| Workflow SHA pinning |
repo-config.md |
scripts/check-uses-sha-pinned.sh |
lint-workflow-security |
uses-sha-pinned |
| action pin comment |
../architecture/pin-convention.md |
scripts/check-patch-tag-pins.sh |
(none) |
patch-tag-pins |
| Pin digest provenance |
repo-config.md |
scripts/check-pin-digest-provenance.sh |
lint-doc-invariants |
(none) |
| Renovate invariants |
repo-config.md |
scripts/check-renovate-invariants.sh, scripts/check-renovate-config-validator.sh |
renovate-invariants, lint-doc-invariants |
renovate-config-validator |
| No dead renovate markers |
repo-config.md |
scripts/check-renovate-markers-matched.sh |
renovate-invariants |
(none) |
| Bump-script integrity |
verification.md |
scripts/check-gh-api-version-header.sh, scripts/check-bump-script-integrity.sh |
lint-script-hygiene |
gh-api-version-header, bump-script-integrity |
| verify-latest-release parity + attribution |
verification.md |
(none) |
(none) |
(none) |
| Failure-reason ladder coverage |
verification.md |
scripts/check-verify-reason-ladder.sh |
lint-workflow-security |
verify-reason-ladder |
| Gitleaks / TruffleHog / Dependency review / Trivy / Grype / SBOM |
verification.md |
(none) |
(none) |
(none) |
| Cosign keyless signing |
verification.md |
(none) |
(none) |
(none) |
| gh attestation verify --repo pin |
verification.md |
scripts/check-gh-attestation-repo.sh |
lint-workflow-security |
gh-attestation-repo |
| cosign verify identity + issuer pin |
verification.md |
scripts/check-cosign-identity-pinned.sh |
lint-workflow-security |
cosign-identity-pinned |
| Release-asset blob signatures |
verification.md |
(none) |
(none) |
(none) |
| Release-asset provenance sidecar |
verification.md |
(none) |
(none) |
(none) |
| Bump credentials blast-radius |
trust-model.md |
(none) |
(none) |
(none) |
| PR-triggered workflow secret allowlist |
trust-model.md |
scripts/check-pr-workflows-no-secrets.sh |
pr-workflows-no-secrets |
(none) |
| flake.lock input staleness |
../architecture/auto-update.md |
scripts/check-flake-lock-staleness.sh |
(none) |
(none) |
| flake.lock input provenance |
trust-model.md |
scripts/check-flake-lock-provenance.sh |
lint-doc-invariants |
(none) |
| harden-runner |
trust-model.md |
scripts/check-harden-runner-first.sh |
lint-workflow-security |
harden-runner-first |
| harden-runner block egress |
trust-model.md |
scripts/check-harden-runner-block.sh |
lint-workflow-security |
harden-runner-block |
| egress allowlist matches tool inventory |
trust-model.md |
scripts/check-egress-allowlist.sh |
lint-workflow-security |
egress-allowlist |
| Per-job timeout-minutes |
workflow-hardening.md |
scripts/check-job-timeout-minutes.sh |
lint-workflow-security |
job-timeout-minutes |
| Workflow YAML holds no Unicode space |
workflow-hardening.md#workflow-ascii-space |
scripts/check-workflow-ascii-space.sh |
lint-workflow-security |
(none) |
| Workflow concurrency group |
workflow-hardening.md |
scripts/check-workflow-concurrency.sh |
lint-workflow-security |
workflow-concurrency |
| Checkout persist-credentials false |
workflow-hardening.md |
scripts/check-checkout-persist-credentials.sh |
lint-workflow-security |
checkout-persist-credentials |
| upload-artifact strict |
workflow-hardening.md |
scripts/check-upload-artifact-strict.sh |
lint-workflow-security |
upload-artifact-strict |
| Workflow on.branches main-only |
workflow-hardening.md |
scripts/check-workflow-on-branches.sh |
lint-workflow-security |
workflow-on-branches |
| pull_request_target forbidden |
workflow-hardening.md |
scripts/check-pull-request-target-absent.sh |
lint-workflow-security |
pull-request-target-absent |
| Auto-merge decline gate |
workflow-hardening.md |
scripts/check-auto-merge-decline-gate.sh |
lint-workflow-security |
auto-merge-decline-gate |
| scripts/*.sh shebang + pipefail |
workflow-hardening.md |
scripts/check-script-shebang-pipefail.sh |
lint-script-hygiene |
script-shebang-pipefail |
| Harness preamble |
workflow-hardening.md |
scripts/check-harness-preamble.sh |
lint-script-hygiene |
(none) |
