Repository navigation

Signed release assets with SLSA provenance and SBOMs, Atheris fuzzing, and Scorecard fixes - #51

Merged

laithalsaadoon merged 6 commits into

mainfrom

ci/signed-releases-and-scorecard

Oct 10, 2026

Merged

Signed release assets with SLSA provenance and SBOMs, Atheris fuzzing, and Scorecard fixes#51
laithalsaadoon merged 6 commits into
mainfrom
ci/signed-releases-and-scorecard

Commits on Oct 10, 2026
- fix(security): render the OpenVEX suppressions beside the docs site lockfile too
  
  laithalsaadoon
  and
  claude
  committed
  c707de5
- feat(release): sign, attest and attach the release assets with SBOMs
  
  laithalsaadoon
  and
  claude
  committed
  c4bb333
- ci(fuzz): fuzz the transcript converters with Atheris
  
  laithalsaadoon
  and
  claude
  committed
  32a494f
- fix(converter): reject non-string uuids and payload types instead of crashing
  
  laithalsaadoon
  and
  claude
  committed
  5e8bca3
- fix(converter): guard every string-set membership test on transcript fields
  
  laithalsaadoon
  and
  claude
  committed
  c0ad2c4
- docs(release): describe the three main rulesets and the release push
  
  laithalsaadoon
  and
  claude
  committed
  435884e