๐๏ธ What Secure Build guarantees
One page on what Loha's Secure Build does for every build, what it guarantees, what it does not, and what stays your job.
๐๏ธ Build Security
What the Build Security policy modes do, and exactly what Enforce does and does not guarantee.
๐๏ธ Security issues
How Loha tracks a vulnerability or secret across builds, who can triage it, and when it is due.
๐๏ธ Security exceptions
How to let a known finding through the Build Security gate for a limited time, who approves it, and when it ends.
๐๏ธ Image signing, SBOM and provenance
How Loha signs images that pass the Build Security gate, what it attaches, and how anyone can verify it with cosign.
๐๏ธ Fix pull requests
How Loha opens pull requests that fix vulnerable dependencies, what it changes, and what it will not do.
๐๏ธ Secret scanning on push
How Loha scans every pushed commit for secrets, what the loha/secret-scan check means, and how Enforce refuses builds of a commit with an open secret.
๐๏ธ Image promotion (gate before tag)
Under Enforce, the tag you push only moves to an image that passed the security gate.
๐๏ธ Admission policies
A ready-made policy so your cluster refuses images from your Loha-built repositories that Loha did not sign.