Observed current state
Current .github/workflows/ci.yml runs only:
npm cinpm testnpm run build
PR #44 exact head caff3511afbd4f6c80a11415a909b2548dd2c67e now genuinely passes those jobs, but the repository has no PR-executed lint, dependency-audit, secret-scan, or CodeQL/security job in that workflow. Branch-protection read also returned 403 Resource not accessible by integration, so required-check enforcement could not be independently verified through the connector.
Required correction
Add small, independently executable PR gates for the checks the repository expects before security-sensitive merges, using existing project tooling where available:
- lint/type/style gate (do not invent a new formatter contract if the repo has none);
- dependency vulnerability review/audit;
- secret scanning / credential-pattern prevention that does not print secrets;
- CodeQL or equivalent static-security workflow appropriate for TypeScript;
- ensure failures do not prevent unrelated jobs from reporting their own result where practical.
Do not weaken tests or suppress findings simply to obtain green status. Separate baseline debt from regressions when necessary.
Truth boundary
Green source CI is not runtime verification. Reported cAPI port remains 3003 and verified_runtime_state=NOT_VERIFIED until deployed SHA, HTTP health/protocol identity, container listener and Traefik routing agree. cAPI must be verified before downstream Gnomledger registration is promoted.
Observed current state
Current
.github/workflows/ci.ymlruns only:npm cinpm testnpm run buildPR #44 exact head
caff3511afbd4f6c80a11415a909b2548dd2c67enow genuinely passes those jobs, but the repository has no PR-executed lint, dependency-audit, secret-scan, or CodeQL/security job in that workflow. Branch-protection read also returned403 Resource not accessible by integration, so required-check enforcement could not be independently verified through the connector.Required correction
Add small, independently executable PR gates for the checks the repository expects before security-sensitive merges, using existing project tooling where available:
Do not weaken tests or suppress findings simply to obtain green status. Separate baseline debt from regressions when necessary.
Truth boundary
Green source CI is not runtime verification. Reported cAPI port remains 3003 and
verified_runtime_state=NOT_VERIFIEDuntil deployed SHA, HTTP health/protocol identity, container listener and Traefik routing agree. cAPI must be verified before downstream Gnomledger registration is promoted.