root - chore: defense - record Aikido scan-release gate as merged

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
Docs / supply-chain hardening status.

Summary

Records the merged Aikido scan-release gate (PR #75) in DEFENSE_IN_DEPTH.md and SECURITY.md (defense-in-depth § 6). There is no further auto-implementable file change; remaining items need maintainer or admin access.

Status update

DEFENSE_IN_DEPTH.md: Aikido scan-release gate → PR #75

Remaining (not this PR)

• Socket reviews dependency PRs — no Socket Security check or bot comment on lockfile PRs (root - chore: defense - enable pnpm trustPolicy no-downgrade #67, root - chore: defense - block dependency lifecycle scripts #68). Install the Socket Security GitHub app on Hyphen/react-sdk.
• No npm tokens in Actions secrets — workflows have no NPM_TOKEN/NODE_AUTH_TOKEN refs; this token cannot list secrets (403). Inspect and delete leftovers.
• § 5 (manual): npmjs trusted publisher stage-only for release.yaml; Drydock; 2FA promote; disallow tokens.
• § 7 (manual, last): phishing-resistant 2FA; recovery codes; then a repo admin runs lockdown-repo.sh (never committed here).

Verification

• release.yaml on main has build.needs: [scan-release]
• No Socket Security checks on recent dependency-change PRs

Reference

defense-in-depth-nodejs § 6

  

[gemini-code-assist]

Code Review

This pull request updates the documentation in DEFENSE_IN_DEPTH.md and SECURITY.md to reflect that the Aikido release gate is now active and the stage-publish job is gated on a passing Aikido scan-release job. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (ae5304b) to head (37c4fb8).

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #76   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            3         3           
  Lines           19        19           
  Branches         1         1           
=========================================
  Hits            19        19           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T23:11:43.038865Z	37c4fb8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.