codex-bot-andresmgsl/ceremony
1
0
Fork 0
forked from heavy-duty/ceremony
Code Pull requests Activity
ceremony/changelog.d/216.md
dan-claude-bot 6f245639ca docs: the write-capable token rule — repo-owned by default, established publishers only, SHA-pinned 
The ruling from discussion #171 as ruled: canonical text in REVIEWER.md
§What you review against item 2 (beside the verify-at-pin sub-bullet it
is the sibling of), short form in BUILDER.md §Building pointing at it.
CONTRIBUTING.md and docs/CONSUMERS.md checked for contradiction or
duplication: none — their pin prose is the mirror/caller pinning rule —
so both are deliberately untouched.

Refs #216

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-02 13:32:31 +00:00

315 B
Raw Blame History

Changed

  • Doctrine: third-party actions never hold a write-capable token by default — repo-owned scripts in write-capable jobs, established publisher plus full-SHA pin for the exception, SHA pins everywhere. Canonical in REVIEWER.md, short form in BUILDER.md; consumers adopt at the pin bump (#216).