repair(codeql): restore exact endpoint-set membership

[seonghobae]

Repair finding

Protected main@e6334e229581a918e2f22de18733b76fa65d7e71 currently fails the canonical Python CodeQL producer on py/incomplete-url-substring-sanitization in tests/test_organization_commercial_readiness_loop_receipt_contract.py. Fresh producer run 35754606100 for .github#2040@bd039185ddf8df88480971cdd3b69c38f4558609 completed Python analysis and preserved SARIF; the Medium+ gate failed on the literal results-receiver.actions.githubusercontent.com:443 membership assertion.

This is not a URL sanitizer in product code. _harden_runner_allowed_endpoints() already parses the harden-runner block into a set[str], so the contract intends exact set membership. However, the three separate assert "..." in endpoints expressions trigger the CodeQL substring-sanitization heuristic.

Lost canonical delta

The same causal repair previously existed on the #2106 lineage at 298e6c14c9a56b51c61df2d2e35d7545f0f4f288: the three required endpoints were asserted as one set-subset relation. That valid delta did not survive #2106's later reconciliation/final protected merge; current protected main again carries the three individual membership expressions.

This Draft restores only that semantic delta on current protected main. Exact head 657d10402d4d502249423a85faa1f953542cd719 changes one test file: the three required endpoint strings are required together with set.issubset(endpoints). The helper, workflow, allowlist, permissions, endpoint values, security gate and runtime behavior are unchanged. The negative assertion remains unchanged.

Evidence / acceptance

• Hosted RED: .github#2040 producer 35754606100, Python CodeQL dispatch scan (python) job 106870962325, Medium+ SARIF gate FAILURE; preserved artifact codeql-dispatch-python-35754606100-1 contains py/incomplete-url-substring-sanitization at the endpoint assertion.
• Settlement itself is now proven to work on that unchanged fix(codeql): wake required jobs with the exchanged target app token #2040 head: producer settle exact required run job 106924536948 succeeded and required run 35706035119 advanced to attempt 2. The Actions receiver now consumes an authenticated SUCCESS verdict, while Python correctly consumes the authenticated producer FAILURE. Do not classify this current state as the earlier publication/re-entry defect.
• Source repair: 657d10402d4d502249423a85faa1f953542cd719.

Keep Draft until this exact head receives fresh terminal repository/security/CodeQL evidence and qualifying independent current-head review. After normal protected integration, #2040 and other affected branches must ordinary/non-force reconcile to the new protected main and reacquire their own exact-head evidence; predecessor failures/successes do not transfer.

No self-approval, force-push, destructive rebase, gate weakening, synthetic status, no-op wake commit, blind rerun, or broad CodeQL suppression.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Protected-main Python Security and this CodeQL repair form a foundation check-cycle with canonical AnyIO owner #2278. Draft integration successor #2352 exact f1a8dc813e6dba4e4905bf3e1b770b6d44344944 is an ordinary two-parent merge of #2278 exact 8a5251bf... and this exact 657d1040..., with a tree containing exactly the two parent-owned blobs and no third semantic delta.

Keep #2351 open while #2352 is unmerged. The integration PR is only the convergence/landing vehicle; this one-file source repair remains the semantic owner, and PR-0 is not satisfied until a verified successor normally reaches protected main with complete delta and fresh acceptance evidence.