fix(egress): require headerless anonymous GitHub meta requests

.github/workflows/ci.yml

@@ -183,6 +183,25 @@ jobs:
               diagnosticCount += 1;
               if (diagnosticCount >= 64) break outer;
             }
+            const branchMap = coverage?.branchMap ?? {};
+            for (const [branchId, hits] of Object.entries(coverage?.b ?? {})) {
+              if (!Array.isArray(hits)) continue;
+              const branch = branchMap[branchId];
+              const locations = branch?.locations ?? [];
+              for (const [armIndex, armHits] of hits.entries()) {
+                if (armHits !== 0) continue;
+                const location = locations[armIndex] ?? branch?.loc;
+                const line = branch?.line ?? branch?.loc?.start?.line ?? location?.line ?? location?.start?.line;
+                if (!Number.isInteger(line)) continue;
+                const column = branch?.loc?.start?.column ?? location?.start?.column ?? 0;
+                const path = relative(process.cwd(), file) || file;
+                console.error(
+                  `Uncovered branch ${path}:${line}:${column} branch=${branchId} arm=${armIndex}`,
+                );
+                diagnosticCount += 1;
+                if (diagnosticCount >= 64) break outer;
+              }
+            }
           }
           NODE
           fi
@@ -194,6 +213,9 @@ jobs:
       - name: release KPI verification
         run: npm run kpi:verify
 
+      - name: release dependency license inventory
+        run: npm run release:dependency-license-inventory
+
       - name: release acquisition manifest
         run: npm run acquisition:manifest
 

.github/workflows/patch-validator-image.yml

@@ -6,7 +6,7 @@ on:
 
 concurrency:
   group: noema-patch-validator-image-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -80,6 +80,20 @@ jobs:
           scanner_dir="$RUNNER_TEMP/noema-binary-scanners"
           mkdir -p "$scanner_dir"
 
+          download_scanner_asset() {
+            destination="$1"
+            url="$2"
+            timeout --signal=TERM --kill-after=30s 5m \
+              curl --proto '=https' --proto-redir '=https' --tlsv1.2 --location --fail --silent --show-error \
+                --retry 3 \
+                --retry-all-errors \
+                --retry-delay 2 \
+                --retry-max-time 90 \
+                --connect-timeout 20 \
+                --max-time 180 \
+                --output "$destination" "$url"
+          }
+
           install_scanner() {
             scanner="$1"
             version="$2"
@@ -88,12 +102,10 @@ jobs:
             checksums="${scanner}_${version}_checksums.txt"
             release_base="https://github.com/anchore/${scanner}/releases/download/v${version}"
 
-            curl --proto '=https' --tlsv1.2 --location --fail --silent --show-error \
-              --output "$scanner_dir/$checksums" "$release_base/$checksums"
+            download_scanner_asset "$scanner_dir/$checksums" "$release_base/$checksums"
             printf '%s  %s\n' "$checksums_sha256" "$scanner_dir/$checksums" | sha256sum --check --strict
 
-            curl --proto '=https' --tlsv1.2 --location --fail --silent --show-error \
-              --output "$scanner_dir/$archive" "$release_base/$archive"
+            download_scanner_asset "$scanner_dir/$archive" "$release_base/$archive"
             (
               cd "$scanner_dir"
               grep -E "^[0-9a-f]{64}  ${archive}$" "$checksums" | sha256sum --check --strict
@@ -108,17 +120,64 @@ jobs:
           "$scanner_dir/grype" version | grep -Fq "$GRYPE_VERSION"
           printf 'SCANNER_BIN_DIR=%s\n' "$scanner_dir" >>"$GITHUB_ENV"
 
