boost

Least privilege is the default and it is audited. Every workflow declares a permissions: block; ci.yml and publish.yml default to contents: read at workflow level and grant write scopes only on the single job that needs them (publish.yml's guard job holds contents: read while the release job holds the write scopes and the PyPI Trusted-Publishing OIDC). zizmor's excessive-permissions audit runs as a required check on every pull request, so a job granted more than it needs fails the build rather than merging. https://github.com/jonnyeclectic/boost/blob/main/.github/workflows/publish.yml

No workflow uses pull_request_target, so a fork's pull request runs with a read-only token and no secret access. Secrets are bound at job level and never interpolated into a run: block. Three checks enforce this rather than convention: zizmor (template-injection and dangerous-triggers audits, with every suppression documented by reason in .github/zizmor.yml), actionlint, and shellcheck — which actionlint shells out to, and which is pinned in the lint toolchain precisely because actionlint silently skips every run: block when shellcheck is absent and still exits 0. Documented in SECURITY.md: https://github.com/jonnyeclectic/boost/blob/main/SECURITY.md#secrets-and-credentials

Versions come from setuptools-scm reading git tags, so there is no hand-maintained version constant to fall out of sync and a version is unique by construction. 'boost --version' reports it. [version_unique]

SECURITY.md § Secrets and credentials is the policy, covering storage, access and rotation: releases use no stored token (PyPI Trusted Publishing mints a short-lived OIDC identity, so there is nothing to rotate or steal); every secret that does exist is optional and every job reading one skips itself when absent; secrets never reach untrusted code; an optional token is rotated on suspicion of exposure or when the holder's access is removed, revoked at the issuing service before being replaced or deleted; and gitleaks fails the build on a committed secret. MAINTAINERS.md carries the table of who holds which credential. https://github.com/jonnyeclectic/boost/blob/main/SECURITY.md#secrets-and-credentials

Every release is signed with SLSA build provenance at build time. publish.yml runs actions/attest-build-provenance over dist/* after 'twine check' and before the PyPI upload, so the exact bytes published are the bytes signed, and the attestation records which workflow built which artifact from which commit. Upload to PyPI additionally uses Trusted Publishing (a short-lived OIDC identity, no stored token). A CycloneDX SBOM is generated per released wheel and attached to the GitHub release. Verification instructions: https://github.com/jonnyeclectic/boost/blob/main/docs/verifying-releases.md [osps_br_06_01] [signed_releases]

Every release is signed with SLSA build provenance at build time. publish.yml runs actions/attest-build-provenance over dist/* after 'twine check' and before the PyPI upload, so the exact bytes published are the bytes signed, and the attestation records which workflow built which artifact from which commit. Upload to PyPI additionally uses Trusted Publishing (a short-lived OIDC identity, no stored token). A CycloneDX SBOM is generated per released wheel and attached to the GitHub release. Verification instructions: https://github.com/jonnyeclectic/boost/blob/main/docs/verifying-releases.md [osps_br_06_01] [signed_releases]

SUPPORT.md § What is supported states the scope and duration plainly: only the latest release is supported, there are no backport branches and no long-term-support line, and the supported answer for an older version is to upgrade. It also names the supported environments (operating systems and Python versions), which are exactly what CI runs on every pull request, and states that Python 3.11 and earlier are not supported. https://github.com/jonnyeclectic/boost/blob/main/SUPPORT.md#what-is-supported

SUPPORT.md § When a version stops receiving security updates answers it in one line: the moment a newer release exists. boost cuts a release on every merge to main, so maintaining an older supported line would mean supporting hundreds of versions, and the document says so rather than implying a support window it does not offer. If a release fixes a publicly known vulnerability the release notes name it. https://github.com/jonnyeclectic/boost/blob/main/SUPPORT.md#when-a-version-stops-receiving-security-updates

MAINTAINERS.md § Becoming a maintainer is the published policy, and step 2 is the criterion: 'Review before the grant — the lead maintainer reviews that history and proposes the change in a public issue, naming the scope of access being granted and why. Existing maintainers may object there.' It also requires a track record first, least privilege at the grant (write access is a separate decision from repository administration, which is separate again from anything touching the release path), and that the file is updated in the same change — an access grant not recorded there has not happened. The same review applies when an existing maintainer is given more access. https://github.com/jonnyeclectic/boost/blob/main/MAINTAINERS.md#becoming-a-maintainer

