fix(ci): materialize bounded SARIF PR provenance - #279

Draft

seonghobae wants to merge 194 commits into

fix/ci-node24-actions-v1from

fix/appguardrail-sarif-provenance-v1

Commits on Sep 11, 2026

test(ci): require bounded SARIF merge provenance
seonghobae
committed
4a3e858
ci(test): run SARIF provenance RED verifier
seonghobae
committed
ebedd2f
fix(ci): materialize bounded SARIF PR provenance
seonghobae
committed
e3fabc8
ci: retire SARIF provenance verifier
seonghobae
committed
fc0dea4
ci(test): verify SARIF provenance candidate
seonghobae
committed
8d5feb5
ci(test): expose canonical SARIF provenance formatting
seonghobae
committed
cb6f00f
fix(ci): keep AppGuardrail evidence env ordering unchanged
seonghobae
committed
65bb8c1
style(test): canonicalize SARIF provenance contract
seonghobae
committed
65aa16b
ci(test): verify exact SARIF provenance candidate
seonghobae
committed
7c08c7f
style(ci): preserve AppGuardrail newline boundary
seonghobae
committed
e4a7ddc
ci: retire SARIF provenance full verifier
seonghobae
committed
76e352e
test(commercial): bound unnamed workflow sibling steps
seonghobae
committed
169f18b
fix(commercial): bound workflow step extraction by indentation
seonghobae
committed
df0a74f
test(commercial): enforce SARIF provenance guard and order
seonghobae
committed
05179d5
test(commercial): use structural workflow step ordering
seonghobae
committed
4a0858a
test(commercial): reject duplicate workflow step authority
seonghobae
committed
fc50d20
ci: verify SARIF step-name uniqueness regression
seonghobae
committed
02dd001
test(commercial): require unique workflow step authority
seonghobae
committed
4f550ba
ci: retire SARIF step uniqueness verifier
seonghobae
committed
37412c6
test(ci): bind SARIF action authority to one reviewed step
seonghobae
committed
a8f61be

