 Simon Scatton
|
05050a6d64
|
refactor(ci): extract release qualification and serialize Codex reviews (#4419)
* refactor(ci): extract release qualification and serialize Codex reviews
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* fix(ci): queue Codex reviews without security ordering
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* fix(ci): retain qualification evidence after build failures
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* docs(ci): shorten compatibility review guidance
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
---------
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
|
2026-10-15 13:46:33 +00:00 |
|
|
dependabot[bot]
|
4d9a1d2a54
|
chore(deps): bump github/codeql-action/upload-sarif (#4552)
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.7 to 4.38.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...24c54180a607b1449ed407dd24f251e4e9147c8d)
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.38.3
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
2026-10-14 18:41:04 +00:00 |
|
|
alangou
|
249c6e727f
|
fix(ci): retain sanitized Codex scan diagnostics on failure (#4304)
* fix(ci): preserve public-safe Codex scan diagnostics
Signed-off-by: Adrien Langou <alangou@nvidia.com>
* fix(ci): reject non-regular scanner reports without blocking
Signed-off-by: Adrien Langou <alangou@nvidia.com>
---------
Signed-off-by: Adrien Langou <alangou@nvidia.com>
|
2026-10-07 23:25:28 +00:00 |
|
|
alangou
|
6144a7beb9
|
ci(security): use gpt-6.1-sol with high reasoning effort (#4203)
Signed-off-by: Adrien Langou <alangou@nvidia.com>
|
2026-10-06 08:51:43 +00:00 |
|
|
Evan Lezar
|
251f77e2b8
|
ci(security): gate tagged releases on scans (#3523)
Signed-off-by: Evan Lezar <elezar@nvidia.com>
|
2026-09-21 18:51:37 +00:00 |
|
|
alangou
|
3eb81beba9
|
ci(security): orchestrate security scans with severity gating (#3255)
Signed-off-by: Adrien Langou <alangou@nvidia.com>
|
2026-09-11 10:26:56 +00:00 |
|
|
alangou
|
64a858dade
|
fix(ci): restore Codex Security scan execution (#3124)
* refactor(ci): resolve Codex Security range in Python
Signed-off-by: Adrien Langou <alangou@nvidia.com>
* fix(ci): allow unprivileged userns for Codex sandbox
Signed-off-by: Adrien Langou <alangou@nvidia.com>
---------
Signed-off-by: Adrien Langou <alangou@nvidia.com>
|
2026-09-03 07:38:51 +00:00 |
|
|
alangou
|
f7180c0fd6
|
feat(ci): add Codex Security release qualification (#3087)
* feat(ci): add Codex Security release qualification
Scan cumulative release-train diffs through NVIDIA inference and publish findings to Code Scanning.
Signed-off-by: alangou <alangou@nvidia.com>
* fix(ci): disable package cache for security scan
Prevent cache poisoning in the tag-triggered Codex Security workflow.
Signed-off-by: alangou <alangou@nvidia.com>
* refactor(ci): simplify Codex Security reporting
Remove custom inference cost accounting so the workflow remains focused on scanning and SARIF publication.
Signed-off-by: alangou <alangou@nvidia.com>
---------
Signed-off-by: alangou <alangou@nvidia.com>
|
2026-09-01 13:57:14 +00:00 |
|