fix(github): canonicalize accepted API base URLs - #430

Merged

seonghobae merged 113 commits into

mainfrom

fix/github-api-base-normalization

Aug 22, 2026

Commits on Aug 19, 2026

test(github): reproduce trailing-slash API base failure
seonghobae
committed
07c3900
fix(github): canonicalize accepted API root URLs
seonghobae
committed
0a5a659
test(github): cover every accepted API root spelling
seonghobae
committed
652c660
test(github): reproduce malformed success JSON classification
seonghobae
committed
e774d18
fix(github): classify malformed success JSON upstream
seonghobae
committed
2344eaf
test(github): reproduce invalid success JSON shapes
seonghobae
committed
51913c1
fix(github): reject non-object success JSON
seonghobae
committed
90153e8
test(github): reject malformed installation fields
seonghobae
committed
390421f
fix(github): validate installation response fields
seonghobae
committed
261a22f
merge main into fix/github-api-base-normalization
seonghobae
committed
b1665d8
test(egress): fail closed on response stream errors
seonghobae
committed
ae43758
fix(egress): classify response stream failures
seonghobae
committed
f096ebc
test(egress): reject without awaiting cleanup
seonghobae
committed
6ecc8f3
fix(egress): never await rejected-body cleanup
seonghobae
committed
be991e1
merge(main): converge GitHub API hardening on current protected base
seonghobae
committed
35b9bd7
merge(main): converge GitHub API hardening after #433
seonghobae
committed
c05305b
test(github): reject expired installation credentials
seonghobae
committed
8ecccae
fix(github): reject expired installation credentials
seonghobae
committed
05ea61c
test(github): reject implausibly long-lived installation tokens
seonghobae
committed
8da1e50
fix(github): bound installation token lifetime
seonghobae
committed
dd0794c
test(github): keep successful token fixtures within lifetime
seonghobae
committed
e6544ae
test(github): use bounded success token expiry
seonghobae
committed
13d9e76
test(github): bound replay success token lifetime
seonghobae
committed
d7fa067

Commits on Aug 20, 2026

fix(ci): restore canonical source newline
seonghobae
committed
69b9a7f
test(github): keep exchange success expiry current
seonghobae
committed
4b2ef4b
test(github): reject invalid configured installation ids
seonghobae
committed
23cc641
fix(github): validate configured installation id
seonghobae
committed
5450804
test(github): align configured installation-id contract
seonghobae
committed
f751f7c
test(readiness): reject unsafe GitHub numeric identifiers
seonghobae
committed
1d6cf24
fix(readiness): bound GitHub numeric identifiers
seonghobae
committed
e7b5c87
test(github): reject invalid App ids before egress
seonghobae
committed
f0425ce
test(github): bind App id rejection to public edge
seonghobae
committed
760b61c
fix(github): reject invalid App ids at public edge
seonghobae
committed
a09a21e
merge main into fix/github-api-base-normalization after #435
seonghobae
committed
2b36571
test(exchange): reject oversized body without awaiting cleanup
seonghobae
committed
589c977
fix(exchange): never await rejected-body cleanup
seonghobae
committed
04d8c92
test(exchange): require early rejection body cleanup
seonghobae
committed
07c3bdb
fix(exchange): release rejected request bodies
seonghobae
committed
6a26142
test(egress): classify credential transport failures
seonghobae
committed
c918efd
fix(egress): fail closed on transport rejection
seonghobae
committed
339d752
fix(egress): scope transport failure to credentials
seonghobae
committed
2fd2395
test(readiness): require immutable workflow source coherence
seonghobae
committed
f13e73d
fix(readiness): bind immutable workflow ref to source sha
seonghobae
committed
934fe0a
test(github): reject invalid installation id at request edge
seonghobae
committed
eee3a9d
fix(github): reject invalid installation id at request edge
seonghobae
committed
c5d9b76
test(github): bound installation id in credential egress path
seonghobae
committed
257063a
fix(github): bound installation id in credential egress path
seonghobae
committed
9e6f766
test(egress): clean up blocked redirect bodies
seonghobae
committed
9e5925b
fix(egress): clean up blocked redirect bodies
seonghobae
committed
cabdf67
test(github): clean up outbound read failures
seonghobae
committed
92a954c
fix(github): clean up outbound read failures
seonghobae
committed
8e95bad
test(github): clean up exchange read failures
seonghobae
committed
5ef4b55
fix(github): clean up exchange read failures
seonghobae
committed
7484ffd
Merge protected main into GitHub hardening
seonghobae
committed
a454c83

