3 Commits

Author	SHA1	Message	Date
Dotta	86bbabfecd	Patch isolated reporting URI dependency and enforce Node policy ... Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-09-12 22:46:36 -05:00
Dotta	2116570603	Isolate trusted runner reporting dependencies behind an integrity lock ... Install only the dedicated reporting runtime with npm ci and disabled lifecycle scripts. Preserve the trusted source checkout, pin all registry artifacts, and execute reporting and publication through the isolated runtime before and after scoped credential exchange. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-09-12 22:38:31 -05:00
Dotta	378f1aec81	Resolve trusted qualification reporting locks before frozen installation ... Retain the master-only authorization and trusted reporting checkout. Verify that lock resolution changes only the CI-owned lockfile, and align cache regressions with the existing pinned upstream workflow. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-09-12 20:30:17 -05:00