feat(sandbox): restack patch-validator image on current main - #407

Merged

seonghobae merged 188 commits into

mainfrom

feat/patch-validator-image-on-main

Aug 23, 2026

Commits on Aug 17, 2026

feat(sandbox): restack patch-validator image on protected main
seonghobae
committed
13ae4b5
feat(sandbox): expose image receipt verifier
seonghobae
committed
9e521fa
test(sandbox): measure patch-validator image production
seonghobae
committed
8d356de
feat(reviewer): expose image validation profile
seonghobae
committed
0132a7c
test(image): reproduce exact-toolchain and WORKDIR failures
seonghobae
committed
db19caf
fix(image): build dependencies with exact Node toolchain
seonghobae
committed
0be65c4
test(image): align contract with exact Node toolchain
seonghobae
committed
1a8f627
merge(main): refresh patch-validator image on live base
seonghobae
committed
7773eaa
fix(test): remove unused patch runtime import
seonghobae
committed
08ae8e3
fix(ci): pin patch-validator evidence upload to Node 24 action
seonghobae
committed
ca13042
test(ci): include patch-validator in upload-artifact inventory
seonghobae
committed
8793e9b
test(image): align static builder contract with retained npm tool
seonghobae
committed
dd301d0
docs(changelog): record current patch-validator image evidence
seonghobae
committed
4453f72
test(ci): align upload-artifact pin with workflow
seonghobae
committed
b656acb
test(image): require bundled Node license notice
seonghobae
committed
027bdc5
fix(image): retain Node runtime license notice
seonghobae
committed
3d2e2f8
test(image): require runtime license evidence
seonghobae
committed
9812503
fix(image): retain runtime license evidence
seonghobae
committed
08d2b2c
docs(image): record Node license retention
seonghobae
committed
d194a79
merge main into patch-validator image after #409
seonghobae
committed
bb79114
merge current main into patch-validator image after #411
seonghobae
committed
e4e3c12
test(ci): require bounded patch-validator head retries
seonghobae
committed
81898d3
fix(ci): bound transient patch-validator head retries
seonghobae
committed
6888682
test(ci): bound static validator build budget
seonghobae
committed
a24ac57
fix(ci): give static validator build bounded runway
seonghobae
committed
e4c6ce5
Merge protected main into patch-validator image branch
seonghobae
committed
f78e1d0
Merge protected main into patch-validator image branch
seonghobae
committed
8ad405d
Merge protected main into patch-validator image branch
seonghobae
committed
b4b2781
Merge protected main into patch-validator image branch
seonghobae
committed
73809f0
Merge protected main into patch-validator image branch
seonghobae
committed
6096b7a
test(image): reproduce npm install PATH failure
seonghobae
committed
cda4a56
fix(image): expose installed Node during npm install
seonghobae
committed
4e878ca
merge main into patch-validator image lane
seonghobae
committed
8858e8d
merge protected main security fix into patch-validator image lane
seonghobae
committed
cbccd9e

