okxlin d26004a6ca Harden Renovate caching and digest versioning ...

Strip image digests before deriving app directory versions, while continuing to reject digest-only images. Document the cache privacy boundary, restrict the workflow token to read-only, and bound full scans to 90 minutes.

2026-07-12 10:36:01 +08:00

..

renovate_app_version.py

Harden Renovate caching and digest versioning

2026-07-12 10:36:01 +08:00

renovate_sidecar_guard.py

ci(renovate): close sidecar-only bot prs

2026-07-03 21:12:38 +08:00

renovate_whitelist_audit.py

Soften upgrade-script whitelist heuristic (#4529)

2026-07-04 22:04:40 +08:00

renovate-entrypoint.sh

Fail incomplete Renovate runs (#4728)

2026-07-12 01:45:57 +08:00

test_renovate_app_version.py

Harden Renovate caching and digest versioning

2026-07-12 10:36:01 +08:00