20 Commits

Include renames

Author	SHA1	Message	Date
NuklearRabbit	c7b28beb71	hygiene: prepare MobilityOps for public release	2026-09-02 23:37:29 +02:00
NuklearRabbit	92bdfb421b	Merge remote-tracking branch 'origin/master' into codex/resolve-projectbrain-findings-20260828 ... # Conflicts: # .dockerignore # .gitea/workflows/ci.yml # .gitea/workflows/live-canary.yml # .gitea/workflows/release.yml	2026-09-01 20:42:10 +02:00
NuklearRabbit	d6a566e1a1	ci: keep workflow-only pull requests lightweight	2026-08-29 09:07:38 +02:00
NuklearRabbit	4b727a109f	ci: avoid duplicate post-merge acceptance	2026-08-29 09:04:25 +02:00
NuklearRabbit	55e8ebd81e	fix(ci): isolate demo resets and keep acceptance deterministic	2026-08-29 08:48:06 +02:00
NuklearRabbit	b2bdb78baa	fix(ci): reach DIND services over the compose network	2026-08-29 08:36:14 +02:00
NuklearRabbit	fe92a7f491	ci: consolidate validation and split lightweight probes	2026-08-29 06:59:02 +02:00
NuklearRabbit	19df5f7508	ci: keep one required pull-request gate	2026-08-29 05:38:23 +02:00
NuklearRabbit	2918608240	fix(ci): isolate contract and image scans from host paths	2026-08-29 00:27:17 +02:00
NuklearRabbit	a99aed9a5f	perf(ci): deduplicate branch validation	2026-08-28 23:59:30 +02:00
NuklearRabbit	00e8ec001b	fix(ci): run secret scan inside isolated workspace	2026-08-28 23:57:46 +02:00
NuklearRabbit	d20ff7a243	fix(ci): upgrade pinned Trivy action	2026-08-28 23:42:59 +02:00
NuklearRabbit	00191e9b54	M48: harden demo operations and offsite recovery	2026-08-21 22:17:49 +02:00
NuklearRabbit	acd8b82b09	M44: harden release integrity and assurance	2026-08-21 18:32:02 +02:00
NuklearRabbit	24dcb3494c	M41: harden trust boundaries and delivery	2026-08-21 17:06:59 +02:00
JensandClaude Fable 5	a830e8a2d0	ci(security): pin trivy-action to an existing tag (v0.30.0) so the gate can resolve on Gitea Actions ... The first real platform runs (2026-08-17, new instance runner) failed at 'Unable to resolve 0.30.0: reference not found' - the tag exists only as v0.30.0. Where present, the trufflehog GitHub Action (which fails under the act runner) is replaced by the pinned trufflehog binary in filesystem mode next to gitleaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-18 14:13:18 +02:00
NuklearRabbit	ae39a8947f	M39: harden application and acceptance gates	2026-08-17 03:17:44 +02:00
NuklearRabbit	a9f48d6880	fix(security): add secret-scan step to backend CI job ... Backend job had static checks (ruff/mypy) and a dependency-vulnerability gate but no secret scan; frontend had a dependency audit but no secret scan either. Adds trufflehog once, on the backend job's full checkout, covering the whole repository - the last gap for this repo to count as fully-authored.	2026-08-16 14:54:44 +02:00
NuklearRabbit	6859249570	fix(security): add backend dependency vulnerability gate to CI ... Backend CI had ruff/mypy static checks and a real pip-audit-equivalent was missing; frontend already had npm audit, so backend was the only side of this repo without any dependency-vulnerability gate (partial coverage). Adds trivy-action fs scoped to backend/, HIGH/CRITICAL only, consistent with this security programme's gate convention elsewhere. Verified clean (0 HIGH/CRITICAL) against backend/pyproject.toml before wiring in, so the gate does not immediately fail CI.	2026-08-16 04:41:07 +02:00
NuklearRabbit	686795a452	M16: isolate acceptance and harden readiness	2026-08-10 12:08:42 +02:00