Add cfgaudit → AVE crosswalk (static config-auditor)

.github/workflows/notify-ave-site.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Dispatch to aveproject/ave-site
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ secrets.AVE_SITE_DEPLOY_TOKEN }}
           repository: aveproject/ave-site

.github/workflows/regenerate-records-json.yml

@@ -0,0 +1,58 @@
+name: Regenerate consolidated records JSON
+
+# Keeps dist/ave-records-latest.json current automatically, and creates
+# dist/ave-records-v<version>.json the first time a schema version appears
+# (never rewritten after that -- see scripts/build-records.js).
+# Triggers on every push to develop that touches records/ -- the repo that
+# owns the records reacting to its own commits, not a second repo (ave-site)
+# polling for drift. main and develop both require a PR + approving review +
+# signed commits with no bypass for the Actions bot, so this cannot push
+# directly to develop; it opens a PR instead, same as any other change here.
+
+on:
+  push:
+    branches: ["develop"]
+    paths:
+      - "records/**"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Regenerate consolidated records JSON
+        run: node scripts/build-records.js
+
+      - name: Open PR if dist/ changed
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "chore: regenerate consolidated records JSON"
+          title: "chore: regenerate consolidated records JSON"
+          body: |
+            Auto-generated by `scripts/build-records.js` after a change to
+            `records/` on `develop`. Regenerates `dist/ave-records-latest.json`
+            (and its manifest) to stay in sync with the current record set.
+            The versioned `dist/ave-records-v<schema_version>.json` snapshot
+            is only touched the first time a given schema version appears --
+            if this diff includes one, that means a new schema version's
+            frozen snapshot was just created, not that an existing one
+            changed.
+          branch: chore/regenerate-dist-records
+          base: develop
+          delete-branch: true
+          add-paths: |
+            dist/

.github/workflows/scorecard.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.0
+        uses: ossf/scorecard-action@v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

.gitignore

@@ -1,7 +1,6 @@
 __pycache__/
 *.pyc
 .venv/
-dist/
 *.egg-info/
 docs/agents/handoffs/
 .env

CODE_OF_CONDUCT.md

@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-bawbel.io@gmail.com.
+aveproject.org@gmail.com.
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

CONTRIBUTING.md

@@ -236,4 +236,4 @@ name. Records are immutable once published — your attribution stays forever.
 ## Questions
 
 Open a [GitHub Discussion](https://github.com/aveproject/ave/discussions) or
-email [bawbel.io@gmail.com](mailto:bawbel.io@gmail.com).
+email [aveproject.org@gmail.com](mailto:aveproject.org@gmail.com).

README.md

@@ -276,10 +276,16 @@ record = resp.json()  # full record: fingerprint, IOCs, remediation, frameworks
 
 **Pattern 2 — Bundled offline** (air-gapped, regulated environments)
 ```bash
-# Download the full record set at build time and bundle with your scanner
-curl -L https://github.com/aveproject/ave/releases/download/v1.1.0/ave-records-v1.1.0.json \
+# Always current, no release tag required -- regenerated on every records/ change
+curl -L https://raw.githubusercontent.com/aveproject/ave/main/dist/ave-records-latest.json \
+  -o ave-records.json
+
+# Or pin to a frozen, point-in-time snapshot instead of tracking current:
+curl -L https://raw.githubusercontent.com/aveproject/ave/main/dist/ave-records-v1.1.0.json \
   -o ave-records.json
 ```
+A versioned snapshot is also attached to each [GitHub Release](https://github.com/aveproject/ave/releases)
+once one is cut; the raw paths above do not wait on that.
 
 **Pattern 3 — ID-only emission** (SIEM resolves downstream, scanner makes no network calls)
 ```json

SECURITY.md

@@ -5,7 +5,7 @@
 **Do not open a public GitHub issue for security vulnerabilities in Bawbel
 software (scanner, PiranhaDB, ave-site).**
 
-Email: **bawbel.io@gmail.com**
+Email: **aveproject.org@gmail.com**
 Subject: `SECURITY: [component] [brief description]`
 
 We will acknowledge within 48 hours and work with you on coordinated
@@ -22,7 +22,7 @@ record, not a Bawbel security report.
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full submission process.
 
 For critical or pre-disclosure submissions:
-Email **bawbel.io@gmail.com** subject: `AVE CRITICAL: [brief description]`
+Email **aveproject.org@gmail.com** subject: `AVE CRITICAL: [brief description]`
 
 ---