Commits on Aug 21, 2026

test(oidc): reject non-numeric not-before claims
seonghobae
committed
3a5464e
fix(oidc): reject non-numeric not-before claims
seonghobae
committed
2c8573e
test(github): reject impossible token expiry
seonghobae
committed
a8fb0ee
fix(github): validate token expiry calendar
seonghobae
committed
77c97b4
test(oidc): reject non-finite NumericDate claims
seonghobae
committed
fbff0af
fix(oidc): require finite NumericDate claims
seonghobae
committed
9a90617
test(oidc): reject invalid issued-at claims
seonghobae
committed
075f0b6
fix(oidc): validate issued-at claims
seonghobae
committed
b90e12e
test(oidc): bind repository owner immutable id
seonghobae
committed
de1388e
fix(oidc): reject mismatched repository owner identity
seonghobae
committed
b7e8235
test(oidc): bind repository immutable identity
seonghobae
committed
9988d75
fix(oidc): bind repository immutable identity
seonghobae
committed
b61113c
test(oidc): preserve central workflow repository identity
seonghobae
committed
77895d0
fix(oidc): scope immutable repository id to Noema claim
seonghobae
committed
ea81c9e
test(oidc): bind central workflow repository identity
seonghobae
committed
cdbdc5f
fix(oidc): bind trusted repository identity pairs
seonghobae
committed
dd619bb
merge main into GitHub App hardening
seonghobae
committed
e67ae24
merge main into fix/github-api-base-normalization
seonghobae
committed
fe6522f
merge protected main into fix/github-api-base-normalization
seonghobae
committed
c83dc18
merge(main): converge GitHub credential boundary on current protected main
seonghobae
committed
ecd59c1
merge(main): converge GitHub credential hardening on protected main
seonghobae
committed
04e1ceb
merge(main): converge GitHub credential hardening on protected release evidence
seonghobae
committed
fcd30ea
test(oidc): require current central workflow source
seonghobae
committed
ce5d327
fix(oidc): trust current central workflow source
seonghobae
committed
58a4b13
test(oidc): reject bearer credential whitespace at edge
seonghobae
committed
03a6cec
fix(oidc): reject malformed bearer whitespace at edge
seonghobae
committed
2a65dc9
style(core): restore canonical newline
seonghobae
committed
5382b9e
test(oidc): require current central workflow source
seonghobae
committed
2274772
fix(oidc): roll forward trusted workflow source
seonghobae
committed
bf3e60f
test(oidc): require current central workflow source SHA
seonghobae
committed
b11b2c5
fix(oidc): roll forward central workflow source SHA
seonghobae
committed
23b4dc4
test(ci): require observable release verifier boundaries
seonghobae
committed
74341bb
fix(ci): expose release verifier failure boundaries
seonghobae
committed
e9e1116
test(ci): align reproducibility contract with observable release gates
seonghobae
committed
4b5ec4e
test(oidc): require latest central workflow source SHA
seonghobae
committed
add4243
fix(oidc): follow latest central workflow source SHA
seonghobae
committed
0f10cac
test(ci): require bounded release-test diagnostics
seonghobae
committed
5ff6612
fix(ci): bound release-test diagnostic output
seonghobae
committed
7affdc5
fix(ci): restore canonical source newline
seonghobae
committed
ca9a587
fix(ci): preserve source formatting while restoring newline
seonghobae
committed
697728c

Commits on Aug 22, 2026

test(oidc): require current central workflow source
seonghobae
committed
be569dd
fix(oidc): roll forward central workflow source
seonghobae
committed
eff0b3a
test(ci): require bounded failure diagnostics
seonghobae
committed
3c9ede7
fix(ci): bound release-test failure diagnostics
seonghobae
committed
4f957d2
test(oidc): align Bearer whitespace with bounded envelope
seonghobae
committed
054e671
test(readiness): keep immutable workflow ref and SHA coherent
seonghobae
committed
bbf8fcf
test(github): satisfy earlier App-id trust gate in egress fixtures
seonghobae
committed
8e4ebc3
test(exchange): satisfy App-id preflight in egress-boundary fixture
seonghobae
committed
9081b5e
test(exchange): cover synchronous cleanup failure
seonghobae
committed
233aa7a
test(github): cover expiry defensive branches
seonghobae
committed
a23b085
test(exchange): cover bodyless early rejection cleanup
seonghobae
committed
1552405
test(github): cover noncanonical token expiry format
seonghobae
committed
00ad0aa
test(exchange): align bodyless request coverage
seonghobae
committed
9a51491
test(oidc): require current central workflow source
seonghobae
committed
9bddecc
fix(oidc): trust current central workflow source
seonghobae
committed
fecd911
test(exchange): cover disappearing body cleanup race
seonghobae
committed
4df846e
test(exchange): cover rejected cleanup promise
seonghobae
committed
2cebfe2
test(oidc): require current central workflow source
seonghobae
committed
2a8e3ce
fix(oidc): roll forward central workflow source
seonghobae
committed
31062bb