gqlPrune

Every workflow assigns permissions explicitly, contents: read at the workflow level, elevated per job only where a task needs it (the SBOM job gets contents: write to upload the release asset; publishing gets its OIDC token in the shared release workflow).

Workflows accept no free-text collaborator input. The only inputs to the reusable workflows are typed booleans, and metadata such as pull request bodies is passed through environment variables rather than interpolated into shell.

Each user-facing release has a unique semantic version, published to npm (https://www.npmjs.com/package/gqlprune) and tagged in git (e.g. v2.0.1). [version_unique]

docs/security-policies.md documents the secrets policy: publishing holds no credential (OIDC trusted publishing), the only standing secret is the Codecov upload token in GitHub Actions secrets, secret scanning and gitignore guard the repository, access follows the GOVERNANCE.md escalated-permissions policy, and rotation is defined. https://github.com/Krister-Johansson/gqlPrune/blob/main/docs/security-policies.md

The Verifying a release section of SECURITY.md documents npm audit signatures (command, what it checks, expected result) and the SBOM asset attached to each GitHub release. https://github.com/Krister-Johansson/gqlPrune/blob/main/SECURITY.md

The same section states the expected identity in the provenance attestation: built by GitHub Actions from Krister-Johansson/gqlPrune via the release-please workflow, and says to treat any other identity as compromised. https://github.com/Krister-Johansson/gqlPrune/blob/main/SECURITY.md

SECURITY.md states the scope and duration of support: bug fixes and security updates for the latest release only, with no long-term support branches. https://github.com/Krister-Johansson/gqlPrune/blob/main/SECURITY.md

SECURITY.md states that a release stops receiving security updates the moment a newer release is published. https://github.com/Krister-Johansson/gqlPrune/blob/main/SECURITY.md

GOVERNANCE.md requires review before any escalated permissions: the maintainer reviews contribution history and identity, and records the grant and reasoning in an issue. https://github.com/Krister-Johansson/gqlPrune/blob/main/GOVERNANCE.md

Each GitHub release carries a CycloneDX SBOM of the production dependency tree as an asset, generated by the SBOM workflow; the current release (gqlprune-v2.11.0) has gqlprune-2.11.0.cdx.json attached. https://github.com/Krister-Johansson/gqlPrune/blob/main/.github/workflows/sbom.yml

The project is a single repository; releases comprise no other codebases.

Automated Jest test suite covering the utilities, core pruner, config generator, and CLI dispatch. [test]

The testing policy is documented in CONTRIBUTING.md: https://github.com/Krister-Johansson/gqlPrune/blob/main/CONTRIBUTING.md#testing-policy [tests_documented_added]

docs/assurance-case.md is the threat model and attack surface analysis: it enumerates the surfaces (scanned input, the release pipeline, dependencies, output), argues each threat and its mitigations, and states known limitations; it is updated as the design changes. https://github.com/Krister-Johansson/gqlPrune/blob/main/docs/assurance-case.md

docs/security-policies.md defines the exploitability (VEX) process: any non-affecting component vulnerability gets a recorded statement matching the alert dismissal. Currently there are zero such open vulnerabilities (last reviewed 2026-08-15); the dev-only js-yaml case is the recorded historical example. https://github.com/Krister-Johansson/gqlPrune/blob/main/docs/security-policies.md

docs/security-policies.md defines severity-based remediation thresholds for dependency findings (critical 7 days, high 14, moderate 30, low at next release) and the license policy (OSI-approved, MIT-compatible, inventoried in NOTICES.md). https://github.com/Krister-Johansson/gqlPrune/blob/main/docs/security-policies.md

The policy states that a release does not ship while a critical or high dependency finding is open against the production tree, and the required dependency audit check enforces this continuously. All dependency findings were cleared before 2.11.0 shipped. https://github.com/Krister-Johansson/gqlPrune/blob/main/docs/security-policies.md

The dependency audit status check runs npm audit against the production tree on every pull request and is required by the branch ruleset, so high or critical advisories block merge. Dependabot supplies the vulnerability intelligence, and suppressions require a recorded VEX statement per the policy. https://github.com/Krister-Johansson/gqlPrune/blob/main/.github/workflows/sca.yml

CodeQL findings surface in GitHub code scanning and are addressed. [static_analysis_fixed]

GitHub CodeQL code scanning runs on pushes, pull requests, and on a schedule; ESLint (typescript-eslint) and strict tsc --noEmit also run in CI. [static_analysis]