Repository navigation
Promote eMudhra incident response to main (#483) - #484
Merged
Merged
Conversation
emudhra-incident-response
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
devtomain: #483 (emudhra-incident-response).Changes
.github/workflows/main.yml: both R2 sync steps (dev and prod) exportAWS_CA_BUNDLEfrom the certifi bundle, so the AWS CLI verifies R2's TLS chain against certifi instead of its embedded bundle, which still trusts the Sectigo AAA root that cross-signs the compromised eMudhra intermediates.requirements.txt:certifi>=2026.10.19floor (first release to drop the emSign ECC Root CA - G3).CONTRIBUTING.mdmoved from.github/to the repo root and adapted for this repo; README link updated.SECURITY.mdadded: private vulnerability reporting via GitHub advisories, scope and supported-versions policy for the registry.LICENSEadded (MIT).Notes
providers/src. The push run onmainwill execute the setup steps only; all publish and deploy steps are gated onNUM_PROVIDERS > 0.AWS_CA_BUNDLElines in the prod R2 sync step first execute on the next provider promotion tomain. Watch that run.Verification
CI green on the
devmerge commit d34dd72: Build and Deploy (setup only, all deploy steps skipped), Provider Delete Guard, CodeQL, Dependency Graph.