security: fail closed on privileged workflow refs - #1912

Open

lawrencecchen wants to merge 7 commits into

harden-manaflow-cifrom

security/dispatch-trust

Commits on Sep 2, 2026

security: gate privileged workflows on trusted refs
lawrencecchen
committed
940477b
fix: fetch release tags before change detection
lawrencecchen
committed
1d0f082
test: trigger workflow contract on release script changes
lawrencecchen
committed
5b3f75e
fix: fetch protected main before ancestry checks
lawrencecchen
committed
9b2ab30
fix: safely retry existing draft releases
lawrencecchen
committed
ffddeac
security: bind release publication to immutable tags
lawrencecchen
committed
203eca9
security: pin release commit identity
lawrencecchen
committed
94387db