fix(egress): bound anonymous GitHub API authority - #500

Merged

seonghobae merged 563 commits into

mainfrom

fix/oidc-workflow-sha-canonical-config

Aug 30, 2026

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 27, 2026

test(trace): reject normalized non-ASCII trace authority
seonghobae
committed
e06ce74
test(trace): enforce public canonical trace authority
seonghobae
committed
89fce32
fix(trace): preserve exact header authority
seonghobae
committed
c86e45b
fix(trace): preserve exact public header authority
seonghobae
committed
52d9bc2
test(oidc): reject non-object JWT JSON envelopes
seonghobae
committed
877f592
fix(oidc): require object JWT JSON envelopes
seonghobae
committed
d5ef532
test(oidc): align non-object rejection contract
seonghobae
committed
717d6bd
fix(oidc): remove unreachable non-object claim branch
seonghobae
committed
2e1cd10
test(worker): reject normalized trace authority
seonghobae
committed
22ff97b
fix(worker): preserve canonical trace authority
seonghobae
committed
16ba120
test(oidc): require central workflow repository authority
seonghobae
committed
58caf63
test(oidc): bind regression to protected worker boundary
seonghobae
committed
15d495f
fix(oidc): require central workflow repository authority
seonghobae
committed
01d7c3e
fix(readiness): bind workflow authority to central repository
seonghobae
committed
b42691e
test(oidc): model configured distributed limit in trust regression
seonghobae
committed
517b9e6
test(oidc): cover central repository owner mismatch
seonghobae
committed
3529a4e
test(github): bound installation token authority
seonghobae
committed
b8c3e84
fix(github): bound installation token authority
seonghobae
committed
e7486e4
test(observability): require collision-resistant OIDC subject receipt
seonghobae
committed
05fcbb2
fix(observability): strengthen OIDC subject evidence identity
seonghobae
committed
2d08525
test(exchange): reject unreviewed request authority
seonghobae
committed
ae6bd2a
fix(exchange): reject unreviewed request authority
seonghobae
committed
ea50fb1
docs(api): close exchange request schema
seonghobae
committed
2afc8f4
test(exchange): converge exact-schema regressions
seonghobae
committed
9329b00
test(readiness): preserve canonical trace correlation
seonghobae
committed
498955e
fix(readiness): preserve canonical trace correlation
seonghobae
committed
d58b6aa

Commits on Aug 28, 2026

test(oidc): reject ambiguous JWKS key identifiers
seonghobae
committed
0530be8
fix(oidc): reject ambiguous JWKS key identifiers
seonghobae
committed
44702a3
test(oidc): reject unsupported critical JOSE headers
seonghobae
committed
0dd4653
test(oidc): bind critical JOSE rejection to bearer boundary
seonghobae
committed
71cb7f3
fix(oidc): reject unsupported critical JOSE headers
seonghobae
committed
bc6f4d6
test(oidc): reject unsupported b64 signing semantics
seonghobae
committed
ff803d5
fix(oidc): reject unsupported b64 signing semantics
seonghobae
committed
489ba34
test(rate-limit): reject normalized IPv6 client aliases
seonghobae
committed
20edfc0
fix(rate-limit): reject non-canonical IPv6 client aliases
seonghobae
committed
0b8ccec
fix(rate-limit): preserve semantic IPv6 bucket identity
seonghobae
committed
ec5ff0c
test(oidc): reject mismatched metadata media types
seonghobae
committed
6f952dd
fix(oidc): bind metadata responses to JSON media type
seonghobae
committed
e2746c3
test(oidc): cover missing JWKS media type
seonghobae
committed
4115783
test(oidc): cover absent metadata content types
seonghobae
committed
6bdc55f
test(github-api): reject unreviewed JSON media type
seonghobae
committed
8788bd7
fix(github-api): bind JSON responses to reviewed media type
seonghobae
committed
8bf2ec8
chore(source): restore final newline after GitHub API repair
seonghobae
committed
f780dc0
test(github-api): cover missing JSON media type
seonghobae
committed
26d2066
test(github-api): reject BOM-normalized credential JSON
seonghobae
committed
25070d4
test(oidc): reject BOM-normalized discovery JSON
seonghobae
committed
27e8930
fix(json): reject normalized external authority bytes
seonghobae
committed
e2fc03d
test(github-api): reject duplicate credential keys
seonghobae
committed
aa8584f
fix(json): reject duplicate external authority keys
seonghobae
committed
3a5c314
test(oidc): reject duplicate nested JWK authority keys
seonghobae
committed
9303644
fix(json): reject nested duplicate authority keys
seonghobae
committed
c305e4c
test(json): cover whitespace before authority separators
seonghobae
committed
07c1994
test(json): bound streamed external authority responses
seonghobae
committed
c7d2e63
fix(json): bound external authority response bodies
seonghobae
committed
39af6c4
test(json): cover empty external authority body
seonghobae
committed
3488d91
test(oidc): require current central workflow source
seonghobae
committed
bd19ad0
fix(oidc): roll trusted workflow source forward
seonghobae
committed
02ff991
docs(architecture): bind current central workflow trust
seonghobae
committed
9f73921
test(oidc): reject non-string JOSE key ids
seonghobae
committed
9b175ee
fix(oidc): reject non-string JOSE key ids
seonghobae
committed
c7b581c
test(oidc): reject stale issued-at authority
seonghobae
committed
3f053f5
fix(oidc): bound issued-at token lifetime
seonghobae
committed
d6f572f
test(oidc): require current audited central trust source
seonghobae
committed
0479133
fix(oidc): roll trusted central workflow source forward
seonghobae
committed
f4f7f52
docs(architecture): bind current audited workflow source
seonghobae
committed
ce26183
test(oidc): bound JOSE key-id discovery authority
seonghobae
committed
dd95e3b
fix(oidc): bound JOSE key-id discovery selector
seonghobae
committed
067609a
test(ci): require reusable patch-validator build cache
seonghobae
committed
c035471
fix(ci): cache exact-head patch-validator builds
seonghobae
committed
fdf4bd4
test(readiness): fail closed without credential fetch capability
seonghobae
committed
b20ca3d
fix(readiness): require credential fetch capability
seonghobae
committed
cdc9d83
test(readiness): reject non-installable fetch capability
seonghobae
committed
8b6f932
fix(readiness): require replaceable credential fetch capability
seonghobae
committed
740e126
test(exchange): reject overlong GitHub repository authority
seonghobae
committed
f28d02c
fix(exchange): bound GitHub repository name authority
seonghobae
committed
0cde5cb
test(openapi): bound repository locator name segment
seonghobae
committed
a20ded2
fix(openapi): bound repository locator name segment
seonghobae
committed
39e4ded
docs(api): document repository-name authority bound
seonghobae
committed
0da20e3
docs(security): align repository-name validation contract
seonghobae
committed
ed63294
test(egress): reject overlong repository token scope
seonghobae
committed
481889f
fix(egress): bound repository token scope
seonghobae
committed
3a905c8
test(openapi): bind pre-limiter 405 headers
seonghobae
committed
3feafcf
fix(openapi): align pre-limiter 405 headers
seonghobae
committed
eaa4b82
test(openapi): align distributed header authority
seonghobae
committed
a5b173a
test(oidc): require current central workflow source
seonghobae
committed
0a37077
fix(oidc): trust current central workflow source
seonghobae
committed
9233f62
docs(architecture): record current central trust rollforward
seonghobae
committed
62b1527
test(oidc): roll trusted central workflow source
seonghobae
committed
7cbfcaa
fix(oidc): trust current protected central source
seonghobae
committed
1bed960
docs(architecture): record current central workflow trust
seonghobae
committed
fba53f1
test(oidc): require authoritative metadata status
seonghobae
committed
6e3fddf
fix(oidc): require authoritative metadata status
seonghobae
committed
f9771f6
test(github): require endpoint-specific success status authority
seonghobae
committed
806d13b
fix(github): bind JSON success to endpoint status
seonghobae
committed
3734c00
test(github): align app token fixtures with HTTP 201
seonghobae
committed
c199798
test(github): use HTTP 201 token-mint fixtures
seonghobae
committed
c00ee25
test(github): model token creation as HTTP 201
seonghobae
committed
5a534ae
test(github): model successful token creation status
seonghobae
committed
3e49c9c
test(github): preserve token expiry semantics under HTTP 201
seonghobae
committed
cde6492
test(github): model expiry fixture as HTTP 201
seonghobae
committed
2b1377f
test(github): preserve token response semantics under HTTP 201
seonghobae
committed
ef25107
test(github): model worker token responses as HTTP 201
seonghobae
committed
ea58ea1
test(oidc): reject contradictory JWKS key operations
seonghobae
committed
6edea7a
fix(oidc): enforce JWKS verification key operations
seonghobae
committed
de5b2cf
test(egress): reject unused app installation listing authority
seonghobae
committed
f899ad9
fix(egress): remove unused app installation listing authority
seonghobae
committed
978c54b
test(egress): keep redirect coverage on used installation lookup
seonghobae
committed
f5a2875
test(egress): bind authorization framing to used lookup
seonghobae
committed
7cb8ca8

