The repository fails CI when a workflow uses a mutable action reference, a pinned
action lacks a version comment, maintained executable setup code introduces an
ungoverned remote download or execution path, or a job requests write permission
outside the allowlist.
Container actions, if introduced, must use an image digest. Local actions under
./ are allowed. Renovate's GitHub Actions manager has pinDigests: true, so
updates remain reviewable proposals and preserve immutable references.
Every workflow declares read-only permissions at the workflow level. Jobs that
publish a GitHub Release or deploy GitHub Pages opt into only the write or OIDC
permissions they need:
Maintained shell, Python, and Node setup/automation under setup/, scripts/,
and .github/ may not download a remote input—or pipe one into a shell—without a
named, documented, unexpired entry in supply-chain/exceptions.json. The shell
scanner treats direct curl/wget, command substitution (x=$(curl …)),
eval "$(curl …)", and source <(curl …) as remote-input callsites.
Each exception binds an exact HTTPS source to one of two auditable kinds:
accepted-risk requires an exact, whitespace-normalized literal command
with no dynamic source. It states plainly that the bytes are not
checksum-pinned and gives the reason and expiry for that temporary risk
acceptance;
sha256 permits only one deliberately narrow flow: `curl -fsSL -o