ci(openspec): enforce archive-at-merge with a gate + /archive workflow - #185

Open

gohabereg wants to merge 4 commits into

mainfrom

worktree-openspec-archive-ci

GitHub Advanced Security / CodeQL succeeded Jul 23, 2026 in 4s

No new alerts in code changed by this pull request

View all branch alerts.

Annotations

Check failure on line 292 in .github/workflows/openspec-archive.yml

Code scanning / CodeQL

Untrusted Checkout TOCTOU High

Insufficient protection against execution of untrusted code on a privileged workflow (

).

Check failure on line 292 in .github/workflows/openspec-archive.yml

Code scanning / CodeQL

Checkout of untrusted code in a privileged context High

Checkout of untrusted code in a privileged workflow with later potential execution (event trigger:

).