Security fixes CI-A1..CI-A9 (CI/hosting audit)

CI-A1: required checks bind only to the workflow at the current base tip; stale hashes need a re-run.
CI-A2: scratch repos are created with has_actions=0, cannot enable Actions, and are skipped by every scheduler.
CI-A3: site variables are production-only unless marked preview; non-admin previews need an admin opt-in.
CI-A4: GITHUB_ENV denylist covers proxy/TLS/toolchain vars; forge curl runs pinned under a scrubbed env.
CI-A5: job-token pushes are marked only for refs the push actually landed.
CI-A6: job tokens require a running job; Runner DO finalize retries completeJob from the alarm.
CI-A7: deployment creator falls back to parent run actor / head commit author; reviewers need write.
CI-A8: badge cache is consulted after authorization and keyed on visibility.
CI-A9: sites outbound filter parses IP literals via net/resolve-guard.

taigrrcommitted 15 days agoparent d60578dbf1f81f123af901372085dc0fa15e1d6ee150d2fBrowse files