chore(submodules): promote PMOVES-tensorzero gitlink to synced hardened HEAD - #1753
Conversation
…ed HEAD Advances tensorzero gitlink deca197e -> synced hardened HEAD after the upstream sync (PMOVES-tensorzero#6 merged tensorzero/tensorzero main; 958 upstream commits, 1 hardening preserved). Already tracks hardened (not a trap) — straight promote. #6 conflicts (5) resolved preserving hardening: workflows took upstream's explicit-secrets + least-privilege blocks (all 54 general.yml sha-pins survive); provider-proxy Dockerfile kept both USER hardening + upstream HEALTHCHECK. Image-built → this PR's Trivy is the CVE gate. Refs research/FORKSYNC_PARTITION_Z890_4090_2026-06-09.md (Z890 batch). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 30 minutes and 6 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d31ae1e32
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1 +1 @@ | |||
| Subproject commit deca197e869791ceea7c01a7f08fc46feb6fa79f | |||
| Subproject commit ca89fd044ac518cd52d1f3cbcae56ff67952469d | |||
There was a problem hiding this comment.
When the promoted submodule is used to build the provider-proxy image, crates/provider-proxy/Dockerfile now runs groupadd/useradd after switching to gcr.io/distroless/cc-debian13 and after USER nonroot:nonroot; distroless explicitly omits shells/package-management/userland tools, so this RUN layer cannot execute and the build-provider-proxy-container workflow/build path will fail before producing an image. Create the user/passwd entries in a builder stage or use the existing distroless nonroot user instead.
Useful? React with 👍 / 👎.
1 participant
Promotes tensorzero gitlink
deca197e → ca89fd04(FF +960/0) after upstream sync (PMOVES-tensorzero#6, 958 upstream commits, 1 hardening preserved). Not a trap fork — straight promote.#6's 5 conflicts resolved preserving hardening: workflows took upstream's explicit-secrets +
actions: readleast-privilege blocks (all 54 general.yml sha-pins survive, 0 tag-refs); provider-proxy Dockerfile kept both non-rootUSER+ upstreamHEALTHCHECK. Image-built → post-merge Trivy is the CVE gate.Refs
research/FORKSYNC_PARTITION_Z890_4090_2026-06-09.md(Z890 batch).🤖 Generated with Claude Code