Remove GitHub workflow metadata
ober
4489dcfaae9efcc7d4f1f8b2c53ed442ed42e022
deleted file mode 100644 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: CI - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -env: - JERBOA_VERSION: v0.2.3 - JERBUILD: ${{ github.workspace }}/.jerboa/bin/jerbuild - # The current DB source needs reviewed Raft-wire and bounded-TLS APIs that - # have not yet shipped in v0.2.3. Keep hosted CI visibly blocked until a - # concrete containing release can replace this marker and version. - JERBOA_CORE_API_STATUS: blocked-pending-reviewed-release - -jobs: - verify: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - - name: Install system tools - run: | - set -eu - sudo apt-get update - sudo apt-get install -y --no-install-recommends build-essential curl ca-certificates openssl - - - name: Install cargo-audit - run: cargo install cargo-audit --locked - - - name: Install Jerboa toolchain - run: sh support/ensure-jerboa.sh "$JERBOA_VERSION" .jerboa/bin - - - name: Record Jerboa core compatibility status - run: | - { - echo "### Jerboa core compatibility" - echo - echo "Status: \`$JERBOA_CORE_API_STATUS\`" - echo - echo "The fail-closed API probe in make verify must reject v0.2.3 until a reviewed containing release is pinned." - } >> "$GITHUB_STEP_SUMMARY" - - - name: Verify (includes fail-closed core API probe) - run: make verify - - - name: Release evidence - run: make release-evidence deleted file mode 100644 --- a/.github/workflows/security-baseline.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Security Baseline - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -jobs: - baseline: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - - name: Required release files - run: | - set -eu - test -f LICENSE - test -f SECURITY.md - test -f .gitignore - find . -maxdepth 1 -iname "README*" -type f | grep -q . - - - name: High-confidence secret scan - run: | - set -eu - pattern="(BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-(ant-api03|proj|svcacct)-[A-Za-z0-9_-]{30,}|AKIA[0-9A-Z]{16})" - matches="$(git grep -n -I -E "$pattern" -- . ":!*.png" ":!*.jpg" ":!*.jpeg" ":!*.gif" ":!*.so" ":!*.dylib" ":!*.o" ":!*.a" ":!*.boot" ":!*.tar.gz" || true)" - if [ -n "$matches" ]; then - echo "$matches" - echo "High-confidence secret pattern found." - exit 1 - fi