Controls: SEC-04/11/13/31–38, CICD-27.
Add OSV-Scanner over uv.lock, make Semgrep locally reproducible from the locked toolchain, and close the remaining documented differences between make verify and the required CI jobs. Preserve fail-closed behavior and do not add muted gates.
The Scorecard workflow now publishes SARIF evidence. Add explicit policy enforcement for the aggregate and named-control thresholds once #79 establishes the final branch rules and #80 supplies signed-release evidence; retain a dated monthly report as required by SEC-38.
Done when local/CI supply-chain checks are reproducible and the applicable Scorecard thresholds are enforced rather than merely reported.
Controls: SEC-04/11/13/31–38, CICD-27.
Add OSV-Scanner over
uv.lock, make Semgrep locally reproducible from the locked toolchain, and close the remaining documented differences betweenmake verifyand the required CI jobs. Preserve fail-closed behavior and do not add muted gates.The Scorecard workflow now publishes SARIF evidence. Add explicit policy enforcement for the aggregate and named-control thresholds once #79 establishes the final branch rules and #80 supplies signed-release evidence; retain a dated monthly report as required by SEC-38.
Done when local/CI supply-chain checks are reproducible and the applicable Scorecard thresholds are enforced rather than merely reported.