Commits on Aug 18, 2026

Commits on Aug 19, 2026

test(image): require Grype scan of generated binary SBOM
seonghobae
committed
d40bc87
test(image): restore current scanner contract after diagnostic RED
seonghobae
committed
a2faf0f
fix(image): scan the generated static-runtime SBOM
seonghobae
committed
65a1360
test(image): lock Grype to generated binary SBOM
seonghobae
committed
8f8237c
test(image): retain Grype failure diagnostics
seonghobae
committed
b1fdbdd
fix(image): retain bounded Grype diagnostics
seonghobae
committed
8f103da
Merge protected main into patch-validator image lane
seonghobae
committed
c2a130a
Merge protected main into patch-validator image lane
seonghobae
committed
c345668
test(image): require valid isolated Grype config
seonghobae
committed
db8a82b
fix(image): use valid isolated Grype config
seonghobae
committed
3a16197
Merge protected main into patch-validator image lane
seonghobae
committed
2726c78
test(image): align embedded Grype config contract
seonghobae
committed
1ac98c4
test(image): require complete embedded identity diagnostics
seonghobae
committed
03818ac
test(image): drop non-causal identity aggregation probe
seonghobae
committed
df42a48
test(image): bind Ada scanner identity
seonghobae
committed
fcd08d9
fix(image): scan bundled Ada dependency
seonghobae
committed
0f9da62
test(image): require reviewed c-ares runtime identity
seonghobae
committed
4dda175
test(image): require reviewed c-ares and Brotli identities
seonghobae
committed
b5e218b
test(image): require reviewed native identity catalog parity
seonghobae
committed
32ddb3e
test(image): make native identity parity regression executable
seonghobae
committed
55091fa
feat(image): centralize reviewed embedded runtime identities
seonghobae
committed
bd810ec
feat(image): generate embedded runtime inventory from reviewed catalog
seonghobae
committed
3ce7d8a
test(image): cover reviewed inventory and disabled QUIC metadata
seonghobae
committed
f01d92e
fix(image): generate runtime inventory from reviewed catalog
seonghobae
committed
c5b42d9
test(image): bind workflow to canonical embedded catalog
seonghobae
committed
09f957c
fix(image): verify embedded runtime with shared reviewed catalog
seonghobae
committed
db518b6
test(image): verify shared runtime identity catalog end to end
seonghobae
committed
e9f165e
test(image): bind GitHub PURLs to exact upstream tags
seonghobae
committed
6dd09b1
fix(image): bind GitHub identities to exact release tags
seonghobae
committed
9c1dc8a
merge main into feat/patch-validator-image-on-main
seonghobae
committed
1e318ed
merge main into feat/patch-validator-image-on-main
seonghobae
committed
10d721b
test(image): require reviewed nbytes identity
seonghobae
committed
515f130
fix(image): review nbytes runtime identity
seonghobae
committed
fa8fe6b
test(sandbox): classify ncrypto as Node-internal metadata
seonghobae
committed
948c23d
fix(sandbox): classify ncrypto as Node-internal metadata
seonghobae
committed
2049a07
merge(main): converge patch-validator image after #433
seonghobae
committed
72dc043
test(sandbox): require reviewed simdjson identity
seonghobae
committed
245c6dd
fix(sandbox): add reviewed simdjson identity
seonghobae
committed
070dd57
test(sandbox): require reviewed uvwasi identity
seonghobae
committed
daaa184
fix(sandbox): add reviewed uvwasi identity
seonghobae
committed
d26684e
test(sandbox): require reviewed simdutf identity
seonghobae
committed
e230c0d
fix(sandbox): add reviewed simdutf identity
seonghobae
committed
b6a10dc
test(sandbox): require reviewed V8 CPE normalization
seonghobae
committed
afc1a73
fix(sandbox): bind patched V8 to upstream CPE
seonghobae
committed
b3c978f
test(sandbox): require reviewed zlib fork identity
seonghobae
committed
b830aaf
fix(sandbox): add reviewed zlib fork identity
seonghobae
committed
2a2f8af
test(supply-chain): bind embedded inventory to exact image digest
seonghobae
committed
558dd6b
fix(supply-chain): validate embedded inventory image digest
seonghobae
committed
05e258e

Commits on Aug 20, 2026

Commits on Aug 21, 2026

test(image): require QUIC applicability evidence
seonghobae
committed
a823f20
fix(image): retain Node QUIC build evidence
seonghobae
committed
03a6d9e
test(image): bind QUIC applicability to runtime metadata
seonghobae
committed
a812892
refactor(image): use existing QUIC runtime evidence
seonghobae
committed
060f4ca
test(image): require reviewed QUIC applicability layer
seonghobae
committed
923a206
fix(image): review QUIC-only OpenSSL applicability
seonghobae
committed
c4ddfd2
fix(image): apply reviewed runtime applicability
seonghobae
committed
07a273e
merge main into patch-validator image
seonghobae
committed
9436248
test(image): require reviewed embedded CVE applicability
seonghobae
committed
683cce0
fix(image): apply exact reviewed embedded CVE scope
seonghobae
committed
484dd15
test(image): match retained V8 scanner evidence
seonghobae
committed
213b414
fix(image): bind V8 applicability to scanner CPE version
seonghobae
committed
e36ccde
merge main into feat/patch-validator-image-on-main
seonghobae
committed
806964c
merge protected main into feat/patch-validator-image-on-main
seonghobae
committed
19536c1

Commits on Aug 22, 2026

Commits on Aug 23, 2026