Commits on Aug 29, 2026

test(rate-limit): bound local client bucket cardinality
seonghobae
committed
e9193ed
fix(rate-limit): bound local client bucket retention
seonghobae
committed
eb8c721
fix(rate-limit): restore canonical source newline
seonghobae
committed
0c65c58
test(rate-limit): cover expired bucket cleanup at capacity
seonghobae
committed
bfb6f88
fix(rate-limit): remove unreachable capacity branch
seonghobae
committed
33b6c1d
test(rate-limit): preserve renewed bucket eviction recency
seonghobae
committed
42fcb19
fix(rate-limit): refresh renewed bucket eviction recency
seonghobae
committed
e2095a8
test(ci): preserve in-flight validator cache seed
seonghobae
committed
9a62f08
fix(ci): let validator builds seed shared cache
seonghobae
committed
e111bf3
test(exchange): reject misleading JSON media types in base worker
seonghobae
committed
b8a9254
fix(exchange): enforce reviewed JSON media type in base worker
seonghobae
committed
66982b4
test(exchange): align helper coverage with reviewed media type
seonghobae
committed
3a22b65
test(exchange): cover missing media type with request body
seonghobae
committed
07e0971
test(exchange): exercise truly missing media type
seonghobae
committed
91e7295
test(exchange): accept GitHub App PKCS#1 private key
seonghobae
committed
895cd67
fix(exchange): normalize GitHub App PKCS#1 private keys
seonghobae
committed
51df024
fix(runtime): accept GitHub App PKCS#1 private keys
seonghobae
committed
dba837b
test(runtime): verify GitHub App PKCS#1 readiness
seonghobae
committed
53206e0
fix(runtime): remove unreachable private-key branches
seonghobae
committed
89580bb
test(runtime): cover private-key envelope rejection paths
seonghobae
committed
48d0f40
test(runtime): accept canonical PKCS8 terminal newline
seonghobae
committed
c12dc70
fix(runtime): canonicalize PKCS8 terminal newline
seonghobae
committed
de79d57
test(runtime): preserve private-key readiness cache after normalization
seonghobae
committed
9900a6c
fix(runtime): preserve readiness cache across key normalization
seonghobae
committed
5abf296
fix(runtime): type normalized credential cache source safely
seonghobae
committed
106dcb9
test(runtime): reject stale cached binding authority
seonghobae
committed
5aba3b5
fix(runtime): drop withdrawn cached bindings
seonghobae
committed
14dcc58
test(oidc): reject encryption-use JWKS keys
seonghobae
committed
6324905
test(trust): require current central workflow source
seonghobae
committed
8045096
fix(oidc): honor JWKS signing-use authority
seonghobae
committed
efad421
fix(trust): roll forward audited central source
seonghobae
committed
311c76e
docs(architecture): record audited central trust roll-forward
seonghobae
committed
a878de0
test(trust): require latest central workflow source
seonghobae
committed
eb28212
fix(trust): follow current protected central source
seonghobae
committed
d307e4a
docs(architecture): track latest central trust authority
seonghobae
committed
6fe3e76
test(egress): reject unreviewed anonymous GitHub API calls
seonghobae
committed
0d4dc6f
test(egress): preserve exact public metadata diagnostic
seonghobae
committed
5e4c0f8
chore(test): drop superseded egress experiment
seonghobae
committed
237334a
test(private-key): reject bare-CR PEM termination
seonghobae
committed
4e8b6f3
fix(private-key): reject bare-CR PEM termination
seonghobae
committed
3d740e6
test(exchange): reject unreviewed query authority
seonghobae
committed
ddc1df8
fix(exchange): reject unreviewed query authority
seonghobae
committed
e504385
test(exchange): reject bare query delimiter authority
seonghobae
committed
8a30904
fix(exchange): require exact resource-form URL
seonghobae
committed
5bc743a
fix(exchange): preserve stable validation message
seonghobae
committed
609af78
test(github-app): refresh stale installation cache
seonghobae
committed
2a6a922
fix(github-app): refresh retired cached installation ids
seonghobae
committed
b39b4f1
test(github-app): retry installation refresh only from cache
seonghobae
committed
d3ea853
fix(github-app): refresh only cached installation authority
seonghobae
committed
484f39c
ci: retrigger exact-head patch validator
seonghobae
committed
bfae9ee
test(egress): restrict anonymous GitHub API authority
seonghobae
committed
3d2c4d3
fix(egress): bound anonymous GitHub API authority
seonghobae
committed
f2e0802
merge(main): adopt protected #505 integration for egress repair
seonghobae
committed
9cce753
merge(main): retain licensing integration with egress repair
seonghobae
committed
05e4a66
test(egress): align legacy cases with reviewed operations
seonghobae
committed
cba0900
test(egress): reject unreviewed outbound header authority
seonghobae
committed
dc6c302
fix(egress): bound outbound header authority
seonghobae
committed
b2367eb
test(egress): align retired listing destination verdict
seonghobae
committed
bbb4e98
test(egress): use reviewed GitHub media type
seonghobae
committed
6ee5540
test(egress): match production token-mint headers
seonghobae
committed
77c6b39
test(egress): require exact token-mint JSON media type
seonghobae
committed
75e6e1e
fix(egress): bind token mint to JSON media type