+      - name: Set up exact dependency materialization toolchain
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24.19.0"
+          cache: npm
+
+      - name: Materialize exact patch-validator dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(node --version)" = "v24.19.0"
+          test "$(npm --version)" = "11.17.0"
+
+          deps_dir="$RUNNER_TEMP/patch-validator-deps"
+          rm -rf "$deps_dir"
+          mkdir -p "$deps_dir"
+          cp package.json package-lock.json "$deps_dir/"
+          source_lock_sha="$(sha256sum package-lock.json | cut -d' ' -f1)"
+          copied_lock_sha="$(sha256sum "$deps_dir/package-lock.json" | cut -d' ' -f1)"
+          test "$copied_lock_sha" = "$source_lock_sha"
+
+          (
+            cd "$deps_dir"
+            timeout --signal=TERM --kill-after=30s 10m env \
+              npm_config_os=wasip1-threads \
+              npm_config_cpu=wasm32 \
+              npm ci --include=optional --ignore-scripts --no-audit --no-fund
+            npm pkg delete devDependencies.@cloudflare/workers-types devDependencies.wrangler
+            timeout --signal=TERM --kill-after=30s 5m env \
+              npm_config_os=wasip1-threads \
+              npm_config_cpu=wasm32 \
+              npm prune --include=optional --ignore-scripts --no-audit --no-fund
+            test -f node_modules/typescript/bin/tsc
+            test -f node_modules/vitest/vitest.mjs
+            test -f node_modules/@vitest/coverage-v8/package.json
+            test -f node_modules/@rolldown/binding-wasm32-wasi/package.json
+            test -z "$(find node_modules -type f -name '*.node' -print -quit)"
+            test ! -e node_modules/@cloudflare/workers-types
+            test ! -e node_modules/wrangler
+            test ! -e node_modules/workerd
+            test ! -e node_modules/miniflare
+          )
+
+          printf 'VALIDATOR_DEPS_CONTEXT=%s\n' "$deps_dir" >>"$GITHUB_ENV"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build exact-head patch-validator image
         shell: bash
         run: |
           set -euo pipefail
+          test -d "$VALIDATOR_DEPS_CONTEXT/node_modules"
           timeout --signal=TERM --kill-after=30s 150m docker buildx build \
             --load \
             --cache-from=type=gha,scope=noema-patch-validator-image \
             --cache-to=type=gha,mode=max,scope=noema-patch-validator-image \
+            --build-context "validator_deps=${VALIDATOR_DEPS_CONTEXT}" \
             --platform=linux/amd64 \
             --file=Dockerfile.patch-validator \
             --build-arg=SOURCE_REVISION=${SOURCE_SHA} \

AGENTS.md

@@ -8,25 +8,28 @@ Worker (npm + `wrangler.toml`); tests run under Vitest.
 ## Agent guidance (CWL governance)
 
 ### Security & review gate
-- Every PR that is eligible for the central **Security Scan** must pass that required gate. It runs
+- Every PR that is expected to receive the central **Security Scan** must pass that required gate. It runs
   `osv-scan` + `dependency-review` (diff-scoped) and `trivy-fs` (repo-wide,
-  fixable `MEDIUM/HIGH/CRITICAL`). The central workflow currently selects pull requests whose base branch is `main`, `master`, or `develop`.
-  A feature-base stacked PR can therefore have no Security Scan run; absence is non-passing evidence
-  rather than scanner success. Keep the stack in dependency order, then after its predecessor integrates
-  refresh or retarget the PR onto an eligible protected base and require a fresh terminal-success Security Scan
-  on the unchanged exact head before merge.
+  fixable `MEDIUM/HIGH/CRITICAL`). The current protected central workflow has no
+  pull-request base-branch filter, so stacked feature-base PRs are expected to
+  receive the same scanner workflow rather than being exempt by branch name.
+  An absent, queued, skipped, cancelled, stale, or failed run is non-passing
+  evidence rather than scanner success. Keep stacks in dependency order and
+  require a fresh terminal-success Security Scan on the unchanged exact head
+  before merge; if an expected run is absent, investigate routing instead of
+  treating the absence as an eligible-base exception.
 - A failing **`trivy-fs` is a REAL finding, not a flake.** Read the job log — it
   prints each finding's rule id / severity / file — or the run's SARIF results,
   then **remediate**:
-  - For this repo, findings are almost always vulnerable npm dependencies: bump
-    the package in `package.json` and refresh `package-lock.json`
-    (`npm update <pkg>` or `npm install <pkg>@<fixed>`), preferring the transitive
-    fix. There is no Dockerfile or k8s manifest today; if you add one, `trivy-fs`
-    will also flag image/IaC misconfig — fix it at the source.
+  - Vulnerable npm dependencies belong in `package.json`/`package-lock.json`;
+    refresh the lockfile with the smallest compatible fixed dependency.
+    Dockerfile/IaC findings, including the patch-validator image definition,
+    must be fixed at the source rather than hidden behind scanner changes.
   - Only for a genuine false positive, add a narrow, **documented**
     `.trivyignore` (or `.trivyignore.yaml`) entry. Never weaken or disable the gate.
-- A local scan with a stale DB misses findings. Run `trivy --download-db-only`
-  first, then scan the **merge ref**, not just the PR head.
+- A local scan with a stale DB misses findings. Refresh scanner data before
+  local diagnosis and keep local evidence separate from the required central
+  exact-head run; local success never substitutes for the protected workflow.
 - The org `code_scanning` ruleset is intentionally **CodeQL-only** (multiple
   code-scanning tools can't converge on one PR ref). Gating is by the Security
   Scan **job result**, not the `code_scanning` rule — do **not** add tools to

