fix(codeql): reject non-canonical dispatch repository identities

[seonghobae]

Current authority — 2026-09-20 KST

• Exact head: 8da5f48fa0438ff33c766f03325f6e7f2a77dd9d; tree 8c129bc3266842d6e244175894bd1f40f22ba1f5.
• Python Security run 35448925970, job 105957721584, audited every other input cleanly and failed only requirements-strix-ci-hashes.txt: anyio 4.14.0 carried CVE-2026-63374, CVE-2026-64847, and CVE-2026-63349.
• Ordinary two-parent repair adopts current canonical AnyIO owner #2278@8a5251bf… while preserving the complete prior fix(codeql): reject non-canonical dispatch repository identities #2271 tree. The only added effective path is the canonical anyio==4.14.2 lock blob eb83beda….
• Protected-main compare is 21 ahead / 0 behind, merge base exactly main@e6334e22…, with exactly four effective paths. Relative to chore(deps): bump anyio from 4.14.0 to 4.14.2 #2278 this head is 9 ahead / 0 behind and differs only in the three intended CodeQL repository-identity paths.
• Fresh exact-head SAST 35480431728, Python Security 35480431734, and Security Scan 35480431743 are terminal CANCELLED; CodeQL 35480431778 remains PENDING. No predecessor result transfers, and cancellation is not GREEN.
• Remains Draft / Proposed, mergeable, and requires terminal current-head Checks plus qualifying independent approval. No source-neutral wake commit, blind rerun, scanner suppression, self-approval, bypass, Force Push, or gate weakening is authorized.

Superseded exact-head record

Current authority — 2026-09-19 KST

• Exact head: 055ee9b9587512fdb999d1c847a4e93828475439; tree d073621c76e22e9514fac6da85b5ebe37573fdc8.
• Stacked base: fix/github-api-url-boundary@b338d1e246fcd13ed4b61ae63e6d36d4a4129beb (#2279).
• Ordinary two-parent integration: c3a4d5196b6e267bea9e03f84b5ba05915785444, ordered parents previous fix(codeql): reject non-canonical dispatch repository identities #2271 2b849c874122961e025c29f7fa0bb697863c3d68 and fix(security): prove GitHub API URL authority #2279 b338d1e246fcd13ed4b61ae63e6d36d4a4129beb.
• Integration RED found that the real dispatch validation printed the repository-admission ::error:: command to stdout while the hardened contract required stderr. GREEN 9501aea608bc1199c7258e586d387ec05ab96075 repairs the production error boundary; 055ee9b... retires the contradictory stale stdout test.
• Verification: URL/repository-identity focused 95 passed; dispatch contracts 72 passed; full 3,374 passed / 28 skipped / 40 subtests passed; git diff --check passed.
• Remains Draft / Proposed. Hosted checks and qualifying independent current-head approval must be reacquired; no predecessor evidence transfers.

Pre-integration history

Problem

The protected CodeQL repository_dispatch handler restricted targets to ContextualWisdomLab, but its repository component accepted trailing . and embedded .. because admission used only ^ContextualWisdomLab/[A-Za-z0-9_.-]+$.

Tracks #2264. This lane owns the CodeQL scan-dispatch admission boundary only. Scheduler repository identity remains owned by #2040; queue-health generic owner/repository identity remains owned by #2268.

RED contract and production repair

The focused test executes the real Bind workflow inputs to live organization pull request metadata shell block, not a copied regex. It requires the existing repository-admission diagnostic for ContextualWisdomLab/repository., ContextualWisdomLab/repo..name, ContextualWisdomLab/.., and ContextualWisdomLab/., while preserving successful admission for ContextualWisdomLab/pg-llm-batch and ContextualWisdomLab/repository.name-1.

Current exact head remains 2b849c874122961e025c29f7fa0bb697863c3d68. The ordinary-forward production commit adds exactly two conditions to the existing organization-local admission hunk in .github/workflows/codeql-scan-dispatch.yml: reject the repository component when it contains .., and reject it when it ends in .. Actor/sender authorization, legacy-v1/v2 envelopes, producer/base/head identity, matrix/rerun binding, credential routing, SARIF/GHAS evidence, status publication, and exact-run settlement are untouched.

