Skip to content

README.md

Latest commit

 

History

History
28 lines (21 loc) · 1.18 KB

README.md

File metadata and controls

28 lines (21 loc) · 1.18 KB

codingworkflow-security-policies

Central repository for organization-wide CI/CD governance workflows.

Required workflows

  • .github/workflows/required-zizmor.yml
    • Reusable workflow (workflow_call) designed to be enforced through GitHub org rulesets.
    • Runs zizmor against .github/workflows in the caller repository.
  • .github/workflows/required-poutine.yml
    • Reusable workflow (workflow_call) designed to be enforced through GitHub org rulesets.
    • Runs boostsecurityio/poutine-action and uploads SARIF to code scanning.

Reusable workflows

  • .github/workflows/reusable-claude-review.yml
    • Centralized manual PR review workflow using anthropics/claude-code-action.
    • Supports Azure OIDC + Azure Key Vault secret retrieval in caller context.
  • .github/workflows/reusable-opencode-review.yml
    • Centralized manual PR review workflow using anomalyco/opencode/github.
    • Supports both single model and multi-model matrix runs in the same workflow:
      • use model for a single run
      • use models (comma/newline list) for matrix fan-out

Governance

  • Protected by a repository ruleset managed with Terraform.
  • CODEOWNERS requires owner review for all changes.