originmark-platform

CI/CD workflows assign strictly the minimum required permissions: ci.yml enforces read-only access (permissions: contents: read) across test and audit jobs, and release.yml isolates token and attestation write permissions to release jobs.

All workflow inputs and trigger contexts are evaluated through fixed, sanitized parameter blocks without executing unquoted shell expressions or interpolating collaborator input into arbitrary shell commands.

Release assets, tarballs, and manifests are explicitly prefixed with the release version identifier (e.g. originmark-v0.1.0.tar.gz) and mapped directly to git tag v0.1.0 and release SHA-256 digests.

SECURITY.md documents our Secrets and Credentials Management Policy, governing storage via GitHub Encrypted Secrets, restricted 2FA maintainer access, 90-day rotation cadences, and immediate revocation protocols.

docs/RELEASE_VERIFICATION.md provides step-by-step instructions for consumers to verify release asset integrity via published SHA256SUMS manifests and cryptographic checksum commands.

docs/RELEASE_VERIFICATION.md specifies instructions to verify the authoring process and maintainer identity using GitHub CLI attestation verification (gh attestation verify) backed by Sigstore OIDC identities.

SECURITY.md and SUPPORT.md explicitly define the support lifecycle: the latest active minor release branch (currently 0.1.x) receives functional and security patches for 12 months post-release.

SECURITY.md explicitly states that versions prior to 0.1.0 (< 0.1.0) are End-of-Life (EOL) and no longer receive security updates.

MAINTAINERS.md defines our Collaborator Review and Permission Escalation Policy, requiring vetting of contribution history, identity lineage verification, 2FA onboarding, and Lead Maintainer sign-off prior to granting escalated access.

Official releases automatically generate and bundle a CycloneDX Software Bill of Materials (SBOM) in JSON format via .github/workflows/release.yml.

This project is a single, self-contained monorepo with no external subproject repositories.

CONTRIBUTING.md and README.md clearly document local test execution commands (pytest with coverage, npm test) and automated CI pipeline execution triggers.

CONTRIBUTING.md enforces our Testing Policy, requiring all major feature additions and bug fixes to include corresponding automated tests and regression checks to be accepted.

GitHub branch protection rules on main require at least one non-author human review and approval prior to merging any pull request.

docs/SECURITY_ASSESSMENT.md provides a comprehensive threat model and attack surface analysis covering signing keys, content hashes, authentication, API routes, and architectural mitigations.

The project maintains an OpenVEX document in docs/VEX.json detailing third-party dependency vulnerability assessments and documenting non-exploitability statuses.

SECURITY.md documents our SCA policy defining strict remediation thresholds (Critical/High within 7 days, Medium within 30 days) and zero tolerance for incompatible licenses.

SECURITY.md mandates that all High and Critical SCA vulnerabilities must be resolved or officially documented in docs/VEX.json prior to publishing any release.

GitHub Actions (.github/workflows/ci.yml) automatically scans all dependencies on every pull request using pip-audit and npm audit, blocking merges if vulnerabilities are found.

SECURITY.md defines our SAST remediation policy, mandating that any High or Medium severity code weakness identified by static analyzers must be resolved before merging.

CI workflow (.github/workflows/ci.yml) automatically evaluates all code changes against Bandit, Ruff, and ESLint security rules, blocking PR merges in the event of violations.