enricobuehler 5a51b0d8e7 ci: SHA-pin secret-bearing third-party actions + audit the web dep tree ...

- Pin android-actions/setup-android, appleboy/scp-action, and
  appleboy/ssh-action to commit SHAs (version kept in a trailing comment).
  These run in jobs holding the Android signing keystore, Play
  service-account, and deploy SSH key, so a moved tag on a third-party
  action could exfiltrate them.
- Add a bun-audit job to audit.yml over web/bun.lock — the console holds
  the login gate, session sealing, and mgmt token, so its deps matter too
  — and trigger the workflow on web/bun.lock changes alongside Cargo.lock.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-06 07:28:45 +02:00

..

android-screenshots.yml

ci: SHA-pin secret-bearing third-party actions + audit the web dep tree

2026-07-06 07:28:45 +02:00

android.yml

ci: SHA-pin secret-bearing third-party actions + audit the web dep tree

2026-07-06 07:28:45 +02:00

apple.yml

fix(ci/apple): set CMAKE_POLICY_VERSION_MINIMUM=3.5 for the vendored libopus

2026-06-28 21:49:27 +00:00

arch.yml

docs(ci/arch): correct the header's pacman setup (key import, not TrustAll) + note the trust root

2026-07-04 17:19:28 +00:00

audit.yml

ci: SHA-pin secret-bearing third-party actions + audit the web dep tree

2026-07-06 07:28:45 +02:00

bench-gpu.yml

bench(ci): report-only regression harness — Tier-1/2 in CI + Tier-3 GPU runner

2026-06-13 19:24:52 +00:00

ci.yml

build: pin the exact Rust toolchain (1.96.0) to stop rustfmt drift

2026-07-05 19:32:38 +00:00

deb.yml

ci(release): derive canary version from git tags (single source of truth)

2026-07-03 22:40:25 +00:00

decky.yml

ci(release): derive canary version from git tags (single source of truth)

2026-07-03 22:40:25 +00:00

docker.yml

ci: SHA-pin secret-bearing third-party actions + audit the web dep tree

2026-07-06 07:28:45 +02:00

flatpak.yml

fix(flatpak): keep both channels in the OSTree summary (fixes stable "No such ref")

2026-07-03 22:40:35 +00:00

linux-client-screenshots.yml

feat(client/linux): CI screenshot capture

2026-06-28 15:05:38 +00:00

release.yml

fix(apple/release): embed Developer ID provisioning profile in the DMG

2026-07-04 15:00:56 +02:00

rpm.yml

feat(packaging/bazzite): systemd-sysext replaces rpm-ostree layering as the primary install path

2026-07-04 16:39:01 +00:00

web-screenshots.yml

feat(web): CI screenshot capture for the mgmt console

2026-06-28 15:05:27 +00:00

windows-drivers.yml

feat(host/windows): seal the host↔driver channels (frame + gamepad, proto v2)

2026-07-03 12:08:56 +00:00

windows-host.yml

ci(release): derive canary version from git tags (single source of truth)

2026-07-03 22:40:25 +00:00

windows-msix.yml

ci(release): derive canary version from git tags (single source of truth)

2026-07-03 22:40:25 +00:00

windows.yml

fix(windows-ci): add FFmpeg's bin dir to PATH explicitly, don't rely on daemon env

2026-07-01 12:25:25 +02:00