| No opaque process-substitution loops in scripts |
workflow-hardening.md |
scripts/check-no-opaque-procsub.sh |
lint-script-hygiene |
no-opaque-procsub |
| Library sourcing is tool-free |
workflow-hardening.md |
scripts/check-lib-source-tool-free.sh |
lint-script-hygiene |
(none) |
| Could-not-run guards exit 2 |
workflow-hardening.md |
scripts/check-guard-exit-code.sh |
lint-script-hygiene |
(none) |
| Temp files created through the guarded helper |
workflow-hardening.md |
scripts/check-guard-exit-code.sh |
lint-script-hygiene |
(none) |
| Repository root resolved through the guarded helper |
workflow-hardening.md |
scripts/check-guard-exit-code.sh |
lint-script-hygiene |
(none) |
| Exit contracts document could-not-run |
workflow-hardening.md |
scripts/check-exit-contract-documented.sh |
lint-script-hygiene |
(none) |
| Third-party tool use is guarded |
workflow-hardening.md |
scripts/check-tool-guarded.sh |
lint-script-hygiene |
(none) |
| Regex ranges hold ASCII |
workflow-hardening.md#regex-range-ascii |
scripts/check-regex-range-ascii.sh |
lint-script-hygiene |
(none) |
| No control characters in tracked paths |
workflow-hardening.md |
scripts/check-path-hygiene.sh |
lint-script-hygiene |
(none) |
| awk file operands spelled explicit |
workflow-hardening.md |
scripts/check-awk-operand-explicit.sh |
lint-script-hygiene |
(none) |
| Filesystem enumerations run through the helper |
workflow-hardening.md |
scripts/check-enumerate-helper-required.sh |
lint-script-hygiene |
(none) |
| Glob-driven scans run through the helper |
workflow-hardening.md |
scripts/check-enumerate-helper-required.sh |
lint-script-hygiene |
(none) |
| Filter-narrowed scans run through the helper |
workflow-hardening.md |
scripts/check-enumerate-helper-required.sh |
lint-script-hygiene |
(none) |
| Payload shape-gate scenario coverage |
workflow-hardening.md |
scripts/check-payload-shape-scenario.sh |
lint-script-hygiene |
(none) |
| Payload source-naming runs through the helper |
workflow-hardening.md |
scripts/check-payload-source-helper.sh |
lint-script-hygiene |
(none) |
| Payload reads run through the helper |
workflow-hardening.md |
scripts/check-payload-source-helper.sh |
lint-script-hygiene |
(none) |
| check-script ↔ test pairing |
workflow-hardening.md |
scripts/check-script-has-test.sh |
lint-script-hygiene |
script-has-test |
| test-runner reachability |
workflow-hardening.md |
scripts/check-test-reachable.sh |
lint-script-hygiene |
(none) |
| harness assertion discrimination |
workflow-hardening.md |
scripts/check-harness-assert-wired.sh |
lint-script-hygiene |
harness-assert-wired |
| harness exemption ratchet |
workflow-hardening.md |
scripts/check-harness-assert-wired.sh |
lint-script-hygiene |
harness-assert-wired |
| harness census parity |
workflow-hardening.md#harness-census-parity |
scripts/check-harness-assert-wired.sh |
lint-script-hygiene |
harness-assert-wired |
| harness subject declaration |
workflow-hardening.md |
scripts/refresh-test-harnesses.sh |
doc-freshness |
test-harnesses-fresh |
| manifest-reaching hook watches nix/hooks |
workflow-hardening.md |
scripts/check-manifest-hook-watches-nix.sh |
lint-script-hygiene |
manifest-hook-watches-nix |
| freshness hook watches evaluated sources |
workflow-hardening.md |
scripts/check-freshness-hook-watches-modules.sh |
lint-script-hygiene |
freshness-hook-watches-modules |
| lean lint-shell routing |
workflow-hardening.md |
(none) |
(none) |
(none) |
| lean lint-shell tool guard |
workflow-hardening.md |
scripts/check-lint-shell-tools.sh |
lint-script-hygiene |
lint-shell-tools |
| ci.yml job ↔ summary category |
workflow-hardening.md |
scripts/check-ci-job-in-summary.sh |
lint-doc-invariants |
ci-job-in-summary |
| Multi-line run: strict-mode prelude |
workflow-hardening.md |
scripts/check-run-block-strict.sh |
lint-workflow-security |
run-block-strict |
| Fork-guard on guard-required jobs |
workflow-hardening.md |
scripts/check-fork-guard-release.sh |
lint-workflow-security |
fork-guard-release |
No unpinned nix run nixpkgs# |
workflow-hardening.md |
