only as v0.30.0. Where present, the trufflehog GitHub Action (which fails under the act runner) is replaced by the pinned trufflehog binary in filesystem mode next to gitleaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-18 14:13:18 +02:00
NuklearRabbit	ae39a8947f	M39: harden application and acceptance gates	2026-08-17 03:17:44 +02:00
NuklearRabbit	a9f48d6880	fix(security): add secret-scan step to backend CI job ... Backend job had static checks (ruff/mypy) and a dependency-vulnerability gate but no secret scan; frontend had a dependency audit but no secret scan either. Adds trufflehog once, on the backend job's full checkout, covering the whole repository - the last gap for this repo to count as fully-authored.	2026-08-16 14:54:44 +02:00
NuklearRabbit	6859249570	fix(security): add backend dependency vulnerability gate to CI ... Backend CI had ruff/mypy static checks and a real pip-audit-equivalent was missing; frontend already had npm audit, so backend was the only side of this repo without any dependency-vulnerability gate (partial coverage). Adds trivy-action fs scoped to backend/, HIGH/CRITICAL only, consistent with this security programme's gate convention elsewhere. Verified clean (0 HIGH/CRITICAL) against backend/pyproject.toml before wiring in, so the gate does not immediately fail CI.	2026-08-16 04:41:07 +02:00
NuklearRabbit	686795a452	M16: isolate acceptance and harden readiness	2026-08-10 12:08:42 +02:00