sync: dev -> main - #10
Merged
Merged
Conversation
Findings applied from the independent audit (CHANGES verdict): workflow-level permissions contents:read; persist-credentials false on checkout; every action pinned to a reviewed commit SHA with its tag in a comment; Serena pinned in .mcp.json to the audited git commit instead of floating uvx resolution. Finding: [P1] workflows ran with default token permissions Finding: [P1] .mcp.json launched unversioned uvx serena Finding: [P2] mutable action tags across all repositories Verified: python yaml.safe_load + json.load on the changed files Source: original Co-Authored-By: GPT-5 Codex <noreply@openai.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Reviewed-by: GPT-5 Codex <noreply@openai.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
repo: workflow and MCP hardening from the security audit
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230938Z-apply-push-37f496 Patch-SHA256: b4531359ae7de13e8c3971798360d09faad4bb1369d9460ef9d09472c51e51e7
repo: run the term wall in CI
`pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234700Z-apply-push-f50b1d Patch-SHA256: 2a0805c0fffd8c391d021298a54e94a005628bc080ab5fa7f622a67ff5137d9c
repo: scan a pull request again when its text is edited
minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004053Z-apply-push-b507a7 Patch-SHA256: 6e2ac3b46cc179bb7757c9e87d797f7304beb2346b944b3db8dadb6829f53c2f
repo: move the wall to the object-store scan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release sync: everything on
devsince the last sync, rebased onto the release branch. Today: the term wall in CI, the object-store content scan, theeditedtrigger, pinned actions and reusable workflows, and the review resolution.🤖 Generated with Claude Code
https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY