From 95cd790da85c75cd33bee59434d4aaf802164bd5 Mon Sep 17 00:00:00 2001 From: Jean Paul Elisa NIYOKWIZERWA Date: Sun, 19 Jul 2026 22:26:53 +0200 Subject: [PATCH] docs: point consumers at saw guard for installing & verifying the gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit saw guard (shipped in the stayawakebot package) now installs and verifies THIS gate, so wire it into the docs instead of leaving install/verify entirely manual: - README Usage: a note that `saw guard setup` installs the gate SHA-pinned to the latest release (and opens pin-bump PRs), and `saw guard check` verifies it's present, SHA-pinned, current, and a required check — across one repo or an account. - HARDENING checklist: a callout that saw guard automates most of the checklist (install / SHA-pin / required-check / freshness), while being honest that CODEOWNERS review and fetch-depth: 0 remain yours to set. Posture is UNCHANGED and already correct — the least-privilege `contents: read` default and remediation-as-deliberate-opt-in (scoped write, prefer a push trigger, keep PR runs report-only) already match what stayAwakeBot's `saw guard setup` emits. This only connects the shipped tooling; no workflow/permission changes. --- CHANGELOG.md | 6 ++++++ README.md | 2 ++ docs/HARDENING.md | 2 ++ 3 files changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 69d9952..565ac11 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,12 @@ All notable changes to this project are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] + +### Changed + +- **Docs: point consumers at `saw guard`** (from the `stayawakebot` package) as the automated way to install and verify this gate. `saw guard setup` installs it SHA-pinned to the latest release and opens pin-bump PRs; `saw guard check` verifies it is present, SHA-pinned, current, and a required check. The manual copy-paste + hardening checklist remain the source of truth (the least-privilege `contents: read` default and remediation-as-opt-in posture are unchanged). + ## [0.1.4] — 2026-07-15 ### Added diff --git a/README.md b/README.md index 4ee2de2..3a6c054 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,8 @@ jobs: `fetch-depth: 0` is required for evil-merge detection (it needs the full commit graph). Deploying this as a required check is the whole point — see the [hardening checklist](docs/HARDENING.md). +**Install and keep it current with `saw guard`.** From the `stayawakebot` package, `saw guard setup` installs this gate **SHA-pinned to the latest Strix release** and proposes pin bumps via PR, and `saw guard check` verifies it is present, SHA-pinned, current, and a required check — across a single repo or a whole account/org. It is the automated path to the hardening checklist below; the snippet above is the manual equivalent. + ## Inputs | Input | Default | Description | diff --git a/docs/HARDENING.md b/docs/HARDENING.md index c91cbb4..3b1b7c4 100644 --- a/docs/HARDENING.md +++ b/docs/HARDENING.md @@ -13,6 +13,8 @@ below get you there. ## Hardening checklist +**Automate most of this with `saw guard`** (from the `stayawakebot` package): `saw guard setup` installs the gate SHA-pinned and opens pin-bump PRs; `saw guard check -f` verifies it is present, SHA-pinned, current, and a required check, and gates CI on the result. The steps below remain the source of truth — **CODEOWNERS review** and **`fetch-depth: 0`** in particular are yours to set, not something the installer can do for you. + - [ ] **Make the Strix job a required status check** on your default branch, so a renamed or removed job blocks a merge instead of silently passing. - [ ] **Check out with `fetch-depth: 0`** so evil-merge detection sees the full commit graph and