feat(#568): make protected paths configurable via env var - #569

Merged

ralphbean merged 29 commits into

mainfrom

agent/568-configurable-protected-paths

Aug 10, 2026

Commits on Aug 6, 2026

feat(#568): make protected paths configurable via REVIEW_PROTECTED_PATHS

ralphbean
and
claude
committed
b5e8a59
feat(#568): make protected paths configurable via REVIEW_PROTECTED_PATHS

ralphbean
and
claude
committed
3962cc1
feat(#568): add protected-path eval case and wire env vars through harness

ralphbean
and
claude
committed
be6b95b
chore: rename eval case to 003-protected-path-downgrade

ralphbean
and
claude
committed
91b10b5
fix(#568): filter empty entries from REVIEW_PROTECTED_PATHS
ralphbean
committed
25cfe45
fix(#568): use dependabot.yml instead of workflow in eval fixture
ralphbean
committed
15c06c8
fix(#568): address review feedback on protected paths
ralphbean
committed
5a3210a
fix(#568): emit optional review env vars in eval runner
ralphbean
committed
d2c99ea
fix(#568): add seed issue to eval fixture for approve path
ralphbean
committed
d437521
fix(#568): bump max_turns for protected-path eval case
ralphbean
committed
aacd11e
fix(#568): bump max_cost_usd for protected-path eval case

ralphbean
and
claude
committed
abc80ea
fix(post-review): scope protected-paths resolution to approve action only
ralphbean
committed
55d5beb
fix: close fail-open gaps in protected-path enforcement

fullsend-ai-coder[bot]
authored and
ralphbean
committed
33ca609
fix(#568): correct stale docs and eval annotation on protected paths
ralphbean
committed
3695b2a
fix(#568): distinguish explicit-empty from comma-noise in REVIEW_PROTECTED_PATHS
ralphbean
committed
ddbd9eb
fix(#568): sanitize REVIEW_PROTECTED_PATHS before GHA error interpolation
ralphbean
committed
4f8f61c
test(#568): isolate fake-scripts test dirs to remove order dependency
ralphbean
committed
dffda0d
docs(#568): document three-way REVIEW_PROTECTED_PATHS resolution in SKILL.md
ralphbean
committed
cb342fb
fix(#568): distinguish unset from explicit-empty REVIEW_PROTECTED_PATHS in eval harness
ralphbean
committed
1335500
fix(#568): fail closed on missing defaults file, unset ambient env in tests
ralphbean
committed
20a78fc
refactor(#568): bake REVIEW_PROTECTED_PATHS default into harness/review.yaml
ralphbean
committed
f686efd
fix(#568): export REVIEW_FINDING_SEVERITY_THRESHOLD in protected-paths tests
ralphbean
committed
bb20f15
fix(#568): address review feedback on protected-paths enforcement
ralphbean
committed
0849170
docs(#568): disambiguate step-2 references in security-triage procedure
ralphbean
committed
d21e5d0
docs(review): fix stale protected-path references, rename shell vars
ralphbean
committed
7fd18c3
refactor(review): namespace-qualify protected-paths internal array
ralphbean
committed
77bf9f4
test(review): add regression test for protected-paths default drift
ralphbean
committed
6b41ef9
fix(#568): remove env/ from default REVIEW_PROTECTED_PATHS
ralphbean
committed
fed0477

Commits on Aug 10, 2026

docs(review): document REVIEW_PROTECTED_PATHS in post-review.sh header
ralphbean
committed
bb167e2

Navigation Menu

feat(#568): make protected paths configurable via env var - #569

feat(#568): make protected paths configurable via env var#569
ralphbean merged 29 commits into
mainfrom
agent/568-configurable-protected-paths

Commits on Aug 6, 2026

feat(#568): make protected paths configurable via REVIEW_PROTECTED_PATHS

feat(#568): make protected paths configurable via REVIEW_PROTECTED_PATHS

feat(#568): add protected-path eval case and wire env vars through harness

chore: rename eval case to 003-protected-path-downgrade

fix(#568): filter empty entries from REVIEW_PROTECTED_PATHS

fix(#568): use dependabot.yml instead of workflow in eval fixture

fix(#568): address review feedback on protected paths

fix(#568): emit optional review env vars in eval runner

fix(#568): add seed issue to eval fixture for approve path

fix(#568): bump max_turns for protected-path eval case

fix(#568): bump max_cost_usd for protected-path eval case

fix(post-review): scope protected-paths resolution to approve action only

fix: close fail-open gaps in protected-path enforcement

fix(#568): correct stale docs and eval annotation on protected paths

fix(#568): distinguish explicit-empty from comma-noise in REVIEW_PROTECTED_PATHS

fix(#568): sanitize REVIEW_PROTECTED_PATHS before GHA error interpolation

test(#568): isolate fake-scripts test dirs to remove order dependency

docs(#568): document three-way REVIEW_PROTECTED_PATHS resolution in SKILL.md

fix(#568): distinguish unset from explicit-empty REVIEW_PROTECTED_PATHS in eval harness

fix(#568): fail closed on missing defaults file, unset ambient env in tests

refactor(#568): bake REVIEW_PROTECTED_PATHS default into harness/review.yaml

fix(#568): export REVIEW_FINDING_SEVERITY_THRESHOLD in protected-paths tests

fix(#568): address review feedback on protected-paths enforcement

docs(#568): disambiguate step-2 references in security-triage procedure

docs(review): fix stale protected-path references, rename shell vars

refactor(review): namespace-qualify protected-paths internal array

test(review): add regression test for protected-paths default drift

fix(#568): remove env/ from default REVIEW_PROTECTED_PATHS

Commits on Aug 10, 2026

docs(review): document REVIEW_PROTECTED_PATHS in post-review.sh header