[CEL-1328] Isolate static deploy credentials - #16

Merged

mong-x merged 32 commits into

mainfrom

mjnong/cel-1328-deploy-workflow-pins

Aug 27, 2026

Commits on Aug 27, 2026

fix(ci): isolate static deploy credentials (CEL-1328)
mong-x
committed
cf61a69
fix(ci): pin privileged deploy dependencies (CEL-1328)
mong-x
committed
b63da66
fix(ci): scope Discord caller permissions (CEL-1328)
mong-x
committed
b7b39c8
fix(ci): configure actionlint runner labels
mong-x
committed
4ffebfb
fix(ci): preserve nested workflow permission bounds (CEL-1328)
mong-x
committed
1aa7ed7
fix(ci): isolate pull request deploy credentials (CEL-1328)
mong-x
committed
f9cfed8
fix(ci): scope preview lock source check (CEL-1328)
mong-x
committed
806709f
fix(ci): harden preview dependency boundary (CEL-1328)
mong-x
committed
6d0e040
fix(ci): validate production artifacts (CEL-1328)
mong-x
committed
db1667e
fix(ci): restrict trusted preview dependencies (CEL-1328)
mong-x
committed
09e1b30
fix(ci): harden preview lifecycle handling (CEL-1328)
mong-x
committed
86bb2b5
fix(ci): harden preview cleanup and comments (CEL-1328)
mong-x
committed
e96b2bd
fix(ci): allow scoped workspace lock entries (CEL-1328)
mong-x
committed
3cf5e73
fix(ci): restrict preview close jobs (CEL-1328)
mong-x
committed
9d74e6a
fix(ci): reject non-registry lock resolutions (CEL-1328)
mong-x
committed
7d56131
fix(ci): close static deploy trust gaps (CEL-1328)
mong-x
committed
a3a7362
fix(ci): remove preview credential exposure (CEL-1328)
mong-x
committed
e9da6d8
fix(ci): validate Discord metadata ownership (CEL-1328)
mong-x
committed
0aa550d
fix(ci): isolate preview registry credentials (CEL-1328)
mong-x
committed
5710c72
fix(ci): bind preview jobs to workflow actor (CEL-1328)
mong-x
committed
589c4f4
fix(ci): gate preview jobs through trusted preflight (CEL-1328)
mong-x
committed
34758e8
fix(ci): verify current preview actor permission (CEL-1328)
mong-x
committed
cddadf3
fix(ci): validate deploy Discord metadata (CEL-1328)
mong-x
committed
fb2de9c
fix(ci): restrict preview dependency artifacts (CEL-1328)
mong-x
committed
8848680
fix(ci): serialize gcloud storage sync (CEL-1328)
mong-x
committed
043e94a
fix(ci): validate preview manifests before install (CEL-1328)
mong-x
committed
344464a
fix(ci): trust default-branch preview callers (CEL-1328)
mong-x
committed
fbe4c72
fix(ci): validate production dependencies before install (CEL-1328)
mong-x
committed
d0cb5f0
fix(ci): reject non-registry manifest sources (CEL-1328)
mong-x
committed
bd44a05
fix(ci): validate pnpm workspace sources (CEL-1328)
mong-x
committed
4017841
fix(ci): reject non-registry lock locators (CEL-1328)
mong-x
committed
90d803b
fix(ci): revalidate preview authorization (CEL-1328)
mong-x
committed
eb30217

Navigation Menu

Uh oh!

[CEL-1328] Isolate static deploy credentials - #16

[CEL-1328] Isolate static deploy credentials#16
mong-x merged 32 commits into
mainfrom
mjnong/cel-1328-deploy-workflow-pins

Commits on Aug 27, 2026

fix(ci): isolate static deploy credentials (CEL-1328)

fix(ci): pin privileged deploy dependencies (CEL-1328)

fix(ci): scope Discord caller permissions (CEL-1328)

fix(ci): configure actionlint runner labels

fix(ci): preserve nested workflow permission bounds (CEL-1328)

fix(ci): isolate pull request deploy credentials (CEL-1328)

fix(ci): scope preview lock source check (CEL-1328)

fix(ci): harden preview dependency boundary (CEL-1328)

fix(ci): validate production artifacts (CEL-1328)

fix(ci): restrict trusted preview dependencies (CEL-1328)

fix(ci): harden preview lifecycle handling (CEL-1328)

fix(ci): harden preview cleanup and comments (CEL-1328)

fix(ci): allow scoped workspace lock entries (CEL-1328)

fix(ci): restrict preview close jobs (CEL-1328)

fix(ci): reject non-registry lock resolutions (CEL-1328)

fix(ci): close static deploy trust gaps (CEL-1328)

fix(ci): remove preview credential exposure (CEL-1328)

fix(ci): validate Discord metadata ownership (CEL-1328)

fix(ci): isolate preview registry credentials (CEL-1328)

fix(ci): bind preview jobs to workflow actor (CEL-1328)

fix(ci): gate preview jobs through trusted preflight (CEL-1328)

fix(ci): verify current preview actor permission (CEL-1328)

fix(ci): validate deploy Discord metadata (CEL-1328)

fix(ci): restrict preview dependency artifacts (CEL-1328)

fix(ci): serialize gcloud storage sync (CEL-1328)

fix(ci): validate preview manifests before install (CEL-1328)

fix(ci): trust default-branch preview callers (CEL-1328)

fix(ci): validate production dependencies before install (CEL-1328)

fix(ci): reject non-registry manifest sources (CEL-1328)

fix(ci): validate pnpm workspace sources (CEL-1328)

fix(ci): reject non-registry lock locators (CEL-1328)

fix(ci): revalidate preview authorization (CEL-1328)