Commits on Sep 12, 2026

test(ci): reject unnamed duplicate SARIF action authority
seonghobae
committed
af22490
test(ci): ignore SARIF authority text inside run blocks
seonghobae
committed
2a938ab
test(ci): reproduce misplaced SARIF source binding
seonghobae
committed
d3e5ad2
ci(test): run focused SARIF source-binding verifier
seonghobae
committed
592ac36
test(ci): bind SARIF source identity to with inputs
seonghobae
committed
ad014b6
ci(test): verify Commercial Readiness suite after SARIF repair
seonghobae
committed
e68d9b1
ci(test): retire focused SARIF verifier
seonghobae
committed
6e25408
test(ci): reproduce duplicate SARIF source inputs
seonghobae
committed
a608174
ci(test): verify duplicate SARIF source-input regression
seonghobae
committed
acb1084
test(ci): reject duplicate SARIF source inputs
seonghobae
committed
63db720
ci(test): verify package after duplicate-input repair
seonghobae
committed
7fbb68f
ci(test): retire duplicate-input SARIF verifier
seonghobae
committed
ab72a88
test(ci): prove SARIF upload job-boundary ambiguity
seonghobae
committed
a78ffc5
fix(ci): bind SARIF source verification to scan job
seonghobae
committed
db80a94
test(ci): reject SARIF job authority outside jobs
seonghobae
committed
df6b038
fix(ci): bound SARIF job lookup to top-level jobs
seonghobae
committed
f8ab2bc
test(ci): reproduce SARIF provenance if-key false positive
seonghobae
committed
33d89f6
test(ci): bind SARIF provenance guard to direct if key
seonghobae
committed
3a39971
test(ci): reproduce provenance step-shape spoof
seonghobae
committed
1e84e85
test(ci): structurally bind provenance step authority
seonghobae
committed
8f9ccbc
test(ci): structurally bind provenance env authority
seonghobae
committed
779f265
test(ci): bind source checkout authority to owning job
seonghobae
committed
a6f7266
ci(test): verify source checkout authority contract
seonghobae
committed
1404ce6
test(ci): retire source checkout verifier
seonghobae
committed
9cf61e3
ci(test): verify checkout contract package quality
seonghobae
committed
75a44ff
ci(test): diagnose checkout contract formatting
seonghobae
committed
b166eb5
ci(test): expose checkout contract formatter diff
seonghobae
committed
aa0dc70
style(test): normalize checkout authority contract
seonghobae
committed
638f11b
ci(test): verify normalized checkout contract package
seonghobae
committed
6eae950
ci(test): remove shallow-parent-only verifier check
seonghobae
committed
c30c2f9
test(ci): retire commercial readiness checkout verifier
seonghobae
committed
045f9db
test(commercial): reject second source checkout
seonghobae
committed
6616122
fix(commercial): bind source checkout authority
seonghobae
committed
9caaf1b
ci: add read-only maintainer verifier
seonghobae
committed
3a83d1b
style(commercial): apply canonical verifier format
seonghobae
committed
0e579fb
ci: retire maintainer verifier
seonghobae
committed
8c4dc50
test(ci): reject case-variant self checkout authority
seonghobae
committed
22d0e21
test(ci): reject quoted checkout authority bypass
seonghobae
committed
5b5674e
test(ci): parse commented quoted checkout scalars
seonghobae
committed
b7ddafe
test(ci): isolate external source checkouts
seonghobae
committed
ea72605
ci: verify external checkout path contract
seonghobae
committed
9b80358
fix(ci): keep verifier checkout warning-free
seonghobae
committed
bab51bb
chore(ci): retire external checkout verifier
seonghobae
committed
de53b8a
ci: verify commercial readiness path contract
seonghobae
committed
31617bd
chore(ci): retire commercial readiness verifier
seonghobae
committed
4546c84
test(ci): add bounded external checkout verifier
seonghobae
committed
10dc22e
test(ci): reproduce external checkout source-subtree overwrite
seonghobae
committed
7f9d9b9
test(ci): bind external checkout to reviewed isolation path
seonghobae
committed
4a05f3a
test(ci): retire external checkout verifier
seonghobae
committed
cd50819
test(commercial): expose YAML alias checkout authority gap
seonghobae
committed
7647124
ci: verify source YAML alias regression
seonghobae
committed
1088438
fix(commercial): reject YAML alias source authority
seonghobae
committed
52cbaf6
test(commercial): expose noncanonical step sequence bypass
seonghobae
committed
7cf47da
fix(commercial): require canonical direct source steps
seonghobae
committed
0c83e6f
ci: retire YAML alias verifier
seonghobae
committed
2e890df
test(commercial): cover scalar YAML alias source authority
seonghobae
committed
db36ec4
ci(commercial): verify scalar YAML alias regression
seonghobae
committed
5ab4fd1
fix(commercial): reject structural scalar YAML aliases
seonghobae
committed
a3f39a6
test(commercial): exercise nested scalar YAML aliases
