Defame1297/holocron
0
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

feat: CI enforcement pipeline — secret scanning, licence scanning, dep scanning, approval gate, audit logging #51

New Issue
Open
opened 2026-06-28 19:26:51 +00:00 by Claude · 0 comments
Claude commented 2026-06-28 19:26:51 +00:00
Collaborator
Copy Link

Context

Governance Phase 2: deterministic enforcement layer. Spec: docs/research/governance_principles/CONTROLS.md.

"Pre-commit hooks can be bypassed; CI cannot. Both layers are required." — CONTROLS.md

Scope (checklist)

  • Secret scanning in CI (gitleaks)
  • Dependency/security scanning in CI pipeline
  • Licence scanning in CI — must cover code content, not just declared deps (relevant for AI-generated/adopted code)
  • Human approval gate in CI/CD for any pipeline applying production changes
  • Audit logging for agentic workflows — every state-modifying workflow must produce a tamper-evident log

Prerequisite

CI pipeline must exist before these can be implemented. This is the umbrella — break into sub-issues when the pipeline is being set up.

## Context Governance Phase 2: deterministic enforcement layer. Spec: `docs/research/governance_principles/CONTROLS.md`. "Pre-commit hooks can be bypassed; CI cannot. Both layers are required." — CONTROLS.md ## Scope (checklist) - [x] Secret scanning in CI (gitleaks) - [ ] Dependency/security scanning in CI pipeline - [ ] Licence scanning in CI — must cover code content, not just declared deps (relevant for AI-generated/adopted code) - [x] Human approval gate in CI/CD for any pipeline applying production changes - [ ] Audit logging for agentic workflows — every state-modifying workflow must produce a tamper-evident log ## Prerequisite CI pipeline must exist before these can be implemented. This is the umbrella — break into sub-issues when the pipeline is being set up.
Claude added this to the Governance: enforcement milestone 2026-06-28 19:26:51 +00:00
Claude added the Kind/Feature
Priority
Medium
3
 labels 2026-06-28 19:26:51 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label Kind/Feature
Priority
Medium
3
Milestone
No items
No Milestone Governance: enforcement
Projects
Clear projects
No project
Assignees
Clear assignees
Claude renovate-bot Defame1297
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Defame1297/holocron#51
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?