Teknium c77a6e3faa chore(security): add OSV-Scanner CI + Dependabot for github-actions only (#20037) ... Adds two supply-chain controls that complement our existing pinning strategy (full-SHA action pins, exact-version source dep pins via uv.lock / package-lock.json) without undermining it. .github/workflows/osv-scanner.yml Detection-only scan of uv.lock and the ui-tui/website package-locks against the OSV vulnerability database. Runs on PRs that touch lockfiles, on push to main, and weekly against main so CVEs published after merge still surface. Uses Google's officially- recommended reusable workflow pinned by full SHA (v2.3.5). Findings upload to the Security tab; fail-on-vuln is disabled so pre-existing vulns in pinned deps do not block merges — we move pins deliberately, not under CI pressure. .github/dependabot.yml Scoped to github-actions only. Action pins must be moved when upstream publishes patches (often themselves security fixes); Dependabot opens a PR with the new SHA + release notes for normal review. Source-dependency ecosystems (pip, npm) are deliberately NOT enabled — automatic version-bump PRs against uv.lock / package-lock.json would fight our pinning strategy. CVE-driven security updates for source deps are enabled separately via the repo's Dependabot security updates setting (GitHub UI), which fires only when a pinned version becomes known-vulnerable.		2026-05-04 20:58:21 -07:00
..
actions/nix-setup	fix(nix): replace magic-nix-cache with Cachix (#17928)	2026-04-30 17:38:58 +05:30
ISSUE_TEMPLATE	feat: add openrouter/elephant-alpha to curated model lists (#9378)	2026-04-13 21:16:14 -07:00
workflows	chore(security): add OSV-Scanner CI + Dependabot for github-actions only (#20037)	2026-05-04 20:58:21 -07:00
dependabot.yml	chore(security): add OSV-Scanner CI + Dependabot for github-actions only (#20037)	2026-05-04 20:58:21 -07:00
PULL_REQUEST_TEMPLATE.md	docs: add documentation & housekeeping checklist to PR template	2026-03-05 07:23:52 -08:00