You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(identity): publish a verified Dex security distribution - #5814
The shared sign-in broker needs a source-bound security correction before fresh adoption, including the portal's dedicated broker.
What
Build and publish a minimal, reviewed distribution with the dependency correction and verified secure connections. Keep runtime adoption as a separate reviewed change.
Evaluation at a4efba7c3861c47e870c6ef5c181558f6efba1d8, based on current main 84977ddd692110a9d7a1f9bc728531d085bb75e9:
Root-cause dependency correction is generated by Go and confined to the exact upstream release, with independent patch replay and a fixed patched-tree check. The selected dependency and scanner releases pass the normal age policy.
The complete Platform root Go suite passed before the base advance. After integration, the new base's 12 module-guard controls, all 11 module tidiness checks and changed merge-heal regressions pass. ShellCheck, Actionlint and the new command's vet/tests pass.
Actual upstream command/server/memory-store/OIDC tests pass with normal CGO. The new checker has observed RED controls for unexamined reports, new findings and changed primary advisory metadata. Its native paired control reaches the actual weaker-protocol check; SQLite, allowed/refused HTTPS and gRPC handshakes, certificate reload, wrong CA and wrong hostname controls pass.
Repeated native execution exposed a transient SQLite-journal/certificate-watch collision. Certificates and database files now occupy separate fixture directories; ten full repeated controls pass. Endpoint reservations and bounded fictional failure diagnostics are retained. Both earlier failed fixture attempts remain separate adverse evidence.
Linux workflow 41602208351/1 completed the actual musl-linked distribution build, scanner/native controls, non-root read-only container execution and packaged-byte recheck. Its publication job correctly stayed skipped on this PR. Wider CI remains a separate gate.
This is evaluation evidence, not an independent review, promotion, deployed adoption or portal activation. Raw scanner details remain private; the specific historical disposition is supported by primary ranges, source-fix ancestry and actual executable behavior. #5811 retains signed publication/admission, digest adoption and the real broker path; business-site #491 retains its dedicated customer scope.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
The change adds a patched, source-built Dex image and checks its executable, packaged files, and TLS behavior. A GitHub Actions workflow builds and verifies an image archive, then publishes that same archive on pushes to main with an SBOM, signature, and attestations. The documentation describes the image contents, admission checks, and the separate steps required to adopt the image at runtime.
Document the workflow permissions and include all identified inputs in its triggers before merging; otherwise the lint gate can fail, and input-only changes can go unverified.
Pre-merge checks: 4 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Docstring Coverage
Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…
Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title names the main change: publishing a verified Dex security distribution. The changeset adds a build script, a Dockerfile, a verify/publish workflow, a dependency patch bumping golang.org/x/ne…
Description check
The description states the purpose: a source-bound security correction for the shared sign-in broker, delivered as a minimal, reviewed distribution with a dependency correction and verified secure con…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: publishing a verified Dex security distribution. The changeset adds a build script, a Dockerfile, a verify/publish workflow, a dependency patch bumping golang.org/x/net to v0.60.0, and a binary checker that performs TLS and certificate validation. The title's conventional-commit 'fix(identity)' scope and the 'verified' wording fit the change. It is concise, specific, and free of file lists or vague terms.
Full details: Description check
Explanation
The description states the purpose: a source-bound security correction for the shared sign-in broker, delivered as a minimal, reviewed distribution with a dependency correction and verified secure connections. Runtime adoption is deferred to a separate change. These points match the changeset, which adds the Dex image build, the golang.org/x/net bump, and the TLS checks. The description is brief but specific enough to relate to the changes.
Full details: Docstring Coverage
Explanation
Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 14 functions across 4 files. (5 skipped: 5 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Additional context used
Code guidelines: 1
AGENTS.md — auto-discovered
Path-based instructions: 2
Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.
Source excerpt: Resources under `k8s/bases/infrastructure/` are **component-folder-first**: a component's HelmRelease/HelmRepository and its own CRs live together in a folder named after the component — `controllers//` in the con...
