build: 7-day supply-chain soak + pinned security tooling (sfw, zizmor, agent/skills scanners, taze) - #6912

Merged

proggeramlug merged 12 commits into

PerryTS:mainfrom

jdalton:build/security-tooling-soak

Jul 28, 2026

Commits on Jul 28, 2026

build: 7-day supply-chain soak + pinned security tooling
jdalton
committed
93c2b36
docs: changelog fragment for #6912
jdalton
committed
8efeaff
ci(zizmor): run the SRI-pinned binary instead of the marketplace action
jdalton
committed
3b73baf
deps(sfw): bump firewall pins to 1.14.0 via dated soakBypass
jdalton
committed
239e573
deps(tools): bump zizmor 1.28.0, pnpm 11.15.1, npm 12.0.1 — newest soaked releases
jdalton
committed
c9dc5f5
docs: fragment says rack-pinned zizmor, not marketplace action
jdalton
committed
71b13f6
feat(soak): auto-prune expired bypass annotations — fixer + scheduled bot PR
jdalton
committed
fc7e3f1
ci(soak-autofix): bind the artipacked ignore to the checkout line
jdalton
committed
6cc276e
ci: pin actions/* to latest release-tag SHAs in the new security workflows
jdalton
committed
4fe87ad
fix(soak): expired annotations warn instead of failing — stale is not unsafe
jdalton
committed
07ca0a9
fix(soak): address review-bot findings across the port
jdalton
committed
e3dda61
fix(sfw): export SFW_UNKNOWN_HOST_ACTION=ignore in the shims
jdalton
committed
d882d5a