Limen 0.0.1

[apostasie]

No description provided.

[mendral-app]

Supply Chain Security Review

✅ Approve

No dependency changes detected by osv-scanner. Workflows use SHA-pinned actions/checkout@9c091bb… (verified v7.0.0), minimal permissions: {} at top level with scoped contents: read/contents: write per job, persist-credentials: false, and the custom setup-aqua action downloads the installer at a pinned tag with SHA256 verification. The update-aqua-checksum workflow's write scope is appropriately limited to Renovate branches only.

_{Tag @mendral-app with feedback or questions. View session}

[mendral-app]

Supply Chain Security Review

✅ Approve

CI overhaul with strong supply-chain hygiene: all actions SHA-pinned, top-level permissions: {} with minimal per-job grants, aqua installer checksum-verified, persist-credentials: false on checkout, and no pull_request_target usage.

_{Tag @mendral-app with feedback or questions. View session}

[mendral-app]

Supply Chain Security Review

✅ Approve

No dependency changes detected by osv-scanner. Workflows are well-hardened: top-level permissions: {}, per-job least-privilege scopes, actions/checkout pinned to verified SHA (9c091bb… = v7.0.0), aqua installer fetched with SHA256 verification, persist-credentials: false, branch name passed via env not interpolation, and write token scoped to the single push step.

_{Tag @mendral-app with feedback or questions. View session}

[mendral-app]

Supply Chain Security Review

✅ Approve

Workflows are well-hardened: all third-party actions pinned by full SHA to verified releases, top-level permissions: {} with minimal per-job grants, persist-credentials: false, concurrency with cancel-in-progress, and the custom composite action checksum-verifies the aqua installer before execution. No dependency changes detected by osv-scanner.

_{Tag @mendral-app with feedback or questions. View session}