Harden the supply chain, fix the purge tool, add log-based alerting - #5

Merged

Gerrrt merged 8 commits into

mainfrom

chore/post-merge-hardening

Aug 2, 2026

Commits on Aug 2, 2026

fix(security): stop the purge tool from being a copy of the secret it purges
Gerrrt
committed
d620ee8
feat(observability): add log-based alerting rules for Loki
Gerrrt
committed
c94d77f
fix(ci): make the Loki rules check work in a container
Gerrrt
committed
ddd4d71
fix: address review on the purge tool and Loki rules check
Gerrrt
committed
aec7686
fix(ci): evaluate Loki rules promptly instead of waiting out a 1m interval
Gerrrt
committed
1ca69b9
Merge remote-tracking branch 'origin/main' into chore/post-merge-hardening
Gerrrt
committed
6bd1fd7
fix(ci): resolve image versions from compose.yaml instead of duplicating them
Gerrrt
committed
42510f6
feat(security): pin images by digest, add SECURITY.md
Gerrrt
committed
054542c