seonghobae
committed
30b9745
fix(commercial): inspect first-line scalar YAML authority
seonghobae
committed
348a049
ci(commercial): retire scalar YAML alias verifier
seonghobae
committed
d617e8a
test(ci): bound provenance condition to direct job entries
seonghobae
committed
6e8f80c
test(ci): bound provenance env to direct job entries
seonghobae
committed
b91bf3b
test(ci): close YAML structural authority gaps
seonghobae
committed
dac0537
test(ci): pin external checkout path failure modes
seonghobae
committed
9edf731
ci: verify PR279 review repairs
seonghobae
committed
1db2110
test(ci): isolate mapping-key alias regression
seonghobae
committed
7be7d9a
ci: use Node 24 setup action in PR279 verifier
seonghobae
committed
0f42fb2
ci: retire PR279 focused verifier
seonghobae
committed
6eb637a
test(commercial): reproduce quoted workflow-key escape
seonghobae
committed
f5dec48
test(commercial): reject quoted workflow authority keys
seonghobae
committed
6946fb5
test(commercial): reproduce explicit workflow-key escape
seonghobae
committed
a1283b3
test(commercial): reject explicit workflow authority keys
seonghobae
committed
f149bf7
test(commercial): reproduce case-variant checkout action bypass
seonghobae
committed
74921ab
ci(commercial): add bounded checkout identity verifier
seonghobae
committed
3dce644
fix(commercial): normalize checkout action repository identity
seonghobae
committed
4a9ef75
chore(ci): retire checkout identity verifier
seonghobae
committed
ac8a563
test(commercial): cover spaced YAML structural keys
seonghobae
committed
c0ab38a
ci(commercial): verify spaced YAML structural-key regression
seonghobae
committed
6b18188
fix(commercial): reject spaced YAML structural keys
seonghobae
committed
d412afb
ci(commercial): prove spaced YAML key runtime semantics
seonghobae
committed
e5a8e95
chore(ci): retire spaced-key runtime probe
seonghobae
committed
f2d5901
chore(ci): retire spaced-key contract verifier
seonghobae
committed
5d175a0
test(commercial): cover case-variant external checkout action
seonghobae
committed
3c66a03
test(ci): verify external checkout action identity
seonghobae
committed
ef0fabe
fix(commercial): normalize checkout action repository identity
seonghobae
committed
76492f1
chore(ci): retire external checkout identity verifier
seonghobae
committed
7e798cb
test(ci): verify explicit YAML tag semantics
seonghobae
committed
96718d6
test(ci): reproduce YAML tag authority bypass
seonghobae
committed
b20a5a8
test(ci): isolate YAML tag bypass RED
seonghobae
committed
5ec554c
test(ci): run YAML tag bypass RED
seonghobae
committed
20cb930
test(ci): correct YAML tag RED fixture
seonghobae
committed
ccc0321
fix(ci): reject YAML tag authority in source verification
seonghobae
committed
52eb469
test(ci): verify YAML tag authority repair
seonghobae
committed
c7053e3
chore(ci): retire YAML tag verifier
seonghobae
committed
882f344
test(ci): run broad item 32 verification
seonghobae
committed
324dc17
test(ci): repair broad verifier base materialization
seonghobae
committed
7290524
chore(ci): retire item 32 broad verifier
seonghobae
committed
e773887
test(ci): expose final-step boundary contamination
seonghobae
committed
19608e9
test(ci): host item 33 boundary RED
seonghobae
committed
3522695
fix(ci): bound final checkout step to steps section
seonghobae
committed
3d219a1
test(ci): broaden item 33 exact-head verification
seonghobae
committed
6d166bc
chore(ci): retire item 33 boundary verifier
seonghobae
committed
cc89f56
test(ci): bound source verification at sibling jobs
seonghobae
committed
7a45a5c
ci: verify item 34 source job boundary
seonghobae
committed
40f5b86
ci: retire item 34 verifier
seonghobae
committed
9524892
test(ci): reproduce SARIF sibling job authority leak
seonghobae
committed
be47608
fix(ci): bound SARIF authority to direct scan job
seonghobae
committed
a222182
test(ci): verify PR279 item35 exact contracts
seonghobae
committed
416b240
test(ci): retire PR279 item35 verifier
seonghobae
committed
72cb172
test(ci): add bounded verifier for PR 279 item 36
seonghobae
committed
56fbca1
test(ci): reproduce case-aliased SARIF action bypass
seonghobae
committed
0754494
fix(ci): bind SARIF action repository identity case-insensitively
seonghobae
committed
7260b61
chore(ci): remove completed PR 279 item 36 verifier
seonghobae
committed
91ef583
test(ci): reproduce SARIF upload action identity bypass
seonghobae
committed
4b6ed63
test(ci): verify SARIF upload action identity regression
seonghobae
committed
453b887
fix(ci): bind SARIF source evidence to upload action identity
seonghobae
committed
c750a0b
chore(ci): remove completed item 37 verifier
seonghobae
committed
3e4defa