seonghobae
committed
fa11c84
fix(egress): canonicalize token mint media type
seonghobae
committed
a3046ad
test(egress): bind scope cases to JSON media type
seonghobae
committed
ac96ea4
test(egress): bind token operation to JSON media type
seonghobae
committed
8d5f0c0
test(egress): prove canonical token media type on wire
seonghobae
committed
b802dc5
test(egress): close token media-type branch coverage
seonghobae
committed
d94a069
test(egress): cover noncanonical reviewed header value
seonghobae
committed
a4a318b
test(egress): cover rejected-header short circuit
seonghobae
committed
b4812ae
test(egress): prove reviewed production header contract
seonghobae
committed
f4527e9
test(github-app): bind configured installation to repository
seonghobae
committed
cf3a756
fix(github-app): verify configured installation ownership
seonghobae
committed
e87212d
test(github-app): reflect repository-bound configured installs
seonghobae
committed
71859c3
test(egress): require canonical Bearer framing
seonghobae
committed
355ca3d
fix(egress): enforce canonical Bearer scheme
seonghobae
committed
cb7cf4d
test(egress): reject non-canonical HTTP method casing
seonghobae
committed
69cde35
fix(egress): preserve canonical HTTP method bytes
seonghobae
committed
172cc90
test(egress): fail closed on malformed request headers
seonghobae
committed
39d9b63
fix(egress): fail closed on malformed headers
seonghobae
committed
0239b29
test(egress): require explicit installation token media authority
seonghobae
committed
ab15f39
test(egress): preserve canonical media-type synthesis contract
seonghobae
committed
b5eb23f
test(egress): fail closed on malformed cancellation authority
seonghobae
committed
07c9b13
fix(egress): fail closed on invalid cancellation signals
seonghobae
committed
5a550d5
test(egress): classify streamed deadline expiry as timeout
seonghobae
committed
e135ad9
fix(egress): preserve streamed timeout authority
seonghobae
committed
c19549b
test(egress): reject pre-aborted caller authority before transport
seonghobae
committed
2c065df
fix(egress): honor pre-aborted caller signal before transport
seonghobae
committed
7615cfc
test(ci): require stale image runs to cancel
seonghobae
committed
6e71cbf
fix(ci): cancel superseded image verification runs
seonghobae
committed
8819ec6
test(ci): require resilient image scanner downloads
seonghobae
committed
0c3f1f3
fix(ci): retry transient scanner release downloads
seonghobae
committed
bd6e936
test(egress): preserve mid-flight caller cancellation
seonghobae
committed
1208839
fix(egress): honor mid-flight caller cancellation
seonghobae
committed
804f6ed
test(egress): cover bodyless late cancellation
seonghobae
committed
ffa11e6
test(egress): preserve cancellation during body streaming
seonghobae
committed
2828948
fix(egress): honor cancellation during body streaming
seonghobae
committed
439fa8f
test(egress): preserve cancellation over late transport rejection
seonghobae
committed
873496d
fix(egress): preserve caller abort reason on late rejection
seonghobae
committed
3677562
test(egress): reject normalized reviewed header authority
seonghobae
committed
2eb620d
fix(egress): preserve raw reviewed header authority
seonghobae
committed
36bfd2c
test(egress): require timeout despite abort-ignoring body
seonghobae
committed
0212ef8
fix(egress): enforce abort-aware response reads
seonghobae
committed
00c6161
fix(egress): type abort listener for exact deadline
seonghobae
committed
271d47b
test(egress): exercise active abort race
seonghobae
committed
6faee9f
test(egress): cover post-read cancellation race
seonghobae
committed
5f6ea1a
fix(egress): remove synthetic abort no-op
seonghobae
committed
dc3fb50
test(ci): require license evidence before manifest
seonghobae
committed
2d79b35
fix(ci): materialize license evidence before manifest
seonghobae
committed
44107bd
test(egress): require abort-bounded transport headers
seonghobae
committed
3b4abd3
test(egress): cover late transport cleanup branches
seonghobae
committed
0f75d39
fix(egress): bound transport wait to abort authority
seonghobae
committed
7726c93
test(egress): cover synchronous abort transport cleanup
seonghobae
committed
1be5bd4
fix(egress): clean late transport on synchronous abort
seonghobae
committed
1cb9a10
test(egress): await caller cancellation deterministically
seonghobae
committed
32046d1
test(egress): cover response-settle cancellation race
seonghobae
committed
acf9659
test(egress): deterministically cover post-transport revocation
seonghobae
committed
84bc542
test(ci): require branch coverage failure diagnostics
seonghobae
committed
a76c1d4
fix(ci): report uncovered branches on coverage failure
seonghobae
committed
f307d13
test(acquisition): align CLI audit timeout hierarchy
seonghobae
committed
9a5d86a
test(egress): cover native transport-settlement revocation race
seonghobae
committed
d47073d
test(egress): cover revoked bodyless transport response
seonghobae
committed
6c8d90b
test(ci): require concrete branch diagnostic locations
seonghobae
committed
e230074
fix(ci): emit concrete branch coverage locations
seonghobae
committed
df110e8

