ci: add signed fail-closed release supply chain - #38

Merged

itayson merged 8 commits into

mainfrom

feat/release-supply-chain-gates

Jul 16, 2026

Commits on Jul 16, 2026

build(app): add environment-gated release signing
itayson
committed
e0c38f7
ci(release): add signed fail-closed release pipeline
itayson
committed
9fa1346
docs: document release signing and key rotation
itayson
committed
809fa29
ci(release): harden artifact publication context
itayson
committed
f927f4e
ci(security): surface dependency review failures in PRs
itayson
committed
f208fdf
ci(security): detect dependency manifests through PR API
itayson
committed
b1d398d
ci(security): preserve Gitleaks history and simplify dependency review
itayson
committed
916ccfa
ci(security): review only actual dependency changes
itayson
committed
fffa748