fix(APP-01): harden static security and production-evidence foundation #10

	# security-ci — enforce the CSP + security-header profile (M1B).
	#
	# Turns docs/security/csp-baseline.json from "specified" into "enforced":
	# 1. connect-src exfil-boundary gate (build fails on */https:/http:/non-allowlisted origin)
	# 2. serializer + header-served integration tests (node --test, zero deps)
	#
	# Hardening mirrors docs-ci.yml: top-level empty permissions (least privilege;
	# each job opts in), SHA-pinned public actions, persist-credentials: false,
	# pinned tool version (Node 22, local<->CI parity). Inline on purpose (a
	# private coworkerz-ci reusable breaks under the default GITHUB_TOKEN).
	name: security-ci

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]

	permissions: {}

	jobs:
	csp-enforcement:
	name: CSP connect-src gate + header tests
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
	with:
	node-version: "22"
	- name: connect-src exfil-boundary gate (fails on wildcard/scheme/non-allowlisted origin)
	run: node src/security/serialize-cli.js --check
	- name: serializer + header-served integration tests
	run: npm test

Navigation Menu