donghyeon.kang/clean-architecture-frontend-template
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: harden CI evidence and removal contracts

Browse Source
This commit is contained in:
DongHyeonka
2026-08-02 14:48:04 +09:00
parent 1bb2cc4a20
commit f49d147b01
20 changed files with 1175 additions and 767 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/supply-chain.md
+2 -2
View File
@@ -95,8 +95,8 @@ mandatory before any generated job becomes a required check.
External provider supervision is fail-closed and requires a Linux runner with
an executable `/usr/bin/bwrap`. Bubblewrap mounts the repository workspace
read-only, hides `.git`, pins the trusted Node executable at
`/usr/local/bin/node`, and exposes only the sibling `untrusted` raw-evidence
read-only, hides `.git`, and read-only binds the trusted `process.execPath`
inside the sandbox at `/tmp/node`. It exposes only the sibling `untrusted` raw-evidence
directory as writable. Provider commands run non-interactively through
`/bin/sh -eu -c`, receive a minimized environment plus only their own
provider-prefixed credentials, and have a 30-minute limit. They must consume