sec: hash-pin every dependency install and add coverage-guided fuzzing - #244

Merged

cdeust merged 13 commits into

mainfrom

sec/pin-dependencies-and-fuzzing

Jul 29, 2026

Commits on Jul 28, 2026

sec: hash-pin every dependency install and add coverage-guided fuzzing

cdeust
and
claude
committed
570d4b3
sec(ci): build the two unbuilt images, sync counts, document the change

cdeust
and
claude
committed
65c2167
sec(ci): install uv via the SHA-pinned action, not an unpinned pip command

cdeust
and
claude
committed
b9f418f

Commits on Jul 29, 2026

fix(scripts): split the uv call from the rules, so the suite needs no uv

cdeust
and
claude
committed
2da5a20
fix(deps): refresh uv.lock instead of bypassing it

cdeust
and
claude
committed
2a71323
merge: main into sec/pin-dependencies-and-fuzzing

cdeust
and
claude
committed
c090278
merge: main into sec/pin-dependencies-and-fuzzing

cdeust
and
claude
committed
f707917
fix(deps): constrain onnxruntime<1.24 on python<3.11 — the lock fork had no cp310 artifact

cdeust
and
claude
committed
ba8e330
fix(ci): fail the doc-claim gate on conflict markers and unparseable JSON

cdeust
and
claude
committed
c7525a9
docs: refresh the advertised test count to the merged tree's measured 6426

cdeust
and
claude
committed
545f404
style: ruff format the new doc-claim gate tests

cdeust
and
claude
committed
60506ef
docs(changelog): record the onnxruntime lock fix and the conflict-marker gate

cdeust
and
claude
committed
5ce9962
ci: move every action off the deprecated Node 20 runtime

cdeust
and
claude
committed
eeb3469