Current foundation prerequisite

The historical prerequisite in this record is superseded. Canonical URL/redirect owner #2279 has since landed as protected main@e6334e229581a918e2f22de18733b76fa65d7e71, and the live top section is authoritative for current ancestry and hosted evidence.

Acceptance

Focused production-path hostile/positive matrix, existing CodeQL dispatch workflow contracts, exact-head quality/security checks, and qualifying independent review must all be current-head GREEN before merge. No predecessor evidence transfers across head movement.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Source-level finding is valid at this exact head. Protected codeql-scan-dispatch.yml admits TARGET_REPOSITORY with ^ContextualWisdomLab/[A-Za-z0-9_.-]+$, while this PR's new regression executes the actual validation shell block and requires trailing-dot, embedded-.., exact . and exact .. repository components to fail closed. Keep this PR Draft/RED until the minimum workflow admission hunk is applied and the complete existing CodeQL dispatch contract plus fresh exact-head hosted gates pass. Do not infer GREEN from the derived regex or transfer predecessor evidence.

[seonghobae]

Exact-head review: the RED remains intentionally production-neutral. The second test-only commit strengthens causality by requiring the existing repository-admission diagnostic in addition to nonzero exit, so an unrelated downstream validation failure cannot satisfy the hostile cases. Current protected handler still uses the permissive repository expression; keep Draft until the minimum admission hunk is applied, the focused matrix and existing CodeQL dispatch contracts pass on one unchanged head, and fresh hosted gates are terminal. No predecessor review/check evidence transfers.

[seonghobae]

Exact-head source review: 2b849c874122961e025c29f7fa0bb697863c3d68 is the minimum causal production repair for the established scan-dispatch repository-identity RED. Pre-ref candidate inspection rejected two unreferenced reconstructions with unrelated one-line collateral; neither was pushed. The accepted candidate compares to 10a87abddddd0b7b02d4c10b4ee9347ebe6f2237 as ahead 1 / behind 0 and exactly one workflow file, +2/-0. The only source delta keeps the existing fixed ContextualWisdomLab/ owner and allowed-character grammar, then rejects repository components containing .. or ending in . before any GitHub API metadata read. Actor/sender authorization, legacy-v1/v2 envelopes, producer/base/head identity, matrix/rerun binding, credential routing, SARIF/GHAS evidence, status publication, and exact-run settlement are unchanged. This COMMENT does not self-approve or transfer predecessor evidence. Exact-head hosted CodeQL/SAST/Python Security/Security Scan runs are newly queued and must settle normally before acceptance.

[seonghobae]

Exact-head RCA refresh for 2b849c874122961e025c29f7fa0bb697863c3d68:

SAST Semgrep 35353637026 is now terminal FAILURE. This is not evidence that the two-line CodeQL repository_dispatch admission repair is defective. The hosted job checked out and verified the exact submitted revision, verified the pinned Semgrep manifest, completed the Semgrep scan, filtered/uploaded SARIF, and reported findings successfully. The only failing step was Enforce Semgrep gate (fail on Medium+ findings).

That chronology matches the existing central-baseline SAST blocker currently owned by #2269/#2272. Keep this queue-health/dispatch slice source-stable while those central SAST/authenticated-request findings converge. Do not broaden suppression, remove the repository-identity repair, add a source-neutral wake commit, or manually rerun the unchanged head merely to obtain a new receipt.

The remaining exact-head lanes are still incomplete at this read: CodeQL PR 35353637005, Python Security 35353636946, and Security Scan 35353636966 are queued. Any future head movement must reacquire acceptance from zero.

