Wiki on Dominicus In

CI/CD

Mon, 01 Jan 0001 00:00:00 +0000

CI/CD
#

Workflow inventory for dominicusin.github.io. All checks must pass on main.

Required (branch protection)
#

🧪 Build, validate, test, link-check (quality.yml) — the only required status check. Lint + Hugo build + Jest + Playwright + link check.

Security
#

Workflow	Purpose	Blocking?
`security.yml`	npm audit + Trivy + Semgrep	no
`security-scan.yml`	CodeQL + Gitleaks	no
`dependency-review.yml`	block PRs with new vulns	PR-only
`sbom.yml`	generate SBOM + attest	no
`scorecard.yml`	OpenSSF Scorecard	no (continue-on-error)
`license-check.yml`	license allowlist	no

Housekeeping / PR mgmt
#

stale.yml — auto-close stale issues/PRs
lock-threads.yml — lock old threads
labeler.yml + labeler.yml config — auto-label by path
pr-title-check.yml — Conventional Commits reminder
size-label.yml — PR size label

Deploy
#

hugo.yml — build + deploy to GitHub Pages (artifact attestation via actions/attest@v4.2.2).
deploy-dao.yml — DAO contract tests always run; deploy job skips when DEPLOY_PRIVATE_KEY / SEPOLIA_RPC_URL secrets are absent.
fortify.yml — Fortify AST scan, skips without credentials.

Known external (not repo-owned)
#

Vercel, Snyk — third-party GitHub Apps failing on rate/test limits. Not fixable from this repo; disable in repo Settings → Integrations if unwanted.
CircleCI — fixed via .circleci/config.yml.

Engineering Blog — Wiki

Mon, 01 Jan 0001 00:00:00 +0000

Engineering Blog — Wiki
#

This wiki tracks the operations, CI/CD, and security posture of the dominicusin.github.io Hugo + Blowfish engineering blog.

Security

Mon, 01 Jan 0001 00:00:00 +0000

Security
#

Supply-chain and application-security posture for dominicusin.github.io.

Code scanning (CodeQL)
#

Alerts: 0 (as of 2026-08-20). 8 src/ alerts fixed in code; 11 scripts/ alerts closed as won't fix (build-time utilities, covered by codeql-config.yml paths-ignore).
Config: .github/codeql/codeql-config.yml.

Secret scanning
#

Resolved: Firebase web config is public-by-design (false positive).
Gitleaks runs in security-scan.yml.

Attestations (SLSA)
#

actions/attest@v4.2.2 (Generate Generic Attestations) runs on:
- sbom.yml — attests the generated SBOM (sbom.spdx.json).
- hugo.yml — attests the built site artifact (./public).

Dependency hygiene
#

Dependabot active (dependabot.yml).
dependency-review.yml blocks PRs introducing new vulnerabilities.
license-check.yml enforces a permissive license allowlist.

Hardening notes
#

DA0 contracts compile/test under Hardhat 2.x (3.x breaks the CommonJS config + chai-matchers). See issue #202 / milestone “CI/CD Hardening”.
Deploy DAO contracts and Fortify AST Scan are gated on secrets and skip gracefully when absent (non-blocking).

Wiki on Dominicus In

CI/CD

CI/CD #

Required (branch protection) #

Security #

Housekeeping / PR mgmt #

Deploy #

Known external (not repo-owned) #

Engineering Blog — Wiki

Engineering Blog — Wiki #

Security

Security #

Code scanning (CodeQL) #

Secret scanning #

Attestations (SLSA) #

Dependency hygiene #

Hardening notes #

CI/CD
#

Required (branch protection)
#

Security
#

Housekeeping / PR mgmt
#

Deploy
#

Known external (not repo-owned)
#

Engineering Blog — Wiki
#

Security
#

Code scanning (CodeQL)
#

Secret scanning
#

Attestations (SLSA)
#

Dependency hygiene
#

Hardening notes
#