scripts/check-nix-run-pinned.sh |
lint-workflow-security |
nix-run-pinned |
| setup-nix composite required |
workflow-hardening.md |
scripts/check-setup-nix-required.sh |
setup-nix-required |
(none) |
| Nix-host reachability |
workflow-hardening.md#nix-host-reachability |
scripts/check-egress-allowlist.sh |
lint-workflow-security |
egress-allowlist |
| GITHUB_TOKEN min-permissions |
min-permissions.md |
scripts/check-min-permissions.sh |
lint-workflow-security |
min-permissions |
| GITHUB_TOKEN write-scope allowlist |
min-permissions.md |
scripts/check-permission-scopes.sh |
lint-workflow-security |
permission-scopes |
| Workflow-scanner division of labor |
workflow-scanners.md |
(none) |
(none) |
(none) |
| Scorecard drift check |
workflow-scanners.md#scorecard |
scripts/check-scorecard-threshold.sh |
(none) |
(none) |
| Pin-diff isolation |
../architecture/auto-update.md |
scripts/check-pin-diff-isolated.sh |
lint-doc-invariants |
pin-diff-isolated |
| Pin-shape parity set |
../architecture/auto-update.md |
scripts/refresh-pin-parity.sh |
doc-freshness |
pin-parity-fresh |
| nix/linpeas.nix pin invariants |
../architecture/auto-update.md |
(none) |
flake-check |
(none) |
| Release VERSION shape |
../architecture/auto-update.md |
(none) |
(none) |
(none) |
| Linpeas-pin release-trigger |
../architecture/auto-update.md |
(none) |
(none) |
(none) |
| Stale-pin failure attribution |
../architecture/ci.md |
(none) |
(none) |
(none) |
| Cancelled-job attribution |
../architecture/ci.md |
(none) |
(none) |
(none) |
| Cron-notify root-cause comments |
../architecture/ci.md |
(none) |
(none) |
(none) |
| dockerhub-sync trigger |
../architecture/ci.md |
(none) |
(none) |
(none) |
| Pages site invariants |
../architecture/ci.md |
scripts/gen-dashboard-data.sh |
(none) |
(none) |
| Cron schedule |
../architecture/ci.md |
scripts/check-cron-table.sh |
(none) |
check-cron-table |
| Prose CI-job names resolve |
workflow-hardening.md |
scripts/check-prose-ci-names.sh |
lint-doc-invariants |
check-prose-ci-names |
| Required-check counts match the table |
workflow-hardening.md |
scripts/check-required-check-counts.sh |
lint-doc-invariants |
check-required-check-counts |
| Scanner notify arms match their workflow |
workflow-hardening.md |
scripts/check-notify-arms.sh |
lint-doc-invariants |
check-notify-arms |
| Single-source cron schedules |
../architecture/ci.md |
scripts/check-doc-cron-restatement.sh |
lint-doc-invariants |
check-doc-cron-restatement |
| update-flake-lock credential split / renovate-flake-lock-refresh |
../architecture/flake-input-bumps.md |
(none) |
(none) |
(none) |
| Notify label descriptions |
workflow-hardening.md#notify-label-descriptions |
scripts/check-notify-label-descriptions.sh |
lint-workflow-security |
notify-label-descriptions |
| Lock-derived doc regeneration |
../architecture/flake-input-bumps.md |
scripts/check-lock-derived-docs.sh |
lint-workflow-security |
lock-derived-docs |
| pre-commit-hooks SHA parity |
../architecture/flake-input-bumps.md |
scripts/check-pre-commit-hooks-sha-parity.sh |
lint-script-hygiene |
pre-commit-hooks-sha-parity |
| Declared systems evaluate |
../install/nix.md |
scripts/check-flake-systems-eval.sh |
flake-check |
(none) |
| OCI image |
../install/docker.md |
(none) |
image-smoke, image-smoke-arm64 |
(none) |
| Manifest digest-pinning |
../install/docker.md |
scripts/check-manifest-digest-pinned.sh |
lint-workflow-security |
manifest-digest-pinned |
| DOCKERHUB_TOKEN split |
../runbooks/dockerhub-recovery.md#dockerhub_token-split-rw--delete |
scripts/check-dockerhub-token-scope-split.sh |
lint-doc-invariants |
(none) |
| Docker Hub notify-body parity |
../runbooks/dockerhub-recovery.md |
(none) |
(none) |
(none) |
| Ratchet pin audit |
../runbooks/ratchet-pin-audit.md |
scripts/check-ratchet-pin-audit.sh |
harness-group |
(none) |
| Ratchet version parity |
../runbooks/ratchet-pin-audit.md |
scripts/check-ratchet-pin-audit.sh |
harness-group |
(none) |
| Reproducibility check |
../runbooks/reproducibility-check.md |
(none) |
(none) |
(none) |
