Timofei Larkin f3e55d2be4 fix(ci): harden API gate against tampering and schema gaps ...

Scope the gate's own files (cmd/api-gate, internal/apigate, the workflow) to the API owners in CODEOWNERS, and compile the detector from the trusted base checkout when present (head fallback only during bootstrap), so a PR cannot neuter the gate by editing its own detector code.

Detect two more breaking vectors: removing nullable:true (rejects null) and adding a oneOf/allOf/not composition constraint. Both covered by regression tests.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

2026-07-01 15:03:02 +03:00

..

api-review-gate.yaml

fix(ci): harden API gate against tampering and schema gaps

2026-07-01 15:03:02 +03:00

auto-release.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

backport.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

build-main.yaml

ci: run selector bats in checks, harden flux install, 3-way fragment apply

2026-06-25 10:21:06 +05:00

codegen-drift.yml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

codeql.yml

ci(codeql): build Go with manual mode instead of autobuild

2026-06-26 18:11:06 +05:00

labels.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pr-labeler.yaml

ci(renovate): force chore(deps) commits and add area/dependencies label (#3015)

2026-06-30 11:27:43 +03:00

pr-size.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pre-commit.yml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pull-requests-release.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pull-requests.yaml

fix(ci): create the overlay output dir before flux pull

2026-06-30 18:33:17 +03:00

scorecard.yml

ci(scorecard): stop uploading SARIF to code-scanning; drop push trigger

2026-06-26 18:11:06 +05:00

stale.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

tags.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

ui-test.yaml

ci(dashboard): typecheck and test the in-tree console SPA

2026-06-23 12:20:48 +05:00

update-releasenotes.yaml

ci(release): run update-releasenotes only on changelog changes

2026-06-26 18:11:05 +05:00