Jordan Harband 799de1d2dc [actions] TOC: use node/install instead of setup-node ...

`lts/*` is now node 26, which is not in the runner's tool cache,
so `setup-node` downloads it from a GitHub release asset host that the harden-runner allowlist blocks.
`node/install` installs node with nvm from nodejs.org, like the other workflows.

2026-11-02 13:42:07 -06:00

..

ISSUE_TEMPLATE

[meta] disable blank issues

2024-11-04 15:07:16 +00:00

scripts

[actions] cache container images, verified against digests looked up live

2026-10-09 14:14:20 -07:00

workflows

[actions] TOC: use node/install instead of setup-node

2026-11-02 13:42:07 -06:00

external-threat-actor.png

[security] add threat model

2023-11-15 10:10:29 -08:00

FUNDING.yml

[meta] create FUNDING.yml

2019-11-05 12:05:09 -08:00

INCIDENT_RESPONSE_PLAN.md

[meta] update security policy; add IRP

2025-06-23 16:11:48 -07:00

insider-threat-actor-and-libs.png

[security] add threat model

2023-11-15 10:10:29 -08:00

SECURITY.md

[security] add security escalation policy

2025-09-15 14:33:37 +02:00

THREAT_MODEL.md

[Docs] threat model: document the mirror payload/metadata trust boundary

2026-07-15 13:44:04 -07:00