Skip to content

v1.4.2 — hardened QA runtime

Choose a tag to compare

View all tags
@cderinbogaz cderinbogaz released this 21 Aug 09:48
v1.4.2
cb2a5da
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Juror v1.4.2 hardens the isolated post-merge browser QA runtime.

Highlights:

  • keep Codex Responses on auth-appropriate HTTPS endpoints through the controller-owned allowlisted proxy, with inherited NO_PROXY bypasses removed
  • restore sandboxed Chromium startup for arbitrary non-root runner identities by providing a private writable home
  • verify namespace and seccomp-BPF protection on native amd64 before release, including a passwd-less numeric UID/GID
  • preserve npm, Action-source, SBOM, image, and provenance verification through the existing trusted release workflows

Full changes: #72 and #73.

Assets 7
Loading