feat(ci): audit orphaned workflow registry evidence read-only - #124

Open

seonghobae wants to merge 115 commits into

mainfrom

test/workflow-registry-orphan-audit

Commits on Aug 12, 2026

test(ci): require fail-closed workflow registry audit
seonghobae
committed
ac23287
feat(ci): classify orphaned workflow registry evidence read-only
seonghobae
committed
b8ad62a
test(ci): bind workflow inventory to reported total count
seonghobae
committed
4f3c314
fix(ci): verify paginated workflow count against API total
seonghobae
committed
8aa8e86
test(ci): prevent stale file-size metadata bypass
seonghobae
committed
d9d8b5a
fix(ci): enforce audit input bound while reading
seonghobae
committed
b4608dc
test(ci): reject impossible workflow audit timestamps
seonghobae
committed
e462a27
test(ci): cover remaining workflow registry review gaps
seonghobae
committed
65e8049
fix(ci): close workflow registry audit gaps
seonghobae
committed
1cd9b4f
test(ci): expose disabled protected workflows
seonghobae
committed
0c65ea9
fix(ci): surface disabled protected workflows
seonghobae
committed
8a5d7ba
test(ci): reject duplicate workflow audit JSON keys
seonghobae
committed
223e539
fix(ci): reject ambiguous duplicate workflow audit JSON
seonghobae
committed
5f8c219
test(ci): reject pathological JSON nesting cleanly
seonghobae
committed
e288a62
test(ci): reproduce parser recursion failure deterministically
seonghobae
committed
22bdcf6
fix(ci): bound JSON parser recursion failures
seonghobae
committed
02d9313
test(ci): use one unittest import style
seonghobae
committed
1fc028c

Commits on Aug 13, 2026

Commits on Aug 14, 2026

test(ci): reject impossible workflow source paths
seonghobae
committed
e376124
fix(ci): validate repository workflow source shape
seonghobae
committed
ef77785

Commits on Aug 15, 2026

test(ci): reject boolean integer lookalikes in workflow evidence
seonghobae
committed
d7f2d20
fix(ci): reject boolean integer lookalikes in workflow evidence
seonghobae
committed
77b63fd
docs(changelog): record workflow registry audit evidence
seonghobae
committed
c226080
test(ci): reject invisible workflow audit text
seonghobae
committed
51749a9
fix(ci): reject invisible workflow audit controls
seonghobae
committed
519c36a
test(ci): reject float workflow registry status codes
seonghobae
committed
1fd8dae
fix(ci): require integer workflow registry status codes
seonghobae
committed
b1b5488
test(ci): reject nonstandard JSON numeric constants
seonghobae
committed
5e2437c
fix(ci): reject nonstandard JSON numeric constants
seonghobae
committed
80c2730
test(ci): bound workflow registry JSON integers
seonghobae
committed
09f1507
fix(ci): bound workflow registry JSON integers
seonghobae
committed
85c2b09
test(ci): reject workflow registry JSON floats
seonghobae
committed
441967a
fix(ci): reject workflow registry JSON floats
seonghobae
committed
5ffaa42
test(ci): reject workflow ids wider than u64
seonghobae
committed
527278c
fix(ci): bound workflow registry ids to u64
seonghobae
committed
8d8649f
test(ci): reject malformed Unicode evidence safely
seonghobae
committed
36b3845
fix(ci): normalize malformed Unicode audit evidence
seonghobae
committed
d6ddd7b
test(ci): reject ambiguous registry schema extensions
seonghobae
committed
62e8463
fix(ci): close workflow registry schema v1
seonghobae
committed
f6a10d8