Re-evaluated a4b6dec7c1cc2719e9fe2306330c05d618f80988 after addressing both review findings:
CI 41611639250/1 and Linux image verification 41611639239/1 completed successfully. All 58 native contexts and eight matching workflows are settled; the publication job correctly stayed skipped on this PR.
The actual producer/consumer workflow regression was RED for a publish-only retry before repair. Both partial and full retry cases now select the producing job's exact archive. Hash and image identity checks remain required.
The previous certificate check incorrectly admitted a controlled stale-certificate build (RED). The repaired control requires both endpoints to present the renewed leaf under distinct trust, repeats the protocol/CA/hostname controls, and rejects retired trust. Linux CI builds this adversarial control separately, restores the source, then compiles the shipping executable.
Independently downloaded the resulting native image artifact (13219671231), verified its archive hash, image configuration and all 16 layers, inspected the packaged executable and passive source offer, and confirmed the source contains the restored upstream reloader. The actual executable still binds the reviewed compiler, upstream revision and dependency correction. Fresh scanner output is retained privately.
Assessed the ancillary static-analysis report against the implementation. Its file/process warnings concern explicitly selected build tools and generated disposable fixture paths, not request-controlled paths or a deployed service boundary. The fixture has bounded process, HTTP and TLS operations. The remaining reported close/context/style and documentation-permission observations do not invalidate these controls; no check was disabled or waived.
This is evaluation evidence, not substantive review, signed main publication, deployed adoption or portal activation. Both original review threads are resolved. #5811 and business-site #491 retain their remaining publication/admission/adoption obligations.
Evaluated signed head 2b998a52af4f99ffe8836b494be93bf8273b4ff1, integrated with main 7d38b1bce1f0612f84a9df1d1b115e7abab3aa3e:
The full root Go suite passes across 90 packages. All 11 tracked modules pass the actual tidiness command. Native TLS-floor, real certificate-renewal and deliberately stale-certificate controls pass in this round; the complete checker package took 6.445s.
Six parsed-workflow controls were independently RED for omitted checker-module and signing-installer inputs, then GREEN after fixing both event filters. The producing-attempt archive retry controls remain green. Publication permissions now document their consumers without changing the grants.
Actionlint, ShellCheck, changed-package vet, diff checks and installed Zizmor 1.31.1 offline validation pass. The ancillary file/process/context/style report was assessed against the bounded build-tool and disposable-fixture boundaries; no scanner or gate was disabled.
Hosted CI 41628212290/1 and native Linux image verification 41628212626/1 succeeded. The complete current-head census contains 58 settled successful/skipped contexts and eight successful workflows. The PR's image-publication job correctly stays skipped; this is not main publication or deployed adoption.
All four review threads are resolved. Fix confirmations and their empty reply-review containers are not a green substantive review of this head.
The portable review cycle is now at the second repaired head; any further findings must be assessed against the complete set under the convergence rule. #5811 and business-site #491 retain actual signed publication/admission/adoption. Portal activation remains separate and disabled.
Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 48 minutes.
CodeRabbit explicitly declined the current-head full-review request at 11:47:02 UTC: its included allowance is exhausted, with a stated 48-minute recovery window. Primary response: #5814 (comment). With the minute-window safety margin, do not retry before 12:36:02 UTC. No usage-based billing or credit reset is authorized.
The current-head no-gate guard returns ADMIT; this is not a review verdict. The ordered sequence advances to Codex, preserving all review and merge gates.
Readiness at 2b998a52af4f99ffe8836b494be93bf8273b4ff1, base 7d38b1bce1f0612f84a9df1d1b115e7abab3aa3e:
All eight exact-head workflow runs have succeeded, including CI and the actual Linux distribution verification. The latter built the real shipping executable and separate adverse control, exercised TLS and certificate renewal, scanned the resulting distribution, and retained its verified archive; PR publication was correctly skipped. Native checks are complete; CodeRabbit is neutral because of its explicitly reported allowance limit. Configured native code_quality remains UNVERIFIED, not waived; GitHub reports CLEAN.
Full comments, reviews, inline findings and four native threads were re-read: every reported finding is addressed and all four threads are resolved. Ordered review progressed only after CodeRabbit's explicit refusal. Codex's substantive current-head review is green, with its completed exact-head summary reporting no findings.
