Skip to content

chore(foundation): converge AnyIO and CodeQL endpoint repairs #2352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seonghobae wants to merge 14 commits into
base: main
Choose a base branch
from
Draft

chore(foundation): converge AnyIO and CodeQL endpoint repairs #2352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
a83d6d3
fix(security): allowlist https://api.github.com before urllib urlopen
seonghobae Sep 18, 2026
225260a
test(security): pin GitHub API redirect credential boundary
seonghobae Sep 18, 2026
0ae2204
fix(security): contain GitHub API redirects to admitted origin
seonghobae Sep 18, 2026
062663a
test(security): pin Strix redirect credential boundary
seonghobae Sep 18, 2026
2708a6b
fix(security): contain Strix GitHub API redirects
seonghobae Sep 18, 2026
3758b89
chore(deps): bump anyio from 4.14.0 to 4.14.2
dependabot[bot] Sep 18, 2026
4dcd25c
test(security): align Strix transport seam with dedicated opener
seonghobae Sep 19, 2026
834d285
test(security): bind authenticated openers at owned seams
seonghobae Sep 19, 2026
6d10002
merge(security): carry #2269 urllib GitHub API opener into #2278
seonghobae Sep 19, 2026
545648e
chore(deps): isolate AnyIO security owner delta
seonghobae Sep 19, 2026
c51c8d2
merge: carry AnyIO lock update onto protected owner
seonghobae Sep 19, 2026
8a5251b
fix(deps): restore AnyIO owner isolation
seonghobae Sep 20, 2026
657d104
repair(codeql): restore exact endpoint-set assertion
seonghobae Sep 23, 2026
f1a8dc8
chore(foundation): converge dependency and CodeQL repairs
seonghobae Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions requirements-strix-ci-hashes.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,9 +140,9 @@ annotated-types==0.7.0 \
--hash=sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53 \
--hash=sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89
# via pydantic
anyio==4.14.0 \
--hash=sha256:b47c1f9ccf73e67021df785332508f99379c68fa7d0684e8e3492cb1d4b23f89 \
--hash=sha256:dd9b7a2a9799ed6552fde617b2c5df02b7fdd7d88392fc48101e51bae46164d9
anyio==4.14.2 \
--hash=sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494 \
--hash=sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f
# via
# google-genai
# gql
Expand Down
8 changes: 5 additions & 3 deletions tests/test_organization_commercial_readiness_loop_receipt_contract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,9 @@ def test_json_receipt_is_retained_as_an_immutable_short_lived_artifact() -> None
assert "if-no-files-found: error" in source
assert "retention-days: 3" in source
endpoints = _harden_runner_allowed_endpoints(source)
assert "results-receiver.actions.githubusercontent.com:443" in endpoints
assert "*.actions.githubusercontent.com:443" in endpoints
assert "*.blob.core.windows.net:443" in endpoints
assert {
"results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443",
"*.blob.core.windows.net:443",
}.issubset(endpoints)
assert "- name: Checkout exact trusted coordinator source" not in endpoints
Loading