Repository navigation

Pin privileged release actions and document custody - #166

Draft

gontzess wants to merge 12 commits into

mainfrom

steve.gontzes/gf16-action-allowlist

Draft

Pin privileged release actions and document custody#166
gontzess wants to merge 12 commits into
mainfrom
steve.gontzes/gf16-action-allowlist

Commits on Oct 22, 2026
- Enforce pinned action policy in privileged release jobs
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  e20da1c
- Cover first-party subactions and inherited release secrets
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  8f77768
- Recognize bracket and whole-context secret references
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  afabc58
- Clarify failure notification event and metric behavior
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  56442bd
- Bound failure reporting and reject overwritten workflow bootstraps
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  32533b4
- Invalidate bootstrap readiness for root and unresolvable checkouts
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  ae409b7
- Clarify best-effort notification failure rationale
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  a72f290
- Retain the pinned Datadog notification survivor
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  9742d3d
- Document manual workflow action re-pinning
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  d20de4f
- Clarify manual action re-pinning and remove unrelated assertion
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  253c7f4
- Keep release action pins and concise custody documentation
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  cb85b31
- Describe Datadog notification as event-only
  
  gontzess
  and
  c1-squire-dev[bot]
  committed
  6583b65