Guarded Repository Evidence Contract (codex_plugin_scanner/guarded_repository_evidence.py)

Generates sanitized evidence and provenance metadata for secure GitHub Action workflow runs. Use to audit repository scan results securely.

# Source: https://github.com/hashgraph-online/hol-guard | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
# Provided via justclaw.it.com; keep this notice with the code.
"""Sanitized evidence contract for the Guarded Repository GitHub Action.

The evidence intentionally records scan/run metadata only. Scanner findings,
repository file paths, source content, prompts, commands, credentials, actor
identity, and private workflow inputs are excluded.
"""

from __future__ import annotations

import hashlib
import json
import re
from dataclasses import asdict, dataclass
from datetime import datetime, timezone
from pathlib import Path
from typing import Literal

SCHEMA_VERSION = "guarded-repository/v1"
CLAIM = (
    "Guarded Repository means this commit 

... (truncated -- full source via MCP)