Skip to content

fix(review): 특권 OpenCode PR 소스 격리 #579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 32 commits into from
Closed

fix(review): 특권 OpenCode PR 소스 격리 #579

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
61f4389
fix(review): isolate untrusted PR source blobs
seonghobae Jul 16, 2026
9548f66
fix(review): bind approvals and isolate Git metadata
seonghobae Jul 17, 2026
469c9eb
fix(review): fail closed before Noema credentials
seonghobae Jul 17, 2026
9e3508f
fix(review): trust isolated coverage worktree
seonghobae Jul 17, 2026
461ddf2
feat(review): scope organization queue sweeps
seonghobae Jul 17, 2026
171ba46
fix(review): close Strix trust-boundary findings
seonghobae Jul 17, 2026
8702d86
Merge remote-tracking branch 'origin/main' into agent/fix-opencode-un…
seonghobae Jul 17, 2026
448b42d
fix(security): fail closed on incomplete Strix scans
seonghobae Jul 17, 2026
0496b9c
Merge remote-tracking branch 'origin/main' into agent/fix-opencode-un…
seonghobae Jul 17, 2026
1cd2e86
Merge remote-tracking branch 'origin/main' into agent/fix-opencode-un…
seonghobae Jul 17, 2026
e7e4ffd
test(review): prove offline coverage paths
seonghobae Jul 17, 2026
f538d6d
test(review): isolate scheduler actor lookup
seonghobae Jul 17, 2026
0acf47f
style(review): format materializer regression tests
seonghobae Jul 20, 2026
e3c8d45
fix(review): 모델 풀 큐 독점과 형식 재시도 제한
seonghobae Jul 20, 2026
8b575e5
fix(review): bind evidence and pin coverage runners
seonghobae Jul 20, 2026
1a826b7
fix(review): install trusted base Python locks
seonghobae Jul 20, 2026
ac73542
fix(review): close privileged execution boundaries
seonghobae Jul 22, 2026
ad0d616
fix(ci): close review trust-boundary gaps
seonghobae Jul 22, 2026
099ce24
fix(ci): harden trusted review execution
seonghobae Jul 22, 2026
674f9ba
fix(review): preserve descriptor and SHA identity
seonghobae Jul 22, 2026
7e3cbcf
fix(review): harden identity and scope contracts
seonghobae Jul 22, 2026
d153584
fix(ci): harden trusted review tooling
seonghobae Jul 22, 2026
746dcbc
fix(ci): harden Strix source materialization
seonghobae Jul 22, 2026
c7b33d2
fix(ci): anchor review identity evidence
seonghobae Jul 22, 2026
bb55850
fix(ci): diff Dependabot lock from merge base
seonghobae Jul 22, 2026
dcc56ac
test(review): isolate autofix actor lookup
seonghobae Jul 22, 2026
0d66caa
fix(review): anchor OpenCode base identity
seonghobae Jul 22, 2026
b3bb41b
test(ci): cover privileged fail-closed paths
seonghobae Jul 22, 2026
6a6e5d4
fix(autofix): require trusted marker actor
seonghobae Jul 22, 2026
b7fe19c
fix(ci): support coverage artifact reruns
seonghobae Jul 22, 2026
4d58323
fix(ci): ignore malformed autofix markers
seonghobae Jul 22, 2026
c9d2871
merge: refresh OpenCode isolation against main
seonghobae Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/noema-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ run-name: >-

on:
pull_request_target:
types: [opened, synchronize, reopened, ready_for_review, closed]
types: [opened, synchronize, reopened, ready_for_review, edited, closed]
workflow_run:
workflows: ["Required OpenCode Review", "Strix Security Scan"]
types: [completed]
Expand Down
171 changes: 132 additions & 39 deletions .github/workflows/opencode-review.yml
View file
Open in desktop

Large diffs are not rendered by default.

Loading
Loading