chore(restack): adopt protected auth baseline into CI concurrency controls - #312
Conversation
* fix(auth): fail closed without write-capable admin on public bind * fix(auth): reject unusable bootstrap credentials * fix(auth): reject header-ambiguous admin secrets * docs(security): record research redistribution assessment * test(auth): strengthen strict admin-token properties * test(auth): mirror strict admin-token rejection in fuzz target * test(auth): keep fuzz role semantics in sync * test(auth): property-check credential and RBAC boundary * test(auth): exercise fuzz invariants for arbitrary bytes * fix(auth): align health and write denial auth semantics * test(auth): reject fixed smoke administrator credential * fix(auth): mint ephemeral smoke administrator credential * docs(security): preserve fail-closed auth traceability * test(auth): bind smoke token generation to forwarding * docs(auth): retain redistributable NIST SSDF evidence * docs(auth): preserve external-secret deployment lifecycle after restack * docs(security): reconcile NIST artifact provenance --------- Co-authored-by: OpenAI Codex <codex@openai.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
Non-force reverse-direction adoption only. Protected/default
mainis exactf8260f1e03836039ff9463dd99fa982e4e270c4b; #166 remains oncodex/skip-draft-ci@e00d61c994d3b1c2b7923bb1b781c1e06d32aae4with historical protected basea52ccd0.... Adopt protected #155 into the Wardnet CI/Fuzz bounded lane without copying organization-owned workflow authority or changing #166's source-head/concurrency semantics. No force/rebase, gate weakening, no-op dispatch, or new feature delta. Predecessor #166 evidence becomes historical after merge.