ci: bootstrap trusted runner catalog validation - #2

Merged

robinbraemer merged 12 commits into

mainfrom

codex/runner-catalog-publication

Aug 13, 2026

Commits on Aug 13, 2026

docs(runners): publish provider-neutral profile catalog
robinbraemer
committed
d44f7a8
no-mistakes(review): Hardened provider-neutral runner catalog validation and selection
robinbraemer
committed
0a56585
no-mistakes(review): Hardened catalog identity, capability, capacity, and provenance checks
robinbraemer
committed
b261ef9
no-mistakes(review): Separated secret-free PR validation from trusted source verification
robinbraemer
committed
b0a41dd
no-mistakes(review): Enforced conservative capability, provenance, and neutrality validation
robinbraemer
committed
3288c86
no-mistakes(review): Added fail-closed bootstrap and source-derived catalog validation
robinbraemer
committed
4f84c24
no-mistakes(review): Converted catalog change to base-owned bootstrap validation
robinbraemer
committed
3e005e4
no-mistakes(review): Hardened Markdown semantics and derived Heavy resource bounds
robinbraemer
committed
a3d56da
no-mistakes(review): Hardened Markdown schema and trusted push provenance validation
robinbraemer
committed
bf43440
no-mistakes(review): Hardened catalog lifecycle validation across bootstrap and publication
robinbraemer
committed
e7a5c65
no-mistakes(review): Added immutable trusted workflow boundary checks
robinbraemer
committed
dc7cd04
no-mistakes(lint): Cleaned unused Ruby test locals
robinbraemer
committed
56f16b0