Dockerfile.patch-validator

@@ -4,23 +4,69 @@ FROM alpine:3.24.1@sha256:79ff19e9084a00eece421b2523fb93e22d730e2c0e525905de047e
 
 ARG NODE_VERSION=24.19.0
 ARG NODE_SOURCE_SHA256=f6d95e10a0431ee1067fc6aabe9f762908b4716dd35324e1ddb4b1466b76659f
+ARG OPENSSL_VERSION=3.5.8
+ARG OPENSSL_SOURCE_SHA256=a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2
 
 RUN apk add --no-cache \
       binutils-gold \
+      coreutils \
+      curl \
       g++ \
       gcc \
       libgcc \
       libgcc-static \
       linux-headers \
       make \
+      perl \
       python3 \
       py3-setuptools \
       xz
 
-ADD --checksum=sha256:${NODE_SOURCE_SHA256} https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}.tar.xz /tmp/node.tar.xz
-
-RUN mkdir -p /usr/src/node \
-    && tar -xJf /tmp/node.tar.xz --strip-components=1 -C /usr/src/node
+RUN set -eu; \
+    download_exact() { \
+      url="$1"; \
+      expected="$2"; \
+      output="$3"; \
+      timeout --signal=TERM --kill-after=30s 5m \
+        curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
+          --retry 3 \
+          --retry-all-errors \
+          --retry-delay 2 \
+          --retry-max-time 90 \
+          --connect-timeout 20 \
+          --max-time 180 \
+          --output "$output" \
+          "$url"; \
+      printf '%s  %s\n' "$expected" "$output" | sha256sum --check --strict; \
+    }; \
+    download_exact \
+      "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}.tar.xz" \
+      "$NODE_SOURCE_SHA256" \
+      /tmp/node.tar.xz; \
+    download_exact \
+      "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz" \
+      "$OPENSSL_SOURCE_SHA256" \
+      /tmp/openssl.tar.gz
+
+RUN mkdir -p /usr/src/node /usr/src/openssl \
+    && tar -xJf /tmp/node.tar.xz --strip-components=1 -C /usr/src/node \
+    && tar -xzf /tmp/openssl.tar.gz --strip-components=1 -C /usr/src/openssl
+
+WORKDIR /usr/src/openssl
+
+RUN ./Configure linux-x86_64 \
+      no-shared \
+      no-tests \
+      --prefix=/opt/openssl \
+      --libdir=lib \
+    && make -j"$(getconf _NPROCESSORS_ONLN)" \
+    && make install_sw \
+    && test -f /opt/openssl/include/openssl/opensslv.h \
+    && test -f /opt/openssl/lib/libcrypto.a \
+    && test -f /opt/openssl/lib/libssl.a \
+    && grep -Fq "OPENSSL_VERSION_MAJOR  3" /opt/openssl/include/openssl/opensslv.h \
+    && grep -Fq "OPENSSL_VERSION_MINOR  5" /opt/openssl/include/openssl/opensslv.h \
+    && grep -Fq "OPENSSL_VERSION_PATCH  8" /opt/openssl/include/openssl/opensslv.h
 