| Scorecard PAT scope and rotation |
../runbooks/scorecard-pat-rotation.md |
(none) |
(none) |
(none) |
| Scorecard Signed-Releases backfill |
../runbooks/scorecard-signed-releases-backfill.md |
(none) |
(none) |
(none) |
| CI retry watchdog |
../runbooks/ci-watchdog.md |
(none) |
(none) |
(none) |
| actionlint embedded-linter pins |
../actionlint-embedded-linters.md |
scripts/check-actionlint-shellcheck-active.sh, scripts/check-actionlint-pyflakes-active.sh |
(none) |
actionlint-shellcheck-active, actionlint-pyflakes-active |
| octoscan workflow scanning |
../development/linting.md |
scripts/octoscan-scan.sh |
(none) |
octoscan |
| ci-summary-category-map |
required-checks.md |
scripts/refresh-ci-summary.sh |
doc-freshness |
ci-summary-fresh |
| Required-check workflows carry no paths filter |
required-checks.md |
scripts/check-required-checks-no-paths.sh |
required-checks-no-paths |
(none) |
| Merging PRs |
../development/git.md |
(none) |
commitlint |
commitlint |
| Commitlint config is explicit |
../development/git.md |
scripts/check-commitlint-config-explicit.sh |
lint-workflow-security |
commitlint-config-explicit |
| Ephemeral-reference ban |
../development/linting.md |
scripts/check-ephemeral-refs.sh |
lint-doc-invariants |
check-ephemeral-refs |
| Ephemeral-refs scope gap |
../development/linting.md |
scripts/refresh-ephemeral-refs-gap.sh |
doc-freshness |
ephemeral-refs-gap-fresh |
| Treefmt YAML quote gotcha |
../development/linting.md |
(none) |
flake-check |
treefmt |
| Flake-show auto-block |
../development/linting.md |
scripts/refresh-flake-show.sh |
doc-freshness |
flake-show-fresh |
| Generated-document ownership |
../development/linting.md |
scripts/refresh-scripts-reference.sh, scripts/refresh-just-recipes.sh, scripts/refresh-treefmt-config.sh, scripts/refresh-precommit-table.sh, scripts/refresh-ci-dag.sh, scripts/refresh-enforcement-matrix.sh |
doc-freshness |
scripts-reference-fresh, just-recipes-fresh, treefmt-config-fresh, precommit-table-fresh, ci-dag-fresh, enforcement-matrix-fresh |
| Scripts-reference round trip |
../development/linting.md |
scripts/check-scripts-reference-roundtrip.sh |
lint-doc-invariants |
check-scripts-reference-roundtrip |
| Round-trip renderer Python leads the doc-lint shell |
../development/linting.md |
(none) |
flake-check |
(none) |
| Python type checking |
../development/linting.md |
(none) |
flake-check |
mypy-strict |
| Markdown anchor resolution |
../development/linting.md |
scripts/check-doc-anchors.sh |
lint-doc-invariants |
check-doc-anchors |
| Config schema validation |
../development/linting.md |
scripts/check-jsonschema.sh |
lint-doc-invariants |
check-jsonschema |
| Docs-audit point is recorded |
../development/docs-audit.md |
scripts/docs-audit-pressure.sh |
(none) |
(none) |
| Flake outputs reference |
../reference/flake-outputs.md |
scripts/refresh-flake-show.sh |
doc-freshness |
flake-show-fresh |
| PR auto-labeling |
../development/labeling.md |
(none) |
(none) |
(none) |
| Changelog tag-pattern parity |
../development/changelog.md |
scripts/check-cliff-tag-pattern.sh |
cliff-tag-pattern |
(none) |
| Changelog link-duplication guard |
../development/changelog.md |
scripts/check-changelog-links.sh |
changelog-links |
(none) |
| Changelog released-section freshness |
../development/changelog.md |
scripts/check-changelog-fresh.sh |
changelog-links |
(none) |
| Changelog generator-owned |
../development/changelog.md |
(none) |
(none) |
(none) |
| Changelog App identity |
../development/changelog.md |
(none) |
(none) |
(none) |
| Changelog self-reference skip |
../development/changelog.md |
(none) |
(none) |
(none) |
| Size-label ignore-list parity |
../development/labeling.md |
scripts/check-size-label-ignores.sh |
lint-doc-invariants |
size-label-ignores |
| Cache-prune permission scope |
../development/cache-cleanup.md |
scripts/check-permission-scopes.sh |
lint-workflow-security |
permission-scopes |
| Cache-prune fork-guard |
../development/cache-cleanup.md |
scripts/check-fork-guard-release.sh |
lint-workflow-security |
fork-guard-release |