-See [SECURITY.md](SECURITY.md). It enumerates concrete `FAIL IF` checks across dependencies, GitHub Actions, release pipelines, and the tend automation surface, and it is enforced by `.github/workflows/security-audit.yaml` (nightly + as a required gate before VS Code publish). Read it before touching: `.github/workflows/`, `.github/dependabot.yml`, `.config/tend.yaml`, `pnpm-workspace.yaml`, `scripts/sign-and-deploy.sh`, or anything that introduces a new secret, workflow trigger, or environment. Failures are tracked under the `security-audit-failure` issue label.
0 commit comments