From the AI-native docs audit (B8 in .agents/known-issues.md).
Two supply-chain hardening points:
- Renovate auto-merge (
renovate.json) merges non-major updates automatically. This relies on master branch protection requiring status checks to pass. Verify that protection is configured, otherwise a broken update could merge without CI.
- NuGet publish has no approval gate (
.github/workflows/nuget.yml): pushing a v* tag publishes to NuGet.org immediately. Consider a GitHub Environment with required reviewers for the publish job.
Severity: medium (process).
From the AI-native docs audit (B8 in
.agents/known-issues.md).Two supply-chain hardening points:
renovate.json) merges non-major updates automatically. This relies onmasterbranch protection requiring status checks to pass. Verify that protection is configured, otherwise a broken update could merge without CI..github/workflows/nuget.yml): pushing av*tag publishes to NuGet.org immediately. Consider a GitHub Environment with required reviewers for the publish job.Severity: medium (process).