AIPass

1,358 Commits 9 Branches 14 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
AIOSAI	9048666c65	ci: OSSF scorecard hardening (DPLAN-0243) — hash-pin all standalone workflow pip installs via .github/requirements/ locks (pip/lint/build/e2e/audit, pip-compile --generate-hashes, 11/11 target-env closure verified incl. Windows colorama marker fix) + provenance attestation on publish (attest-build-provenance v4.1.1 SHA-pinned, id-token+attestations perms) + dependabot pip ecosystem for the new locks. Editable -e . installs untouched byte-identical. 5/5 fresh-venv --require-hashes installs green, 5/5 YAML parse, pinned ruff matches repo lint. First SSH-signed commit (repo config wired this session).	2026-07-15 12:21:22 -07:00
AIOSAI	3071ea8eac	ci(deps): bump codeql-action init+analyze to v4.36.3 together + group future bumps The split Dependabot PRs (#init, #analyze) each bumped one path in security.yml, leaving the sibling at v4.36.2 -> CodeQL fails 'init and analyze must match'. Bump both to v4.36.3 (SHA 54f647b) in one commit, and add a dependabot groups block so codeql-action (init/analyze/upload-sarif, one monorepo release) always lands as a single grouped PR. Fixes the two red Security Scan runs.	2026-07-05 02:07:18 -07:00
AIOSAIandClaude Opus 4.6	f30443504c	chore: add hooks, CI/CD infrastructure, ignore runtime JSON - Transfer Claude Code hooks from internal: identity injector, email notification, auto-fix diagnostics, pre-compact recovery - Add notification sounds for tool use, stop, and alerts - Wire all hooks in .claude/settings.json - Add global system prompt (.aipass/aipass_global_prompt.md) - Add branch-local prompt placeholders for all modules - Set up CI pipeline: lint (ruff) → test matrix (3.10-3.13) → coverage - Add workflows: PyPI publish, security scanning, stale issues - Add GitHub issue templates, dependabot, editorconfig - Configure pytest norecursedirs and coverage fail-under=70 - Add *.json to gitignore — runtime JSON files constantly change - Untrack runtime JSON (registry, plans, seed bypass, module data) - Keep source JSON tracked via negation rules (json_templates, pack, spawn templates, settings, pyrightconfig) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-06 20:33:40 -08:00

Author

SHA1

Message

Date

AIOSAI

9048666c65

ci: OSSF scorecard hardening (DPLAN-0243) — hash-pin all standalone workflow pip installs via .github/requirements/ locks (pip/lint/build/e2e/audit, pip-compile --generate-hashes, 11/11 target-env closure verified incl. Windows colorama marker fix) + provenance attestation on publish (attest-build-provenance v4.1.1 SHA-pinned, id-token+attestations perms) + dependabot pip ecosystem for the new locks. Editable -e . installs untouched byte-identical. 5/5 fresh-venv --require-hashes installs green, 5/5 YAML parse, pinned ruff matches repo lint. First SSH-signed commit (repo config wired this session).

2026-07-15 12:21:22 -07:00

AIOSAI

3071ea8eac

ci(deps): bump codeql-action init+analyze to v4.36.3 together + group future bumps

The split Dependabot PRs (#init, #analyze) each bumped one path in security.yml,
leaving the sibling at v4.36.2 -> CodeQL fails 'init and analyze must match'.
Bump both to v4.36.3 (SHA 54f647b) in one commit, and add a dependabot groups
block so codeql-action (init/analyze/upload-sarif, one monorepo release) always
lands as a single grouped PR. Fixes the two red Security Scan runs.

2026-07-05 02:07:18 -07:00

AIOSAIandClaude Opus 4.6

f30443504c

chore: add hooks, CI/CD infrastructure, ignore runtime JSON

- Transfer Claude Code hooks from internal: identity injector, email
  notification, auto-fix diagnostics, pre-compact recovery
- Add notification sounds for tool use, stop, and alerts
- Wire all hooks in .claude/settings.json
- Add global system prompt (.aipass/aipass_global_prompt.md)
- Add branch-local prompt placeholders for all modules
- Set up CI pipeline: lint (ruff) → test matrix (3.10-3.13) → coverage
- Add workflows: PyPI publish, security scanning, stale issues
- Add GitHub issue templates, dependabot, editorconfig
- Configure pytest norecursedirs and coverage fail-under=70
- Add *.json to gitignore — runtime JSON files constantly change
- Untrack runtime JSON (registry, plans, seed bypass, module data)
- Keep source JSON tracked via negation rules (json_templates, pack,
  spawn templates, settings, pyrightconfig)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-06 20:33:40 -08:00