ci-config-guard-claudeseclisted

# CI Config Regression Guard — Authoring Playbook CI gates are the controls between a regression and a green build, and they are easy to weaken **silently** (lower a floor, drop a job from an aggregator's `needs:`, re-introduce a tag pin, delete an `exit 1`). This skill produces a guard test that makes any such weakening fail loudly and reviewably. Maps to OWASP CICD-SEC-1 (Insufficient Flow Control) / CICD-SEC-7 (Insecure System Configuration) and NIST SSDF PO.3/PW.4. Catalog of existing guards: `docs/devsecops/ci-config-regression-guards.md`. Implementations: `scanner/tests/test_ci_*.py`. ## When to add a guard Add one only when **silent weakening of a specific invariant would disable enforcement** AND you can name a concrete past or plausible incident. No incident → likely not worth it (avoid guard sprawl). Good candidates: required-check aggregator `needs` completeness, action SHA-pinning, coverage `--cov-fail-under`, a severity `exit 1`, a load-bearing version pin. ## Conventions (ClaudeSec) - **Location**: `scanner/tests/test_ci_<thing>.py`, run by the `scanner-unit-tests` job (`python3 -m pytest scanner/tests/`). - **stdlib-only**: regex / line scanning. **No PyYAML** — it's not in `requirements-ci.txt`, so `import yaml` fails in CI. - **No `scanner/lib` import** → does not affect the 99% coverage gate. - **Direction-explicit**: floors `>=` (ratchet-up stays green), pins `==` (any change trips), triggers/flags = presence. State it in the docstring. - **Non-