Repository navigation

feat(security-review): automated per-PR security-review pipeline (EXP-440) - #1940

Open

gvladika wants to merge 54 commits into

mainfrom

feature/exp-440-security-review-pipeline

Open

feat(security-review): automated per-PR security-review pipeline (EXP-440)#1940
gvladika wants to merge 54 commits into
mainfrom
feature/exp-440-security-review-pipeline

Commits on Jun 8, 2026
- feat(commands): add /extract-audit-knowledge skill (EXP-478)
  
  gvladika
  and
  claude
  committed
  7728d46
- fix(commands): correct idempotency check in /extract-audit-knowledge (EXP-478)
  
  gvladika
  and
  claude
  committed
  8d887b1
- feat(audit): seed audit/knowledge/ corpus from existing audit reports (EXP-479)
  
  gvladika
  and
  claude
  committed
  8460961
- feat(audit-knowledge): backfill 39 missing audits; corpus schema 1.1 (EXP-479)
  
  gvladika
  and
  claude
  committed
  9acc367
- feat(ci): add Stage 1 static-analysis workflow for security review (EXP-480)
  
  gvladika
  and
  claude
  committed
  d51c695
- chore(ci): remove Aderyn job from Stage 1 workflow (EXP-484)
  gvladika
  committed
  041e524
Commits on Jun 15, 2026
- feat(ci+commands): add lifi-pr-review skill + Stages 2/3 workflow (EXP-483)
  
  gvladika
  and
  claude
  committed
  17e1201
- fix(ci): scope PR diff to src/ in security-review workflow (EXP-483)
  
  gvladika
  and
  claude
  committed
  ebec888
- refactor(security-review): wrap ToB skills instead of reimplementing (EXP-483)
  
  gvladika
  and
  claude
  committed
  f19e92b
- fix(ci): drop Aderyn refs from Stage 2 workflow + skill (EXP-484)
  gvladika
  committed
  0b76783
- pr-ready: align docs + skip-list with Aderyn removal (lifi-pr-review/EXP-484)
  gvladika
  committed
  5c08a82
- docs(security-review): drop EXP-482 noise-baseline references
  gvladika
  committed
  44407dc
- refactor(security-review): drop Aderyn from Stage 1; tighten Slither tuning rationale (EXP-484)
  
  gvladika
  and
  claude
  committed
  daf85ba
- fix(semgrep): tighten lf-046 / lf-029 / lf-053 rules (EXP-484)
  
  gvladika
  and
  claude
  committed
  50b0477
- chore(semgrep): delete lf-053-loop-msg-value (duplicate of Slither detector)
  gvladika
  committed
  73316f7
- feat(audit-knowledge): coverage check + add-audit chain (EXP-481)
  
  gvladika
  and
  claude
  committed
  66e40e6
- fix(audit-knowledge): drop CI guard, keep local diagnostic (EXP-481)
  
  gvladika
  and
  claude
  committed
  4c4031d
- fix(audit-knowledge): coverage script honors processed_audits field (EXP-481)
  gvladika
  committed
  2fe48e0
- fix(security-review): tune Slither + Semgrep precision (EXP-484) [stack 6/7] (#1888)
  
  gvladika
  and
  claude
  authored
  e7de0b7
Commits on Jun 17, 2026
Commits on Jun 18, 2026
- Scope Stage 1 SARIF queue to changed files in fp-check triage
  
  gvladika
  and
  claude
  committed
  d5053bf
Commits on Jun 19, 2026
- Strip ticket IDs, changelog notes, and stale terms from pipeline code
  
  gvladika
  and
  claude
  committed
  d2f40c3
Commits on Jun 25, 2026
- Merge branch 'main' into feature/exp-440-security-review-pipeline
  gvladika
  authored
  9d4a817
- chore(security-review): rename skill to lifi-security-review, drop unused coverage script
  
  gvladika
  and
  claude
  committed
  a6e28ad
- Merge branch 'main' into feature/exp-440-security-review-pipeline
  gvladika
  authored
  be8cdc7
- fix(security-review): address code-review findings
  
  gvladika
  and
  claude
  committed
  103576c
Commits on Jun 26, 2026
- fix(security-review): exclude external/fork PRs from keyed Stage 2
  
  gvladika
  and
  claude
  committed
  d093961
- pr-ready: anchor-fix lf-046 receiver name regex (lf-046:43)
  
  gvladika
  and
  claude
  committed
  6779b35
- pr-ready: match ERC20 balanceOf-as-amount in lf-001 (lf-001:32)
  
  gvladika
  and
  claude
  committed
  fdefa35
- pr-ready: narrow lf-029 signature-binding exclusion (lf-029:49)
  
  gvladika
  and
  claude
  committed
  6491136
- pr-ready: exclude guarded non-native branch in lf-054 (lf-054:24)
  
  gvladika
  and
  claude
  committed
  a0428e2
- pr-ready: correct lf-002 SafeERC20 remediation message (lf-002:12)
  
  gvladika
  and
  claude
  committed
  62a4e42
- pr-ready: fix LF-011 title to match root_cause (findings.json:352)
  
  gvladika
  and
  claude
  committed
  e77a5b0
- pr-ready: make extract-audit-knowledge reruns idempotent (extract-audit-knowledge.md:117)
  
  gvladika
  and
  claude
  committed
  da36a79
- pr-ready: make Stage 1 SARIF download non-fatal (security-review.yml:251)
  
  gvladika
  and
  claude
  committed
  78556e7
- pr-ready: load security-review controls from base revision (security-review.yml:121)
  
  gvladika
  and
  claude
  committed
  9aa21f7
- pr-ready: map src/Interfaces in by-area routing (lifi-security-review.md:98)
  
  gvladika
  and
  claude
  committed
  2719783
- pr-ready: require curated.sarif on cost-guardrail exit (lifi-security-review.md:164)
  
  gvladika
  and
  claude
  committed
  39bc71d
- pr-ready: don't init ToB submodule from PR head (security-review.yml:259)
  
  gvladika
  and
  claude
  committed
  964b777
Commits on Jul 2, 2026
- fix(security-review): harden keyed Stage 2 against prompt injection (EXP-440)
  
  gvladika
  and
  claude
  committed
  e0a0df1
Commits on Jul 15, 2026
- Merge remote-tracking branch 'origin/main' into feature/exp-440-security-review-pipeline
  gvladika
  committed
  6186444

Commits

Commits on Jun 8, 2026

Commits on Jun 15, 2026

Commits on Jun 17, 2026

Commits on Jun 18, 2026

Commits on Jun 19, 2026

Commits on Jun 25, 2026

Commits on Jun 26, 2026

Commits on Jul 2, 2026

Commits on Jul 15, 2026