 ENV PATH="/opt/node/bin:${PATH}"
 WORKDIR /usr/src/node
@@ -31,10 +77,14 @@ RUN ./configure \
       --with-intl=small-icu \
       --without-corepack \
       --disable-single-executable-application \
+      --shared-openssl \
+      --shared-openssl-includes=/opt/openssl/include \
+      --shared-openssl-libpath=/opt/openssl/lib \
     && make -j"$(getconf _NPROCESSORS_ONLN)" V= \
     && make install \
     && test "$(/opt/node/bin/node --version)" = "v${NODE_VERSION}" \
     && test "$(/opt/node/bin/npm --version)" = "11.17.0" \
+    && OPENSSL_VERSION="${OPENSSL_VERSION}" /opt/node/bin/node --input-type=module --eval='if (process.versions.openssl !== process.env.OPENSSL_VERSION) throw new Error(`unexpected OpenSSL ${process.versions.openssl}`)' \
     && /opt/node/bin/node --input-type=module --eval='/\p{ID_Continue}/u.test("a")' \
     && ! readelf -l /opt/node/bin/node | grep -q 'Requesting program interpreter' \
     && ! readelf -d /opt/node/bin/node | grep -q '(NEEDED)' \
@@ -49,30 +99,11 @@ RUN ./configure \
     && readelf -p .note.package /opt/node/bin/node \
       | grep -Fq 'cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*' \
     && test "$(/opt/node/bin/node --version)" = "v${NODE_VERSION}" \
+    && OPENSSL_VERSION="${OPENSSL_VERSION}" /opt/node/bin/node --input-type=module --eval='if (process.versions.openssl !== process.env.OPENSSL_VERSION) throw new Error(`unexpected OpenSSL ${process.versions.openssl}`)' \
     && /opt/node/bin/node --input-type=module --eval='/\p{ID_Continue}/u.test("a")' \
     && ! readelf -l /opt/node/bin/node | grep -q 'Requesting program interpreter' \
     && ! readelf -d /opt/node/bin/node | grep -q '(NEEDED)'
 
-FROM node_builder AS dependencies
-
-WORKDIR /build
-
-COPY package.json package-lock.json ./
-RUN npm_config_os=wasip1-threads npm_config_cpu=wasm32 \
-      npm ci --include=optional --ignore-scripts --no-audit --no-fund \
-    && npm pkg delete devDependencies.@cloudflare/workers-types devDependencies.wrangler \
-    && npm_config_os=wasip1-threads npm_config_cpu=wasm32 \
-      npm prune --include=optional --ignore-scripts --no-audit --no-fund \
-    && test -f node_modules/typescript/bin/tsc \
-    && test -f node_modules/vitest/vitest.mjs \
-    && test -f node_modules/@vitest/coverage-v8/package.json \
-    && test -f node_modules/@rolldown/binding-wasm32-wasi/package.json \
-    && test -z "$(find node_modules -type f -name '*.node' -print -quit)" \
-    && test ! -e node_modules/@cloudflare/workers-types \
-    && test ! -e node_modules/wrangler \
-    && test ! -e node_modules/workerd \
-    && test ! -e node_modules/miniflare
-
 FROM scratch AS runtime
 