[seonghobae]

Prerequisite exact correction: .github#2279 is now cb50c8a28708e4d2b244d968b314fa3fb99194af (Draft/mergeable), superseding 77c1dc... in the PR body. Its final diff remains four files and adds hostile + positive GitHub-API authority contracts without global scanner/path/threshold weakening. Current exact-head hosted checks are still pending; #2271 must remain Draft and must adopt the landed #2279 delta ordinary-forward before any security-GREEN claim.

[seonghobae]

Current foundation exact supersedes the previous correction: .github#2279 is now 9ba43f284da51bfa6aaa389d3fb67f8b232fbba5. Final delta remains the same four-file #2248 authority repair; the last source change only binds the CodeQL Semgrep ignore to the exact guarded sink line. #2271 remains Draft at 2b849c... until #2279 lands and is adopted ordinary-forward with fresh exact-head evidence.

[seonghobae]

Fresh consumer-side prerequisite audit: this owner lane remains source-stable, but its PR description is stale in two live-coordination details. Canonical shared URL/redirect foundation #2279 has advanced ordinarily from 25f83aa... to exact 9c19c6e00eafc028068719ab482282c1256f8893; those new exact-head runs are currently queued. This #2271 head’s own hosted runs are already terminal rather than queued: Security Scan 35353636966 succeeded, while SAST 35353637026, CodeQL 35353637005, and Python Security 35353636946 failed. Keep Draft and do not infer security GREEN from Security Scan alone. Ordinary-forward reconciliation after accepted #2279 remains the correct owner path; no mutable-head copy or predecessor evidence transfer.

[seonghobae]

Traceability/prerequisite-currentness is RED on exact 2b849c874122961e025c29f7fa0bb697863c3d68.

This PR correctly remains Draft behind the canonical #2248 security foundation, but its Current hosted state and foundation prerequisite still names .github#2279@25f83aaee9eb97e423f6ef2467e722035bc2e362 and that generation's run IDs as current. Fresh canonical-owner read shows #2279 has ordinary-forwarded to exact d63d7e96426803d33e79c62e7317776f3dc1851c. That successor keeps the URL/no-redirect repair and additionally carries the actual-production-opener synthetic-302 binding plus the published-lineage evidence repair. Its exact-head runs are currently nonterminal: Agent Review Runtime Quality 35436033522 pending; Python Security 35436033535, CodeQL 35436033515, SAST Semgrep 35436033530, and Security Scan 35436033546 queued.

No source wake-up or restack is appropriate while that foundation is unaccepted. Minimum repair is PR-state/coordination currentness only: replace the stale #2279 generation/run inventory with the live canonical owner generation above (or, preferably, state the stable owner dependency and require a fresh owner reread immediately before adoption so future ordinary-forward movement does not make this body authoritative stale metadata again).

Acceptance remains: #2279 normal landing first → ordinary/non-force adoption here preserving this repository-identity RED/GREEN → fresh exact-head dispatch contracts/security checks → qualifying independent current-head review. Predecessor #2279 GREEN/queued states never transfer. This is a governance/evidence repair; do not create a no-op commit, rerun unchanged checks, or copy #2279 source into this lane.

[seonghobae]

Exact-head coordination review @ 8aff1a6a581613709c01747fe68c1f7523fe84da — PR-state traceability / current-authority gate: FAIL; the repository-identity source repair itself is not rejected.

Live PR metadata is already ordinary-forward on the current URL/redirect owner: base is #2279@d1e4380c15e948aaf104d46aa134fa614058782a and current head is 8aff1a6a.... The PR body, however, still opens its Current authority section with predecessor head 055ee9b... and predecessor foundation b338d1e..., while the nested history also calls 2b849c... current. That prose is now materially stale because #2275, Naruon Gap coordination, and OriginWeave descendants consume #2271 as a prerequisite and must not transfer predecessor evidence or ancestry from body text that contradicts the live ref graph.

RED acceptance: a current-authority/traceability check must fail whenever the PR body marks a predecessor head/base as current or associates hosted/local evidence from that predecessor generation with the live head. Resolve live head_sha, base_sha, parent PR identity, and then-current hosted runs before rendering current authority.

