feat(ci): scaffold reusable security and delivery workflows #6

Merged

gitchegumi merged 1 commit from ci/reusable-pipeline-scaffold into main

2026-09-03 21:42:11 -05:00

kiyi commented

2026-09-03 21:40:01 -05:00

Member

Add the initial shared pipeline shell so repositories in any organization or personal namespace can adopt consistent scan jobs without depending on Homelab infrastructure.

Includes four callable workflows: Gitleaks history/tree scans, Trivy dependency/IaC scans, Semgrep CE with reviewed local rules, and immutable-image scanning plus CycloneDX SBOM. Checkout is commit-pinned; tool versions are explicit and checked; missing tools, findings and scanner errors fail. Add caller examples, runner/security/adoption guidance, and deliberately inactive build/sign/publish/promote stages with optional Zarf/UDS packaging.

Validation: YAML parsing and Bash syntax passed; 16 mocked success/finding/scanner-error/version-mismatch cases passed. Published branch contents match the local validated tree. This is scaffold validation, not live scanner or Forgejo runner execution.

Activation remains tracked in #1, #3, #4 and #5; #2 retains separate Kubernetes runner-migration planning. Direct remote workflow calls require visibility compatibility validation. Documentation includes signed-in-only/vendored fallback and public commit-pinned calls. No visibility changes, bundles, images or deployments were performed.

After merge: update your checkout, resolve #3 runner/toolchain and library access, then adopt examples/ci.yml.example with approved versions/label and validate scan gates (#1/#4). Nothing needs bundling or deploying for this scaffold. Implement #5 before app delivery.

Add the initial shared pipeline shell so repositories in any organization or personal namespace can adopt consistent scan jobs without depending on Homelab infrastructure. Includes four callable workflows: Gitleaks history/tree scans, Trivy dependency/IaC scans, Semgrep CE with reviewed local rules, and immutable-image scanning plus CycloneDX SBOM. Checkout is commit-pinned; tool versions are explicit and checked; missing tools, findings and scanner errors fail. Add caller examples, runner/security/adoption guidance, and deliberately inactive build/sign/publish/promote stages with optional Zarf/UDS packaging. Validation: YAML parsing and Bash syntax passed; 16 mocked success/finding/scanner-error/version-mismatch cases passed. Published branch contents match the local validated tree. This is scaffold validation, not live scanner or Forgejo runner execution. Activation remains tracked in #1, #3, #4 and #5; #2 retains separate Kubernetes runner-migration planning. Direct remote workflow calls require visibility compatibility validation. Documentation includes signed-in-only/vendored fallback and public commit-pinned calls. No visibility changes, bundles, images or deployments were performed. After merge: update your checkout, resolve #3 runner/toolchain and library access, then adopt examples/ci.yml.example with approved versions/label and validate scan gates (#1/#4). Nothing needs bundling or deploying for this scaffold. Implement #5 before app delivery.

kiyi added 1 commit

2026-09-03 21:40:01 -05:00

feat(ci): scaffold reusable security and delivery workflows 34d989eba1

kiyi referenced this pull request

2026-09-03 21:40:24 -05:00

Add secret scanning for commits and Forgejo Actions #1

kiyi referenced this pull request

2026-09-03 21:40:30 -05:00

Establish versioned workflows reusable across organizations #3