Skip to content

Releases

v1.0.2: Enforce TLS policy and document support

v1.0.2: Enforce TLS policy and document support Latest
Latest

Choose a tag to compare

View all tags
@Slymaster Slymaster released this 31 Oct 07:48
v1.0.2
60f27d8

This update hardens the action's HTTPS transport and the TLS defaults passed to the installed Node.js CLI.

  • REST requests require TLS 1.2 or later, OpenSSL security level 2, and valid server certificates. Security level 2 requires at least 2048-bit RSA/DH and 224-bit ECC.
  • Setting NODE_TLS_REJECT_UNAUTHORIZED=0 makes the action fail before any network request or CLI probe.
  • Both CLI invocations receive certificate verification enabled and sanitized NODE_OPTIONS containing the TLS policy. Unrelated Node options are preserved. The installed CLI remains trusted code and can override its own connection options.
  • Redirects remain rejected. The 30-second request timeout, 8 MiB response limit, and transient-error retries are retained.
  • Eleven automated tests include real HTTPS handshakes, certificate and key rejection, and CLI environment checks. The README documents the policy, tests, contribution process and support links.

The v1.0.2 and v1 tags now identify commit 60f27d8. This replaces the earlier documentation-only v1.0.2 tag at e0082ae. Consumers pinned to the previous commit must update their pin to receive the TLS changes.

Validation completed on the exact replacement commit before updating the tags and republishing this release:

  • Test workflow
  • GitHub CodeQL, zero open code-scanning alerts at publication
  • Local suite on Node.js 20 and 22: 11 tests passed on each runtime

Guarani AI remains in private beta. A provisioned workspace token and access to the beta CLI or API are required.

Assets 2
Loading

v1.0.1: Align inputs, verdicts (CLEARED/HOLD) and REST API with Guarani AI v1 beta docs

v1.0.1: Align inputs, verdicts (CLEARED/HOLD) and REST API with Guarani AI v1 beta docs
Marketplace
Marketplace

Choose a tag to compare

View all tags
@Slymaster Slymaster released this 31 Oct 07:13
v1.0.1
6c8e005

Aligns the action with the Guarani AI v1 beta verification contract, including workspace tokens, profiles, verdicts, findings, and REST polling.

The hosted API and CLI packages are in private beta and are not publicly available yet. The action fails closed if it cannot obtain a valid verification result. The report input is validated but does not publish an external report in this version.

Loading