up

.gitea/workflows/build-test-deploy.yml

@@ -64,6 +64,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Verify policy scope configuration
+        run: python3 scripts/verify-policy-scopes.py
+
       - name: Validate NuGet restore source ordering
         run: python3 ops/devops/validate_restore_sources.py
 

.gitea/workflows/release.yml

@@ -139,6 +139,14 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3.4.0
 
+      - name: Install Syft
+        run: |
+          set -euo pipefail
+          SYFT_VERSION="v1.21.0"
+          curl -fsSL "https://github.com/anchore/syft/releases/download/${SYFT_VERSION}/syft_${SYFT_VERSION#v}_linux_amd64.tar.gz" -o /tmp/syft.tgz
+          tar -xzf /tmp/syft.tgz -C /tmp
+          sudo install -m 0755 /tmp/syft /usr/local/bin/syft
+
       - name: Determine release metadata
         id: meta
         run: |
@@ -182,6 +190,10 @@ jobs:
           echo "calendar=$CALENDAR_INPUT" >> "$GITHUB_OUTPUT"
           echo "push=$PUSH_FLAG" >> "$GITHUB_OUTPUT"
 
+      - name: Enforce CLI parity gate
+        run: |
+          python3 ops/devops/check_cli_parity.py
+
       - name: Log in to registry
         if: steps.meta.outputs.push == 'true'
         uses: docker/login-action@v3