GREEN: update coordination/PR-state documentation only to current #2271@8aff1a6a... on #2279@d1e4380..., and bind checks/review statements to the generation that actually produced them. Preserve old RED→GREEN and predecessor evidence under an explicitly historical section. This does not require product/workflow source movement merely to refresh prose; avoid a source-neutral wake/no-op commit. Downstream #2275 must still ordinary/non-force reconcile onto this current parent before its evidence can count.

No force-push/rebase, predecessor-GREEN transfer, copied #2279 source, or gate weakening.

[seonghobae]

Exact-head reconciliation review at 8aff1a6a581613709c01747fe68c1f7523fe84da (tree 15a1f575b0b5cf2cc50b24f86567433f2119e587; COMMENT, not approval).

The earlier mergeable:false observation was transient/stale metadata, not evidence of a content conflict. The current PR is mergeable and is an ordinary two-parent merge whose ordered parents preserve prior #2271 055ee9b... and canonical owner #2279 d1e4380c.... Relative to the current stacked base it is ahead 7 / behind 0 and the effective consumer delta remains exactly three paths: the CodeQL dispatch workflow, its repository-identity production-shell contract, and the existing workflow contract.

Verification on the exact detached tree:

• combined URL authority / CodeQL identity / Strix / repository identity / dispatch contracts: 162 passed with warnings-as-errors;
• full GITHUB_ACTIONS=true suite using the Runtime Quality hashed dependency sets: 3,375 passed, 28 skipped, 40 subtests;
• git diff --check: PASS;
• unresolved review threads: 0.

The current integration preserves the canonical owner's foreign Semgrep evidence identity without copying or rewriting its history. I found no new substantive source finding in this reconciliation generation. The PR correctly remains Draft/Proposed: exact-head hosted gates are nonterminal/incomplete and a qualifying independent approval is still absent. No predecessor evidence transfers.

[seonghobae]

Fresh exact-head coordination update: the current SAST 35438876168, Security 35438876163, and CodeQL 35438876196 generations are no longer queued; all three are terminal cancelled. CodeQL job inventory shows Detect / compatibility / dispatch all cancelled, and the cancelled Detect job currently has no retrievable log, so there is not enough evidence to assign a causal code defect yet. Please treat the body’s queued wording as stale and keep this lane Proposed. Do not convert cancellation into GREEN or blind-rerun this unchanged head; first establish the owner-side cancellation/lifecycle cause (same-PR supersession, scheduler/queue lifecycle, or another explicit cancellation path) and only then reacquire exact-head hosted evidence.

[seonghobae]

Exact-head review-admission update at 8aff1a6a581613709c01747fe68c1f7523fe84da (COMMENT, not approval). Canonical foundation #2279 is now normally integrated as protected main@e6334e229581a918e2f22de18733b76fa65d7e71; this branch already preserves that owner lineage through its ordinary two-parent merge, is behind 0, and retains only the three owned CodeQL repository-admission paths. The prior hosted generation was terminal cancelled before the protected-main retarget and is not acceptance evidence. With source review, 162 focused tests, 3,375 full-suite tests / 28 skipped / 40 subtests, diff-check, and zero unresolved threads already recorded on this exact tree, Ready now means review admission only. Fresh base-current hosted gates and a qualifying independent current-head approval remain mandatory before any normal merge; no predecessor result transfers.

[seonghobae]

Protected-main ancestry repair — 2026-09-19

• Predecessor 8aff1a6a581613709c01747fe68c1f7523fe84da carried fix(security): prove GitHub API URL authority #2279's PR head but not protected merge commit e6334e229581a918e2f22de18733b76fa65d7e71; GitHub compare therefore correctly reported 7 ahead / 1 behind.
• Ordinary two-parent child a0e1424de409ec474e7bc6e9f91a9e99b8a0915e records ordered parents 8aff1a6a… + protected main@e6334e22…, reusing exact tree 15a1f575…. Force=false branch update succeeded.
• Fresh compare is 8 ahead / 0 behind with merge base exactly protected main and the same three owned paths. The PR is mergeable with zero review threads.
• Fresh exact-head runs: Python Security 35448925970, Semgrep 35448925987, CodeQL 35448926009, Security 35448926025. All are nonterminal.

