Repository navigation

repair(foundation): unblock coverage and CodeQL control plane - #2385

Merged

27 commits merged into

mainfrom

fix/codeql-dispatch-unblock

Sep 27, 2026

Merged

repair(foundation): unblock coverage and CodeQL control plane#2385
27 commits merged into
mainfrom
fix/codeql-dispatch-unblock

Commits on Sep 18, 2026
- fix(security): allowlist https://api.github.com before urllib urlopen
  
  seonghobae
  and
  cursoragent
  committed
  a83d6d3
- test(security): pin GitHub API redirect credential boundary
  seonghobae
  committed
  225260a
- fix(security): contain GitHub API redirects to admitted origin
  seonghobae
  committed
  0ae2204
- test(security): pin Strix redirect credential boundary
  seonghobae
  committed
  062663a
- fix(security): contain Strix GitHub API redirects
  seonghobae
  committed
  2708a6b
- chore(deps): bump anyio from 4.14.0 to 4.14.2
  dependabot[bot]
  authored
  3758b89
Commits on Sep 19, 2026
- test(security): align Strix transport seam with dedicated opener
  seonghobae
  committed
  4dcd25c
- test(security): bind authenticated openers at owned seams
  seonghobae
  committed
  834d285
- merge(security): carry #2269 urllib GitHub API opener into #2278
  seonghobae
  committed
  6d10002
- chore(deps): isolate AnyIO security owner delta
  seonghobae
  committed
  545648e
- merge: carry AnyIO lock update onto protected owner
  seonghobae
  committed
  c51c8d2
- fix(opencode): materialize every coverage lock input
  seonghobae
  committed
  e43a75b
- docs(gap): bind coverage repair to canonical PR
  seonghobae
  committed
  c4a73a1
Commits on Sep 20, 2026
- fix(deps): restore AnyIO owner isolation
  seonghobae
  committed
  8a5251b
Commits on Sep 23, 2026
- repair(codeql): restore exact endpoint-set assertion
  seonghobae
  committed
  657d104
- chore(foundation): converge dependency and CodeQL repairs
  seonghobae
  committed
  f1a8dc8
Commits on Sep 24, 2026
- fix(opencode): adopt AnyIO security prerequisite
  seonghobae
  committed
  42e4198
- fix(test-gate): restore full branch coverage
  seonghobae
  committed
  38cfcae
- test(queue-health): scope permission assertion to workflow token
  seonghobae
  committed
  21247ef
- test(queue-health): isolate collector edge cases
  seonghobae
  committed
  57c168b
- repair(foundation): converge CodeQL endpoint contract into coverage owner
  seonghobae
  committed
  f229816
Commits on Sep 25, 2026
- fix(security): update AnyIO lock for audit gate
  seonghobae
  committed
  3b3ce16
Commits on Sep 26, 2026
Commits on Sep 27, 2026
- test(queue): reject scalar broad permissions
  seonghobae
  committed
  871b662
- test(queue-health): pin exact read-only token permissions
  seonghobae
  committed
  372f5b8

Navigation Menu

Repository navigation

repair(foundation): unblock coverage and CodeQL control plane - #2385

repair(foundation): unblock coverage and CodeQL control plane#2385
27 commits merged into
mainfrom
fix/codeql-dispatch-unblock

Commits on Sep 18, 2026

fix(security): allowlist https://api.github.com before urllib urlopen

test(security): pin GitHub API redirect credential boundary

fix(security): contain GitHub API redirects to admitted origin

test(security): pin Strix redirect credential boundary

fix(security): contain Strix GitHub API redirects

chore(deps): bump anyio from 4.14.0 to 4.14.2

Commits on Sep 19, 2026

test(security): align Strix transport seam with dedicated opener

test(security): bind authenticated openers at owned seams

merge(security): carry #2269 urllib GitHub API opener into #2278

chore(deps): isolate AnyIO security owner delta

merge: carry AnyIO lock update onto protected owner

fix(opencode): materialize every coverage lock input

docs(gap): bind coverage repair to canonical PR

Commits on Sep 20, 2026

fix(deps): restore AnyIO owner isolation

Commits on Sep 23, 2026

repair(codeql): restore exact endpoint-set assertion

chore(foundation): converge dependency and CodeQL repairs

Commits on Sep 24, 2026

fix(opencode): adopt AnyIO security prerequisite

fix(test-gate): restore full branch coverage

test(queue-health): scope permission assertion to workflow token

test(queue-health): isolate collector edge cases

repair(foundation): converge CodeQL endpoint contract into coverage owner

Commits on Sep 25, 2026

fix(security): update AnyIO lock for audit gate

Commits on Sep 26, 2026

fix(codeql): unblock CodeQL scan dispatch for all .github PRs

repair(foundation): converge coverage, dependency, and CodeQL owners

fix(ci): bind AnyIO security pin to Strix input

Commits on Sep 27, 2026

test(queue): reject scalar broad permissions

test(queue-health): pin exact read-only token permissions