Paul Bakaus 36e4cea693 Pin workflow actions and document live-edit script trust (#755) ...

Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate.

AI assistance: Codex, under maintainer direction.

2026-09-06 18:04:55 -07:00

..

github

Normalize sheriff exemption labels

2026-08-31 16:43:21 -07:00

lib

Add DeepSeek Harness as a supported skills provider (#746)

2026-09-06 14:46:05 -07:00

build-extension.js

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

build-font-index.mjs

Comp fidelity: font ranking that holds without a browser, spec refuses painted chrome, control-box veto only for discrete controls

2026-08-28 06:13:59 +05:00

build.js

Add DeepSeek Harness as a supported skills provider (#746)

2026-09-06 14:46:05 -07:00

bundle-signing-keys.json

Verify signed skill bundles before extraction (#734)

2026-09-04 18:21:01 -07:00

check-engine-release.mjs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

ci-test-plan.mjs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

fetch-engine.mjs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

generate-extension-icons.js

Add Chrome DevTools extension for anti-pattern detection

2026-04-06 15:18:36 -07:00

generate-promo-tile.js

Polish Chrome extension for Web Store submission

2026-04-06 21:06:09 -07:00

publish-platform-packages.mjs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

release.mjs

Verify signed skill bundles before extraction (#734)

2026-09-04 18:21:01 -07:00

run-tests.mjs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

sign-bundle.mjs

Verify signed skill bundles before extraction (#734)

2026-09-04 18:21:01 -07:00

smoke-provider-hooks.mjs

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

test-suites.mjs

Pin workflow actions and document live-edit script trust (#755)

2026-09-06 18:04:55 -07:00