Commits on Aug 30, 2026

test(image): require patched OpenSSL security floor
seonghobae
committed
ed707c7
fix(image): link static Node against OpenSSL 3.5.8
seonghobae
committed
41191c1
test(image): anchor Node PATH regression to Node build
seonghobae
committed
784d37e
test(image): require pre-materialized validator dependencies
seonghobae
committed
d4a895e
fix(image): pre-materialize validator dependencies
seonghobae
committed
417eabc
fix(image): use local validator dependency context
seonghobae
committed
83d21b8
test(image): align contract with bounded dependency context
seonghobae
committed
db11e1c
docs(governance): align security scan authority
seonghobae
committed
cc20967
test(governance): align central security-scan trigger contract
seonghobae
committed
bee00f8
test(image): require runner-pinned runtime sources
seonghobae
committed
59f0728
test(image): require bounded runtime source fetches
seonghobae
committed
25adc41
fix(image): bound checksum-pinned source fetches
seonghobae
committed
ca2155e
test(image): align bounded source-fetch contract
seonghobae
committed
7dfacbf
test(image): require bounded scanner downloads
seonghobae
committed
971989a
fix(image): bound scanner asset downloads
seonghobae
committed
217b336
fix(image): constrain source redirect protocols
seonghobae
committed
5b3cd3d
fix(image): restore exact verification contract
seonghobae
committed
d675e54
fix(image): bound scanner asset transport
seonghobae
committed
68b0e43
test(image): align scanner retry bound with hardened workflow
seonghobae
committed
d51ef8a