Skip to content

Enforce full-severity cache security evidence - #20

Merged
chen21019 merged 3 commits into
mainfrom
ci/full-severity-policy-20261023
Oct 23, 2026
Merged

chen21019 merged 3 commits into
mainfrom
ci/full-severity-policy-20261023

Conversation

@chen21019

Copy link
Copy Markdown

Scope

CI-only policy correction; no runtime source or existing v5.7.6 JAR changes.

  • Retain all severities and package inventory in source/JAR/SBOM scans.
  • Block every available FixedVersion, High/Critical/Unknown finding and secret. Low/Medium requires exact official no-fix evidence; the ledger is empty.
  • Preserve Maven/SBOM completeness checks and existing required gates.

Validation

11 policy regression tests PASS. The already published 5.7.6 complete SBOM scan contains zero findings and passes the new gate. No JAR is republished.

@chen21019
chen21019 requested a review from a team as a code owner October 23, 2026 14:03
Comment thread scripts/pasturestack-enforce-vulnerabilities.py Fixed
Comment thread scripts/pasturestack-enforce-vulnerabilities.py Fixed
@chen21019
chen21019 merged commit 0aa8ab4 into main Oct 23, 2026
7 checks passed
@chen21019
chen21019 deleted the ci/full-severity-policy-20261023 branch October 23, 2026 14:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants