Shyngys Shynbolatov e191cf8b36 ci: narrow npmscan to dependency-file changes, least privilege, comment only on findings ...

- runs only when package.json, package-lock.json or yarn.lock changes, and
  scans all three
- contents: read; the job adds pull-requests: write only for the comment
- checkout pinned to the ci.yml v7.0.1 SHA with persist-credentials: false
- npmscan-action pinned to v1.4.0; comment: on-findings, 20-minute timeout
- documents what is sent to npmscan.com at the top of the workflow

2026-10-21 06:34:06 +06:00

..

ISSUE_TEMPLATE

feat: add retention feedback loop and honest support matrix (#2681)

2026-08-04 21:42:25 -04:00

prompts

ci: harden workflows and sponsor code review config

2026-06-09 21:20:17 -04:00

workflows

ci: narrow npmscan to dependency-file changes, least privilege, comment only on findings

2026-10-21 06:34:06 +06:00

CODEOWNERS

feat: extend harness audit integration scoring (#1990)

2026-05-19 06:20:54 -04:00

copilot-instructions.md

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

dependabot.yml

ci: avoid redundant Python dependency floors

2026-09-03 14:59:01 -04:00

FUNDING.yml

chore: clean up FUNDING.yml format

2026-02-28 10:09:51 -08:00

PULL_REQUEST_TEMPLATE.md

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

release.yml

feat: deliver v1.8.0 harness reliability and parity updates

2026-03-04 14:48:06 -08:00