hermes-agent

mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-05-06 10:47:12 +08:00

Files

Teknium c77a6e3faa chore(security): add OSV-Scanner CI + Dependabot for github-actions only (#20037 )

Adds two supply-chain controls that complement our existing pinning
strategy (full-SHA action pins, exact-version source dep pins via
uv.lock / package-lock.json) without undermining it.

.github/workflows/osv-scanner.yml
  Detection-only scan of uv.lock and the ui-tui/website package-locks
  against the OSV vulnerability database. Runs on PRs that touch
  lockfiles, on push to main, and weekly against main so CVEs
  published after merge still surface. Uses Google's officially-
  recommended reusable workflow pinned by full SHA (v2.3.5).
  Findings upload to the Security tab; fail-on-vuln is disabled so
  pre-existing vulns in pinned deps do not block merges — we move
  pins deliberately, not under CI pressure.

.github/dependabot.yml
  Scoped to github-actions only. Action pins must be moved when
  upstream publishes patches (often themselves security fixes);
  Dependabot opens a PR with the new SHA + release notes for normal
  review. Source-dependency ecosystems (pip, npm) are deliberately
  NOT enabled — automatic version-bump PRs against uv.lock /
  package-lock.json would fight our pinning strategy. CVE-driven
  security updates for source deps are enabled separately via the
  repo's Dependabot security updates setting (GitHub UI), which
  fires only when a pinned version becomes known-vulnerable.

2026-05-04 20:58:21 -07:00

contributor-check.yml

security: supply chain hardening — CI pinning, dep pinning, and code fixes (#9801 )

2026-04-14 14:23:37 -07:00

deploy-site.yml

docs: publish llms.txt and llms-full.txt for agent-friendly ingestion (#18276 )

2026-04-30 23:17:14 -07:00

docker-publish.yml

Fix for broken docker build

2026-04-20 14:36:04 +10:00

docs-site-checks.yml

docs(website): dedicated page per bundled + optional skill (#14929 )