forkless/NotAlterra
1
0
Fork 0
mirror of https://github.com/forkless/NotAlterra.git synced 2026-08-21 10:28:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

add SBOM generation to CI, document in governance

Browse Source
This commit is contained in:
forkless
2026-06-13 19:36:12 +02:00
parent 8de34fc4a9
commit fbfc2eb626
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/GOVERNANCE.md
+4
View File
@@ -83,6 +83,10 @@ not published. The maintainer tests the draft binaries before publishing.
> CodeQL static analysis is enabled on every push and pull request.
> Alerts are reviewed before release. Currently zero open alerts.
>
> An SBOM (CycloneDX JSON) is generated during every tagged release
> and included alongside the binaries. It lists every crate in the
> dependency tree, versions, and licenses.
Before signing a release tag, the maintainer verifies: