Skip to content

Umbra Admission v0.2.0 — detection scan + SARIF

Choose a tag to compare

View all tags
@bkd-dotcom bkd-dotcom released this 30 Jul 20:43
· 23 commits to main since this release
v0.2.0
da5cd51
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Umbra Admission v0.2.0 — govern any coding agent's PR with a signed receipt, now
with an optional built-in vulnerability scan.

  • Agent-agnostic admission pipeline: contract → injection quarantine →
    required checks → independent verifier → earned authority → Ed25519 receipt.
  • NEW: scan mode (scan: "true") runs the umbra-core SAST detection engine over the
    PR and uploads SARIF to code scanning — 7 languages, cross-file taint,
    deterministic and offline. Optional scan-fail-on gates the check; outputs
    sarif-file and findings-count. Needs security-events: write.
  • Layered prompt-injection defense (patterns + structural carriers + full-file
    quarantine + optional semantic classifier).
  • Sandboxed checks on Linux (auto-installs bubblewrap); UMBRA_REQUIRE_SANDBOX
    fail-closed option.
  • Posts a verdict comment, uploads the signed receipt, fails the check below the
    required authority. Never merges.

Pin @v1 (moving) or @v0.2.0 (exact). Requires umbra-core>=0.5.0 (installed

Contributors

v1
Assets 2
Loading