Fix Skylos remediation findings - #23

Merged

vndv merged 14 commits into

mainfrom

skylos-remediation

May 31, 2026

Commits on May 31, 2026

ci: restrict ci workflow token permissions
Ivan Matveev
committed
5a475ce
ci: pin ci workflow actions
Ivan Matveev
committed
8e42415
ci: disable checkout credential persistence
Ivan Matveev
committed
e2c4b88
ci: ignore install scripts in ci
Ivan Matveev
committed
daa6ed4
ci: scope release workflow permissions
Ivan Matveev
committed
e5dac50
ci: add release job timeout
Ivan Matveev
committed
12f6c16
ci: pin release workflow actions
Ivan Matveev
committed
15764f9
ci: disable release checkout credential persistence
Ivan Matveev
committed
a160005
ci: avoid install lifecycle scripts in release
Ivan Matveev
committed
01e4995
ci: split release provenance from build
Ivan Matveev
committed
4f85c0f
quality: add skylos gate policy
Ivan Matveev
committed
e60a884
quality: add pre-commit policy
Ivan Matveev
committed
1026608
quality: split json rpc session helpers
Ivan Matveev
committed
9862064
security: suppress npm lockfile integrity false positives
Ivan Matveev
committed
7162965