Every release carries a CycloneDX SBOM, generated at build time by .github/workflows/sbom.yml and attached to the GitHub Release as boost-sbom.cdx.json. Verified rather than assumed: the three most recent releases (v1.2.31, v1.2.30, v1.2.29) each carry that asset. Worth stating because this control was inert for 253 releases — it was triggered by release: [published], an event created with GITHUB_TOKEN, which never chains to another workflow; it now runs on workflow_run after the release workflow. https://github.com/jonnyeclectic/boost/releases

boost is a single source-code repository. A release comprises one repository and has no subprojects, so there is no second codebase whose security requirements could be weaker. https://github.com/jonnyeclectic/boost

Four tiers: tests/unit and tests/functional (pytest; the functional suite drives the real CLI in-process), tests/smoke.sh (170 end-to-end checks through the ./boost shim), and a Gherkin BDD suite of 11 features / 47 scenarios. [test]

The policy is mandated by automation rather than by convention, which is the stronger form. CONTRIBUTING.md states that behaviour changes need tests and that anything under boost_cli/core is mutation-tested; the changed-line coverage gate and the mutation gate then enforce it as required status checks, so a change adding major functionality without tests cannot be merged into main even by the maintainer - main is protected and takes changes only through a pull request that has passed the full gate. [test_policy_mandated]

https://github.com/jonnyeclectic/boost/blob/main/docs/security-design.md is that assessment. It identifies the most likely and impactful problems for a CLI that clones third-party repositories and writes files into the directories an AI agent reads - path traversal via attacker-controlled frontmatter, command injection through skill and tap names, archive extraction escapes, link following, untrusted deserialization, supply-chain and CI-action compromise - and pairs each with the mitigation in the codebase. It also states the residual risks plainly, including the most important one: boost can give provenance, integrity and a diff, but cannot vet what a skill instructs an agent to do. [osps_sa_03_01] [assurance_case]

https://github.com/jonnyeclectic/boost/blob/main/docs/dependencies.md documents the monitoring and the thresholds. Dependabot proposes upgrades; pip-audit fails the build when a resolved dependency matches a known OSV or PyPI advisory and also runs on a weekly schedule so a newly published advisory against unchanged code is still caught; OSV-Scanner runs diffed against the base branch and fails on what a pull request adds; a licence gate fails on a licence outside the allowed set; and a CycloneDX SBOM is generated per released wheel. pip-audit and osv-scan are both required checks. The runtime has no third-party dependency to monitor, which is the strongest form of this. [dependency_monitoring]

https://github.com/jonnyeclectic/boost/blob/main/docs/dependencies.md documents the monitoring and the thresholds. Dependabot proposes upgrades; pip-audit fails the build when a resolved dependency matches a known OSV or PyPI advisory and also runs on a weekly schedule so a newly published advisory against unchanged code is still caught; OSV-Scanner runs diffed against the base branch and fails on what a pull request adds; a licence gate fails on a licence outside the allowed set; and a CycloneDX SBOM is generated per released wheel. pip-audit and osv-scan are both required checks. The runtime has no third-party dependency to monitor, which is the strongest form of this. [dependency_monitoring]

https://github.com/jonnyeclectic/boost/blob/main/docs/dependencies.md documents the monitoring and the thresholds. Dependabot proposes upgrades; pip-audit fails the build when a resolved dependency matches a known OSV or PyPI advisory and also runs on a weekly schedule so a newly published advisory against unchanged code is still caught; OSV-Scanner runs diffed against the base branch and fails on what a pull request adds; a licence gate fails on a licence outside the allowed set; and a CycloneDX SBOM is generated per released wheel. pip-audit and osv-scan are both required checks. The runtime has no third-party dependency to monitor, which is the strongest form of this. [dependency_monitoring]

Findings are fixed, or dismissed with a written proof of why they are false positives - never dismissed for convenience. The project keeps that discipline recorded publicly on its roadmap, including the explicit rule that supply-chain posture metrics must not be filed as false positives just to clear the inbox. [static_analysis_fixed]

Several tools, all required checks, all run before every release - which is every merge to main. CodeQL does semantic analysis on push, on pull request and weekly (https://github.com/jonnyeclectic/boost/blob/main/.github/workflows/codeql.yml). ruff's S/flake8-bandit family is Python SAST covering shell=True, tempfile.mktemp, unsafe YAML loading and weak hashing. mypy and pyright are two independent type checkers, the second adding None-flow and narrowing analysis over core/. zizmor audits the GitHub Actions workflows for excessive permissions and unpinned action refs. import-linter enforces the architectural layering. SonarCloud is additionally wired up as an optional, non-blocking dashboard. [static_analysis]