Skip to content

docs: point consumers at saw guard for installing & verifying the gate #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Ndevu12 merged 1 commit into from
Jul 19, 2026
Merged

docs: point consumers at saw guard for installing & verifying the gate #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@ All notable changes to this project are documented here. The format is based on
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Changed

- **Docs: point consumers at `saw guard`** (from the `stayawakebot` package) as the automated way to install and verify this gate. `saw guard setup` installs it SHA-pinned to the latest release and opens pin-bump PRs; `saw guard check` verifies it is present, SHA-pinned, current, and a required check. The manual copy-paste + hardening checklist remain the source of truth (the least-privilege `contents: read` default and remediation-as-opt-in posture are unchanged).

## [0.1.4] — 2026-07-15

### Added
Expand Down
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ jobs:
`fetch-depth: 0` is required for evil-merge detection (it needs the full commit graph). Deploying
this as a required check is the whole point — see the [hardening checklist](docs/HARDENING.md).

**Install and keep it current with `saw guard`.** From the `stayawakebot` package, `saw guard setup` installs this gate **SHA-pinned to the latest Strix release** and proposes pin bumps via PR, and `saw guard check` verifies it is present, SHA-pinned, current, and a required check — across a single repo or a whole account/org. It is the automated path to the hardening checklist below; the snippet above is the manual equivalent.

## Inputs

| Input | Default | Description |
Expand Down
2 changes: 2 additions & 0 deletions docs/HARDENING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ below get you there.

## Hardening checklist

**Automate most of this with `saw guard`** (from the `stayawakebot` package): `saw guard setup` installs the gate SHA-pinned and opens pin-bump PRs; `saw guard check -f` verifies it is present, SHA-pinned, current, and a required check, and gates CI on the result. The steps below remain the source of truth — **CODEOWNERS review** and **`fetch-depth: 0`** in particular are yours to set, not something the installer can do for you.

- [ ] **Make the Strix job a required status check** on your default branch, so a renamed or removed
job blocks a merge instead of silently passing.
- [ ] **Check out with `fetch-depth: 0`** so evil-merge detection sees the full commit graph and
Expand Down
Loading