epic: code and supply-chain security hardening #759

New issue

Open

opened 2026-10-13 22:23:04 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-13 22:23:04 +00:00

Owner

This epic gives the open security-labeled hardening work one home and a clear exit. These fixes are not tied to a feature release, and the security label alone does not track their state.

This epic gates no release. Each release cuts on its own criteria. #675 stays the ADR-tooling-break release.

Scope

The work falls in three areas:

Static analysis. The gosec gate stays tight, and every exclusion carries a current, accurate reason.
Dependencies and supply chain. Scan the lockfiles, track the exposure of a dependency kept only for one check, and sign the release bot commits.
The write boundary. Block a write to the wrong repo at the boundary, and keep the credential-handling guards reliable.

Children

#428 adopt the SDK roots-replacement (SEP-2322), so a write to the wrong repo is blocked at the boundary.
#434 sign the GoReleaser tap and scoop bot commits.
#588 add a credential-gated nancy scan to the gate.
#621 track the osv-scanner exposure of x/crypto, kept in go.mod only for the update signature check.
#501 find why the credential clone-URL guard test failed once with no hook change.
#623 handle every error. Reconcile its acceptance with ADR 0053, which dropped G104 from the exclusion set with an explicit ignore at each site.
#633 record why the kept rule classes stay excluded. ADR 0053 records the triage by class; reconcile the per-site acceptance, then close.

Done when

Every child is closed.

This epic gives the open security-labeled hardening work one home and a clear exit. These fixes are not tied to a feature release, and the security label alone does not track their state. This epic gates no release. Each release cuts on its own criteria. #675 stays the ADR-tooling-break release. ## Scope The work falls in three areas: - Static analysis. The gosec gate stays tight, and every exclusion carries a current, accurate reason. - Dependencies and supply chain. Scan the lockfiles, track the exposure of a dependency kept only for one check, and sign the release bot commits. - The write boundary. Block a write to the wrong repo at the boundary, and keep the credential-handling guards reliable. ## Children - #428 adopt the SDK roots-replacement (SEP-2322), so a write to the wrong repo is blocked at the boundary. - #434 sign the GoReleaser tap and scoop bot commits. - #588 add a credential-gated nancy scan to the gate. - #621 track the osv-scanner exposure of x/crypto, kept in go.mod only for the update signature check. - #501 find why the credential clone-URL guard test failed once with no hook change. - #623 handle every error. Reconcile its acceptance with ADR 0053, which dropped G104 from the exclusion set with an explicit ignore at each site. - #633 record why the kept rule classes stay excluded. ADR 0053 records the triage by class; reconcile the per-site acceptance, then close. ## Done when Every child is closed.

hexajon added the

epic

label

2026-10-13 22:23:04 +00:00

hexajon added a new dependency

2026-10-13 22:23:14 +00:00

#428 security: adopt the SDK roots-replacement (SEP-2322) so the wrong-repo write guard survives 2026-07-28 clients

hexajon added a new dependency

2026-10-13 22:23:14 +00:00

#434 release: sign GoReleaser's tap/scoop bot commits before routing them through signed repos

hexajon added a new dependency

2026-10-13 22:23:14 +00:00