3 Commits

Author	SHA1	Message	Date
cesnimda	e981c63a4d	fix(security): patch vulnerable NuGet dependencies flagged by CI gate ... The new dependency scan correctly failed on real advisories. Bump MailKit 4.13.0->4.17.0 (clears MailKit+MimeKit moderates) and add transitive security pins for the .NET 8.0.0 High-severity advisories: System.Text.Json 8.0.6, Microsoft.Extensions.Caching.Memory 8.0.1 (with DependencyInjection.Abstractions 8.0.2), System.Security.Cryptography.Xml 8.0.3. Verified locally: clean vuln scan, Release build OK, all 39 tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-01 11:38:08 +02:00
cesnimda	87d44537b9	ci: add secret/vuln scanning + staging & production deploy pipelines ... security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and pushes to main/develop (detective backstop to the pre-commit hook). deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated local staging stack (needs a self-hosted Windows runner). deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready to activate once the Linux server + its runner exist. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-01 10:49:08 +02:00
cesnimda	0d3a5fe2fe	docs: define Git workflow, versioning, and environment strategy ... Add the canonical workflow reference (docs/WORKFLOW.md): branch model (main/develop + feature/fix/hotfix), Conventional Commits, SemVer, tagging, and the three-environment strategy (native dev, Docker staging, Linux prod). Seed VERSION (0.1.0) as the single source of truth and a Keep-a-Changelog CHANGELOG. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-01 10:14:15 +02:00