docs: correct CI/supply-chain docs to match the tree - #227
Merged
Merged
Conversation
README.md: replace the pasted boilerplate block (which claimed CI was green) with a verified CI/CD & supply-chain integrity section — full-SHA pinning policy, current measured state on main, and reference SHAs for the actions ci.yml uses. SECURITY.md: rewrite the chat-style document as a real policy (supported versions, private-advisory reporting, SLA by severity, scope, coordinated disclosure, severity table). The supply-chain section now states plainly that pinning is policy but not yet enforced — there is no verify-sha job and no .github/workflows/scripts/verify-shas.py, contrary to the previous text. CHANGELOG.md: record both corrections. SHAs resolved from the actions' own repos on 2026-09-12.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Corrects the CI / supply-chain documentation so it matches the tree.
README.mdThe file carried a pasted boilerplate block that ended in a status line claiming
"CI/CD: ผ่าน · Security: ตรวจสอบแล้ว" and a
ต้องการให้ผมช่วย:list, with adraft
SECURITY.mdpasted inline. CI is not green — it has never run. The blockis replaced with a verified CI/CD & supply-chain integrity section:
the full-SHA pinning policy, the current state measured against
main, and thereference SHAs for the actions
ci.ymluses.SECURITY.mdWas a chat-style answer wrapped in prose and code fences. It had picked up a
"Supply Chain" section describing a
verify-shajob inci.ymland a pin-historyrow of "76 refs / all 12 workflow files / repaired 5 fabricated pins" — none of
which exists: there is no
verify-shajob and no.github/workflows/scripts/verify-shas.py. Rewritten as a normal policy document(supported versions, private-advisory reporting, SLA by severity, scope,
coordinated disclosure, severity table) with a supply-chain section that states
plainly that pinning is policy but not yet enforced, backed by measured counts.
CHANGELOG.mdRecords both corrections.
Verification
(
git/ref/tags/<tag>peeled to the commit) on 2026-09-12; all are 40 chars..github/workflows/onmain.Note
No
.github/workflows/file is touched. Enforcing the policy (rewriting the tagsto SHAs) still needs maintainer write access to the workflows directory.