[seonghobae]

@coderabbitai review

Please review only exact head a0e1424de409ec474e7bc6e9f91a9e99b8a0915e against protected main@e6334e229581a918e2f22de18733b76fa65d7e71. Confirm that the two-parent topology repair preserves the exact prior tree and that the effective diff remains the three CodeQL repository-identity paths. Predecessor checks and reviews do not transfer.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='a0e1424de409ec474e7bc6e9f91a9e99b8a0915e'
main='e6334e229581a918e2f22de18733b76fa65d7e71'
prior='8aff1a6a581613709c01747fe68c1f7523fe84da'

echo '== exact commit metadata =='
git show -s --format='commit=%H%ntree=%T%nparents=%P%nsubject=%s' "$head"
echo
echo '== prior commit tree =='
git show -s --format='commit=%H%ntree=%T%nparents=%P' "$prior"
echo
echo '== ancestry and range =='
printf 'merge_base='
git merge-base "$head" "$main"
git merge-base --is-ancestor "$main" "$head" && echo 'main_is_ancestor=yes' || echo 'main_is_ancestor=no'
git rev-list --left-right --count "$main...$head" | awk '{print "main_only=" $1 "\nhead_only=" $2}'
echo
echo '== effective changed paths =='
git diff --name-status "$main" "$head"
echo
echo '== diff check =='
git diff --check "$main" "$head"
echo 'diff_check=passed'
echo
echo '== effective diff =='
git diff --find-renames --find-copies --unified=80 "$main" "$head" -- .github/workflows/codeql-scan-dispatch.yml tests
echo
echo '== changed files under exact range =='
git diff --name-only "$main" "$head" | while IFS= read -r f; do
  printf '%s\t' "$f"
  git diff --numstat "$main" "$head" -- "$f"
done

Length of output: 21671

---

@seonghobae Review complete for exact head a0e1424de409ec474e7bc6e9f91a9e99b8a0915e.

No blocking finding in the requested scope.

• The exact head has ordered parents 8aff1a6a581613709c01747fe68c1f7523fe84da and protected main@e6334e229581a918e2f22de18733b76fa65d7e71.
• The exact head tree is 15a1f575b0b5cf2cc50b24f86567433f2119e587.
• The predecessor tree is also 15a1f575b0b5cf2cc50b24f86567433f2119e587.
• Therefore, the two-parent topology repair preserves the prior tree exactly.
• The protected main commit is the merge base and an ancestor of the exact head.
• The effective range is 8 commits ahead and 0 commits behind protected main.
• The effective diff changes only these three paths:
  • .github/workflows/codeql-scan-dispatch.yml
  • tests/test_codeql_scan_dispatch_repository_identity_contract.py
  • tests/test_codeql_scan_dispatch_workflow_contract.py
• The workflow rejects repository components that contain .. or end in ..
• The contract tests cover hostile and valid repository identities.
• git diff --check passed.

I did not treat predecessor checks or reviews as evidence for this exact head. The nonterminal exact-head checks and an independent current-head approval remain required.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Metadata-authority correction at unchanged exact head a0e1424de409ec474e7bc6e9f91a9e99b8a0915e: the live PR is Ready / Proposed after #2279 integration, but the terminal Acceptance paragraph still said “Keep Draft.” The body now explicitly makes the top current-authority section governing and labels historical Draft instructions as superseded. This changes no source, check, approval, or merge authority. Hosted exact-head gates and qualifying independent approval remain required.

[seonghobae]

2026-09-20 exact-head admission correction for a0e1424de409ec474e7bc6e9f91a9e99b8a0915e.

