4 Commits

Include renames

Author	SHA1	Message	Date
sharang	65d0ec0d34	ci: bump trivy to 0.70.0 (M0.2) ... v0.50.0 release tarball doesn't exist on GitHub releases (404). Pin to v0.70.0 which is the current latest. Refs: M0.2	2026-05-18 21:40:33 +02:00
sharang	aabe7cd60b	ci: replace aquasecurity/trivy-action with inline binary ... The trivy-action does an internal actions/checkout against github.com/aquasecurity/trivy, which fails on Gitea (act_runner injects Gitea creds; clone returns exit 128). Switch to the same inline-download pattern we use for gitleaks. Refs: M0.2	2026-05-18 21:36:11 +02:00
sharang	ca046f3ddb	ci: rework workflow for Gitea Actions (M0.2) ... The original ci.yaml used wagoid/commitlint-github-action and gitleaks/gitleaks-action, both of which hit GitHub-specific API endpoints that 404 on Gitea ("error trying to get list of pull request's commits: not found"). Changes: - commitlint: bash regex against Conventional Commits, scoped to the PR commit range. Zero external deps. - gitleaks: inline tarball download + binary run, exit-code 1 on any finding. - trivy: unchanged (works fine; uses local fs scan). - Per-stack test/image/e2e jobs now gated on hashFiles(go.sum) / hashFiles(package.json) / hashFiles(Dockerfile) so they skip cleanly on empty repos and light up automatically when real code lands (M4.1, M5.1, etc.). Refs: M0.2	2026-05-18 21:34:07 +02:00
sharang	2e3b7c0499	chore: bootstrap repo scaffolding (M0.1) ... Bootstraps §1.2 scaffolding (README, CONTRIBUTING, CODEOWNERS, CHANGELOG, PR + issue templates, LICENSE, CI workflow, release workflow, commitlint, cliff, .editorconfig, .gitignore, .env.example) and ships a proprietary all-rights-reserved LICENSE naming both founders. Refs: M0.1	2026-05-18 19:15:36 +00:00