 ARG SOURCE_REVISION
@@ -89,11 +120,15 @@ WORKDIR /workspace
 
 COPY --from=node_builder --chown=65532:65532 /opt/node/bin/node /nodejs/bin/node
 COPY --from=node_builder --chown=65532:65532 --chmod=0444 /usr/src/node/LICENSE /licenses/node/LICENSE
-COPY --from=dependencies --chown=65532:65532 /build/node_modules /opt/noema/node_modules
+# validator_deps is a local named BuildKit context materialized from this exact
+# head's lockfile by the workflow. Copying directly from the named context avoids
+# an ambiguous unpinned FROM reference while keeping npm registry resolution out
+# of the Docker build authority.
+COPY --from=validator_deps --chown=65532:65532 /node_modules /opt/noema/node_modules
 COPY --chown=65532:65532 patch-validator/entrypoint.mjs /opt/noema/entrypoint.mjs
 COPY --chown=65532:65532 patch-validator/validate-patch.mjs /opt/noema/validate-patch.mjs
 COPY --chown=65532:65532 patch-validator/runtime.mjs /opt/noema/runtime.mjs
 COPY --chown=65532:65532 patch-validator/validator-tsconfig.json /opt/noema/validator-tsconfig.json
 COPY --chown=65532:65532 patch-validator/validator-vitest.config.mjs /opt/noema/validator-vitest.config.mjs
 
-ENTRYPOINT ["/nodejs/bin/node", "--input-type=module", "--eval", "import { runCli } from '/opt/noema/runtime.mjs'; import { runEntrypoint } from '/opt/noema/entrypoint.mjs'; process.exitCode = runEntrypoint({ runCliImpl: runCli, writeDiagnostic: (message) => process.stderr.write(message) });"]
+ENTRYPOINT ["/nodejs/bin/node", "--input-type=module", "--eval", "import { runCli } from '/opt/noema/runtime.mjs'; import { runEntrypoint } from '/opt/noema/entrypoint.mjs'; process.exitCode = runEntrypoint({ runCliImpl: runCli, writeDiagnostic: (message) => process.stderr.write(message) });"]

src/index.ts

@@ -815,20 +815,19 @@ async function resolveInstallationId(
   repository: string,
   env: Env,
 ): Promise<InstallationIdResolution> {
-  if (env.GITHUB_APP_INSTALLATION_ID) {
-    const configuredInstallationId = env.GITHUB_APP_INSTALLATION_ID;
+  const configuredInstallationId = env.GITHUB_APP_INSTALLATION_ID;
+  if (configuredInstallationId) {
     if (!/^[1-9]\d*$/.test(configuredInstallationId)) {
       throw new ApiError("ERR_GITHUB_INSTALLATION", 500, "GitHub App installation id configuration is invalid");
     }
     const numericInstallationId = Number(configuredInstallationId);
     if (!Number.isSafeInteger(numericInstallationId) || String(numericInstallationId) !== configuredInstallationId) {
       throw new ApiError("ERR_GITHUB_INSTALLATION", 500, "GitHub App installation id configuration is invalid");
     }
-    return { value: configuredInstallationId, source: "configured" };
   }
   const now = Date.now();
   const cacheKey = `${env.GITHUB_API_BASE}:${env.GITHUB_APP_ID}:${repository}`;
-  const cached = installationIdCache.get(cacheKey);
+  const cached = configuredInstallationId ? undefined : installationIdCache.get(cacheKey);
   if (cached && cached.expiresAtMs > now) {
     return { value: cached.value, source: "cache" };
   }
@@ -850,11 +849,23 @@ async function resolveInstallationId(
     throw new ApiError("ERR_GITHUB_API", 502, "GitHub API returned invalid installation response");
   }
   const installationId = String(installation.id);
-  installationIdCache.set(cacheKey, {
+  if (configuredInstallationId && installationId !== configuredInstallationId) {
+    throw new ApiError(
+      "ERR_GITHUB_INSTALLATION",
+      500,
+      "GitHub App installation id does not match target repository",
+    );
+  }
+  if (!configuredInstallationId) {
+    installationIdCache.set(cacheKey, {
+      value: installationId,
+      expiresAtMs: now + configuredTtlMs(env.NOEMA_INSTALLATION_CACHE_TTL_SECONDS, 600, 3600),
+    });
+  }
+  return {
     value: installationId,
-    expiresAtMs: now + configuredTtlMs(env.NOEMA_INSTALLATION_CACHE_TTL_SECONDS, 600, 3600),
-  });
-  return { value: installationId, source: "discovery" };
+    source: configuredInstallationId ? "configured" : "discovery",
+  };
 }
 
 async function createInstallationToken(repository: string, env: Env): Promise<InstallationToken> {