Commits on Sep 13, 2026

test(ci): bound SARIF upload lookup to direct steps
seonghobae
committed
78b5fb3
ci: verify PR279 item38 exact head
seonghobae
committed
b9c62e2
ci: retire PR279 item38 verifier
seonghobae
committed
ed0eb47
test(ci): reproduce post-steps provenance guard authority leak
seonghobae
committed
9567333
ci: add purpose verifier for PR279 item39
seonghobae
committed
5ae28a1
test(ci): bound provenance guard to direct steps
seonghobae
committed
f57d5fb
ci: make PR279 item39 verifier shallow-checkout safe
seonghobae
committed
42c3321
ci: make PR279 item39 hygiene check history independent
seonghobae
committed
90998d0
ci: retire PR279 item39 verifier
seonghobae
committed
ba96e16
test(ci): reproduce post-steps provenance env authority leak
seonghobae
committed
f012c7e
ci: add purpose verifier for PR279 item40
seonghobae
committed
83982dc
test(ci): bound provenance env to direct steps
seonghobae
committed
80b3ea4
ci: retire PR279 item40 verifier
seonghobae
committed
c4049ee
test(ci): reproduce source verifier steps-boundary borrowing
seonghobae
committed
c9db578
fix(ci): bound source verifier to direct steps section
seonghobae
committed
26ed27a
test(ci): broaden item 41 verifier
seonghobae
committed
d3df282
test(ci): reproduce top-level job authority borrowing
seonghobae
committed
ca2616a
fix(ci): bound source verifier to top-level jobs mapping
seonghobae
committed
861e5cb
test(ci): broaden item 42 verifier
seonghobae
committed
21d5a9c
chore(ci): remove completed PR 279 verifier
seonghobae
committed
1dff787
test(ci): expose provenance run marker false acceptance
seonghobae
committed
7db2335
ci(test): verify PR 279 item 43 regression
seonghobae
committed
bf2adb3
fix(ci): bind provenance to exact direct run authority
seonghobae
committed
3d7b53c
ci(test): broaden PR 279 item 43 verification
seonghobae
committed
070f29b
chore(ci): remove completed PR 279 item 43 verifier
seonghobae
committed
45259ab
fix(ci): honor provenance run scalar separator blanks
seonghobae
committed
4ef8d98
ci(test): verify PR 279 item 43 repair
seonghobae
committed
682f092
ci(test): retire PR 279 item 43 verifier
seonghobae
committed
85e23cd
ci(test): verify item 43 with bounded hygiene history
seonghobae
committed
5ba263d
ci(test): retire item 43 bounded verifier
seonghobae
committed
305fb99
test(ci): reproduce provenance run step impersonation
seonghobae
committed
7e5d39f
ci: verify PR 279 item 44 regression
seonghobae
committed
22d728d
test(ci): bound provenance run step authority to scan steps
seonghobae
committed
92b553b
ci: broaden PR 279 item 44 verification
seonghobae
committed
cbf486d
ci: remove completed PR 279 item 44 verifier
seonghobae
committed
b1c6550
test(ci): prove SARIF upload provenance gate
seonghobae
committed
cd6c5c3
test(ci): run PR279 Item45 regression
seonghobae
committed
6afd315
fix(ci): fail closed before SARIF upload
seonghobae
committed
1f9f37b
test(ci): verify PR279 Item45 repair
seonghobae
committed
697f331
chore(ci): retire PR279 Item45 verifier
seonghobae
committed
04ac6be
merge: restack PR279 onto PR276 checkout contract
seonghobae
committed
03ec520
chore(stack): inherit checkout-step authority contract
seonghobae
committed
a087f11
chore(stack): merge latest Node24 contract parent
seonghobae
committed
8374939
chore(stack): inherit block-scalar checkout authority repair
seonghobae
committed
e2807eb
chore(stack): merge latest Node24 contract parent
seonghobae
committed
08a5e76
chore(stack): merge checkout authority hardening parent
seonghobae
committed
4389cb0
chore(stack): merge checkout step-boundary hardening parent
seonghobae
committed
5e602af
chore(stack): adopt checkout env authority hardening parent
seonghobae
committed
295548b
chore(stack): adopt action-pin case authority hardening
seonghobae
committed
e476193
chore(stack): adopt quoted checkout authority hardening
seonghobae
committed
9b765d1
chore(stack): adopt contract newline cleanup
seonghobae
committed
c537bfb
chore(stack): adopt AppGuardrail jobs-boundary contract
seonghobae
committed
2430aad
chore(stack): adopt direct-sequence checkout contract
seonghobae
committed
3c720ce
chore(stack): adopt multi-space checkout contract
seonghobae
committed
0de1bb0

Commits on Sep 14, 2026

chore(stack): adopt quoted uses-key contract
seonghobae
committed
be26085
chore(stack): adopt quoted uses authority docs
seonghobae
committed
27437b8