Submission: CI Security Gates

• Name / student identifier:
• Package manager, runtime and scanner versions:
• Date and environment:
• Mode: local live checks / optional hosted run / supplied-report analysis:

1. Apply the policy to three cases

The scenario files are synthetic teaching cases, not CVEL scan evidence. Write expected helper exits before running them. Record actual output if you run them; otherwise mark execution unperformed.

Scenario	Expected helper exit	Observed exit and message (or unperformed)	Why pass, block or require review?
high.json: complete scan with high finding
clean.json: complete scan without findings
incomplete.json: lookup incomplete, no listed findings

Why does an empty findings list not justify passing an incomplete scan?

2. Verify your application's before/after gate

Evidence	Before repair	After repair
Report filename and scan date
Scan status / complete / findingCount
Built-in threshold command exit
Helper exit and message
Functional test result
Actual execution or supplied historical artifact

List the reviewed dependency change and exact command. Attach manifest/lockfile comparison and reports. Explain whether a nonzero result came from a policy finding or a scanner/setup problem. Do not fabricate a live run from a historical report.

3. Explain the control

1. Which files enforce this policy, and why would continue-on-error undermine it?
2. Why may medium findings remain even when the gate passes?
3. What does least privilege mean? Why does this read-only scan workflow need contents: read, not permission to push changes? Can you answer this without running GitHub Actions?
4. Explain how the supplied lockfile and script-disabled install support a reproducible, safer sample setup.

Optional hosted evidence

Only if you ran GitHub Actions: provide before/after run URLs, logs, the step that changed and what its result establishes. If you completed the local path, write not attempted. Local and hosted paths have the same maximum credit.