This PR is not currently merge-ready: four exact-head required workflows (SAST 35448925987, Security Scan 35448926025, Python Security 35448925970, CodeQL 35448926009) remain queued and there is no qualifying independent current-head approval. Ready state would keep non-admissible work in the saturated runner/review queue and can make stale receipts appear current.

Moving the PR to Draft / Proposed preserves every commit, review, thread, and valid delta. It is not closure or abandonment. Reconcile protected main non-destructively where needed, resolve all valid findings, obtain terminal exact-head Checks and a qualifying independent current-head approval, then return to Ready. No review dismissal, synthetic status, manual rerun, bypass, Force Push, or merge is authorized by this correction.

[seonghobae]

Exact-head metadata reconciliation at a0e1424de409ec474e7bc6e9f91a9e99b8a0915e.

The GitHub lifecycle authority is currently Draft, while the top body record still said Ready. The body now records Draft / Proposed consistently and keeps promotion blocked on terminal exact-head Checks plus qualifying independent current-head approval. No source, tree, gate, review thread, or merge authority changed. The four exact-head runs remain queued and unresolved threads remain zero; this is not approval.

[seonghobae]

2026-09-20 KST currentness handoff from OriginWeave consumer validation — no source change, rerun, label change, or gate mutation.

Exact head remains a0e1424de409ec474e7bc6e9f91a9e99b8a0915e, Draft/mergeable. The top body snapshot saying all four fresh runs are queued is now stale in one important respect: runner acquisition is partial/intermittent, not a total outage.

Fresh job-level evidence:

• Python Security 35448925970: Detect Python completed SUCCESS on hosted runner 1002048333; downstream pip-audit job 105957721584 and Bandit job 105957721628 remain queued with runner_id=0, steps=[].
• CodeQL PR 35448926009: Detect CodeQL languages completed SUCCESS on hosted runner 1002048415; compatibility jobs 105958646043 (python) and 105958646086 (actions) remain queued with runner_id=0, steps=[].
• Earlier Semgrep completion remains valid current-head evidence.

This narrows the blocker to intermittent/backlogged hosted-runner acquisition for downstream shards. Consumer lanes should not create no-op wake commits, blind reruns, or substitute runner labels. If a queued shard acquires a runner and produces a deterministic test/security RED, route that failure to its causal owner immediately; until then #2271 remains Draft and predecessor evidence does not substitute for terminal exact-head Checks.

[seonghobae]

Fresh causal update: Python Security is no longer merely runner-blocked. Run 35448925970 reached pip-audit job 105957721584 and failed deterministically because requirements-strix-ci-hashes.txt still resolves AnyIO 4.14.0 with CVE-2026-4597, CVE-2026-4649, and CVE-2026-4650; pip-audit identifies 4.14.2 as the fix version.

The canonical dependency repair is .github#2278, now exact 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5. Its effective protected-main diff is isolated to the AnyIO lock path. Do not patch the dependency independently on #2271. Required order is #2278 exact-head hosted/review acceptance -> normal landing -> ordinary/non-force adoption of the new protected main into #2271 -> fresh exact-head Python Security/CodeQL/Security evidence. Existing #2271 failure is a valid RED and should remain attributable until that owner repair is consumed.

[seonghobae]

Exact-head Python Security RCA — 2026-09-20 KST

Python Security run 35448925970, job 105957721584, completed every other audited input cleanly and failed only the immutable Strix lock: anyio 4.14.0 carried CVE-2026-63374, CVE-2026-64847, and CVE-2026-63349; all three identify 4.14.2 as the patched version. This is an inherited dependency defect, not the CodeQL repository-identity delta.

Ordinary two-parent repair 8da5f48f adopts canonical dependency owner #2278 while preserving the complete prior #2271 tree. The only tree replacement is requirements-strix-ci-hashes.txt, now the canonical anyio==4.14.2 blob eb83beda…; the PR remains Draft and mergeable.

Fresh exact-head SAST, Python Security, Security Scan, and CodeQL runs are queued/pending. No predecessor result transfers; no blind rerun, suppression, self-approval, bypass, Force Push, or gate weakening was used.