Commits on Aug 16, 2026

test(ci): reject noncanonical negative-zero evidence
seonghobae
committed
a530500
fix(ci): reject noncanonical negative-zero evidence
seonghobae
committed
9deffec
docs(changelog): record canonical integer evidence
seonghobae
committed
05899bb
test(ci): cover workflow registry HTTP failures
seonghobae
committed
6f7f65d
test(ci): classify retryable workflow registry failures
seonghobae
committed
409b8b0
Merge branch 'main' into test/workflow-registry-orphan-audit
seonghobae
authored
2354d3c
fix(ci): classify retryable registry collection failures
seonghobae
committed
b35911f
test(ci): reject retry for non-transient HTTP failures
seonghobae
committed
78ba9b9
fix(ci): bound retryable registry HTTP failures
seonghobae
committed
ba72cba
docs(changelog): record bounded registry retry contract
seonghobae
committed
acb0dfe
test(ci): require bounded Retry-After registry evidence
seonghobae
committed
6621603
fix(ci): preserve bounded Retry-After evidence
seonghobae
committed
98db5a3
docs(changelog): record Retry-After audit evidence
seonghobae
committed
e5ae33f
test(ci): reject Retry-After on successful registry evidence
seonghobae
committed
3eace83
fix(ci): reject retry metadata on successful registry pages
seonghobae
committed
4561282

Commits on Aug 17, 2026

Commits on Aug 18, 2026

test(ci): surface disabled active-PR workflow drift
seonghobae
committed
43bd422
fix(ci): surface disabled active-PR workflow drift
seonghobae
committed
24922ed
docs(ci): record disabled active-PR workflow drift
seonghobae
committed
d4ae542
test(ci): reject null Git commit identities
seonghobae
committed
984bd50
fix(ci): reject null Git commit identities
seonghobae
committed
5080184
docs(changelog): record null Git object rejection
seonghobae
committed
0fa7815

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 23, 2026

Commits on Aug 24, 2026

test(ci): reject symlink workflow audit evidence
seonghobae
committed
8c3d6d2
fix(ci): reject indirect workflow audit evidence
seonghobae
committed
42b1edd
test(ci): reject workflow audit ancestor symlink swaps
seonghobae
committed
7726130
fix(ci): pin workflow audit path traversal to directory descriptors
seonghobae
committed
49244fb
test(ci): reject symlinked workflow audit output
seonghobae
committed
0b3d59e
fix(ci): bind workflow audit output path authority
seonghobae
committed
dc90cd4
test(ci): reject hard-linked workflow audit output
seonghobae
committed
e3fa663
fix(ci): reject linked workflow audit outputs
seonghobae
committed
296dfc3
test(ci): reproduce raced output hard-link alias
seonghobae
committed
e34accd
fix(ci): fail closed on preexisting audit output
seonghobae
committed
1756ce1

Commits on Aug 25, 2026

chore(ci): converge workflow audit with protected main
seonghobae
committed
688309e
docs(changelog): preserve workflow audit release notes
seonghobae
committed
f2dd4b2
test(ci): remove partial audit output after write failure
seonghobae
committed
320f1da
fix(ci): stage audit output before atomic publish
seonghobae
committed
ef7c702
test(ci): cover post-publish cleanup failures
seonghobae
committed
f5f0538
fix(ci): recover audit publish cleanup
seonghobae
committed
459c13e
fix(ci): bind output capability checks to stdlib primitives
seonghobae
committed
687086a
test(ci): cover existing-output fstat failure
seonghobae
committed
5c059a1
fix(ci): normalize existing-output stat failure
seonghobae
committed
581b551
test(ci): reproduce staging fstat cleanup leak
seonghobae
committed
cd764c1
fix(ci): clean staging after inspection failure
seonghobae
committed
cc98483
test(ci): reproduce cleanup error masking fd leak
seonghobae
committed
ddaa47c
fix(ci): preserve primary output failure during cleanup
seonghobae
committed
6dd2023

Commits on Aug 26, 2026

Commits on Aug 27, 2026

Commits on Aug 28, 2026

test(ci): reproduce persistent staging cleanup masking
seonghobae
committed
89d9c56
fix(ci): preserve causal staging cleanup failure
seonghobae
committed
fdb8869