Skip to content

Codex Guard v1.13.0

Choose a tag to compare

View all tags
@Akimiya-z Akimiya-z released this 23 Aug 18:09
v1.13.0
81ce603
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Trust-boundary hardening and more truthful CI gating.

Highlights:

  • Sanitizes and bounds attacker-controlled report text; sweep output reaches shell steps only through an environment variable.
  • Paginates commit statuses, check runs, and report comments.
  • Pending or partially visible CI can no longer appear green; both CI APIs unavailable now fail closed.
  • Handles every completed GitHub check conclusion and ignores previous Codex Guard runs.
  • Makes sweep-label effective and detects GitHub Copilot copilot/ branches by default.
  • Pins internal GitHub Actions by full commit SHA and locks the workflow validator.

Upgrade note: existing workflows should add statuses: read to their permissions block. Generated workflows already include it.

Validation: 120 tests, Node 22/24 CI, coverage, manifest validation, Markdown lint, package audit, and package dry-run all passed.

Assets 2
Loading