From f09328b502d5ec4401ad4e938f00c7bf979031ea Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Tue, 23 Jun 2026 07:30:17 -0400 Subject: [PATCH] =?UTF-8?q?docs:=20gates=20merged=20=E2=80=94=20drop=20the?= =?UTF-8?q?=20'pending=20#12'=20bootstrap=20note?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit attested-delivery/.github#12 is merged; the gate reusables (shellcheck, semgrep, secrets, manifest-review, cosign-sign) are on the released v0.1.0 SHA, not the d4467d5 PR branch. Replace the obsolete bootstrap note with a durable 'central gate pins' note, and fix the matching stale comment in release.yml. --- .github/workflows/release.yml | 2 +- README.md | 14 ++++++-------- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6174779..98b79e1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -132,7 +132,7 @@ jobs: path: ${{ needs.meta.outputs.name }}-${{ needs.meta.outputs.version }}-sbom.cdx.json if-no-files-found: error - # --- gate jobs (existing @698148e + new @d4467d5 bootstrap) ----------------- + # --- gate jobs (central attested-delivery/.github reusables, SHA-pinned) ---- gate-sast: needs: [meta] permissions: { security-events: write, contents: read, actions: read, packages: read } diff --git a/README.md b/README.md index 5462264..4a97cae 100644 --- a/README.md +++ b/README.md @@ -162,14 +162,12 @@ flagged upstream gap, not a property this marketplace can yet enforce. See [docs/explanation/attested-marketplace.md](docs/explanation/attested-marketplace.md) for why admission-time enforcement is the right seam regardless. -## Bootstrap note (gates pending #12) - -Five of the plugin-specific gate reusables — ShellCheck, Semgrep, secrets, -manifest-review, and cosign-sign — are proposed in -[attested-delivery/.github#12](https://github.com/attested-delivery/.github/pull/12) -and not yet merged. Until #12 merges, this marketplace pins those callers to the -PR branch commit **`d4467d5`**. When #12 merges, the pins are re-pinned to the -merged `main` SHA and Dependabot's `github-actions` updater keeps them fresh. +## Central gate pins + +Every gate is a thin caller of the central +[`attested-delivery/.github`](https://github.com/attested-delivery/.github) +reusables, pinned to a released commit SHA and kept fresh by Dependabot's +`github-actions` updater. ## Documentation