From 37735954c3b0a27f6fcc23d43c7f7067d01f8e75 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 25 Aug 2026 18:45:42 +0000 Subject: [PATCH 1/2] mono - chore: defense - record required checks test-22/24/26 Ruleset now requires test, test-22, test-24, test-26, and zizmor after the space-free matrix names landed. Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- SECURITY.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 594f7a92..411015ba 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -49,4 +49,4 @@ Profile: npm library · public ## 7. Repository lockdown - [x] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts — PR #1706 - [x] Recovery codes stored offline in a password manager — PR #1706 -- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #1705 +- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks "test,test-22,test-24,test-26,zizmor"` and `--allowed-actions "pnpm/*,codecov/*,cloudflare/*"` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #1705, required checks updated 2026-08-25 diff --git a/SECURITY.md b/SECURITY.md index 98405dd5..ad350451 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -23,7 +23,7 @@ We will acknowledge receipt, work with you on a coordinated disclosure timeline, This repository follows the [defense-in-depth](https://github.com/jaredwray/agentic/blob/main/skills/security/defense-in-depth-nodejs/SKILL.md) hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_DEPTH.md). Measures currently in place: -- All changes land through pull requests — direct pushes to `main` are blocked, and merging requires passing status checks. +- All changes land through pull requests — direct pushes to `main` are blocked, and merging requires passing status checks (`test`, `test-22`, `test-24`, `test-26`, `zizmor`). - Tags can only be created by repository admins; published GitHub Releases are immutable (assets and tags cannot be changed after publish). - Workflow runs from outside collaborators always require maintainer approval, and only allowlisted GitHub Actions can run. - CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; workflows are security-linted with zizmor on every PR. From f8630699154180695a6f74e37c4d7c89cfe1ae52 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 25 Aug 2026 18:45:57 +0000 Subject: [PATCH 2/2] mono - chore: defense - cite PR #1707 on required-check record Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 411015ba..4adf37df 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -49,4 +49,4 @@ Profile: npm library · public ## 7. Repository lockdown - [x] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts — PR #1706 - [x] Recovery codes stored offline in a password manager — PR #1706 -- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks "test,test-22,test-24,test-26,zizmor"` and `--allowed-actions "pnpm/*,codecov/*,cloudflare/*"` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #1705, required checks updated 2026-08-25 +- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks "test,test-22,test-24,test-26,zizmor"` and `--allowed-actions "pnpm/*,codecov/*,cloudflare/*"` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #1705, required checks updated PR #1707