Actual native host controls independently observed allowed TLS, rejected lower protocols and incorrect trust/hostname, genuine certificate replacement, and refusal of the deliberately stale-certificate executable. All 90 root Go packages, all 11 module-tidy checks, six RED-before/GREEN-after workflow-selection controls and changed-file lint passed. This is distribution readiness; no production adoption or portal login is claimed.
Fresh holder read reports none, the isolated checkout is owned by this invocation and clean, and the reviewed head is unchanged. Promote this source-only prerequisite; keep production/queue admission separate while the independent platform recovery is unfinished. No health or deployment gate is waived.
Blocker cleared (re-verified 2026-11-04 15:20Z): the condition this PR waited on, #5853, merged at 08:01Z (#5843 closed as completed). Head 2b998a52af4f99ffe8836b494be93bf8273b4ff1 is CLEAN with all checks passing, 0 of 4 review threads unresolved and a clean Codex review at this head. The merge queue re-validates it against current main. #5852 stays open only for the separate workflow-enrolment item.
📝 Summary
---------------------
🔍 Total..........670
🔗 Unique.........453
✅ Successful.....535
⏳ Timeouts.........0
🔀 Redirected......12
👻 Excluded........92
❓ Unknown..........0
🚫 Errors..........40
⛔ Unsupported.....40
Errors in .github/workflows/ci.yaml
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 829:14) | Error (cached)
[404] https://get.helm.sh/$archive (at 1112:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 1566:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 4069:65) | Error (cached)
[404] https://get.helm.sh/$archive.sha256sum (at 4070:75) | Rejected status code: 404 Not Found
Errors in .github/workflows/copy-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 132:27) | Error (cached)
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 112:17) | Error (cached)
Errors in .github/workflows/measure-ci-runtime.yaml
[404] https://get.helm.sh/$archive (at 114:77) | Rejected status code: 404 Not Found
Errors in .github/workflows/prepare-email-storage-key.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 109:17) | Error (cached)
Errors in .github/workflows/publish-coroot-checkpoint-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-checkpoint-hotfix.yaml@refs/heads/main (at 212:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-coroot-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-node-agent-hotfix.yaml@refs/heads/main (at 248:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-dex-security-image.yaml
[404] https://devantler.tech/attestations/dex-build/v1 (at 153:82) | Rejected status code: 404 Not Found
[404] https://devantler.tech/attestations/dex-build/v1 (at 157:23) | Rejected status code: 404 Not Found
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-dex-security-image.yaml@refs/heads/main (at 155:20) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-kubescape-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-node-agent-hotfix.yaml@refs/heads/main (at 186:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-kubescape-storage-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-storage-hotfix.yaml@refs/heads/main (at 270:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-kyverno-background-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-background-hotfix.yaml@refs/heads/main (at 205:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-kyverno-migration-runtime.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-migration-runtime.yaml@refs/heads/main (at 187:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-kyverno-reports-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-reports-hotfix.yaml@refs/heads/main (at 183:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-private-mail-bootstrap.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-private-mail-bootstrap.yaml@refs/heads/main (at 127:37) | Rejected status code: 404 Not Found
Errors in .github/workflows/publish-release-recovery.yaml
[404] https://api.github.com/repos/$REPOSITORY/releases/generate-notes (at 192:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 257:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 97:14) | Rejected status code: 404 Not Found
Errors in .github/workflows/validate-coroot-security-progress.yaml
[ERROR] http://127.0.0.1:1/ (at 137:67) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 89:36) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 90:25) | Error (cached)
[ERROR] http://127.0.0.1:9090/ (at 130:80) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 135:66) | Error (cached)
[ERROR] http://127.0.0.1:9090/ (at 136:64) | Error (cached)
Errors in .github/workflows/verify-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 110:27) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 103:17) | Connection refused - server may be down or port blocked
Errors in .github/workflows/verify-email-storage-key-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 110:17) | Error (cached)
Errors in .github/workflows/verify-openbao-backup-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 114:17) | Error (cached)
Errors in docs/costs.md
[404] https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/#cloud-servers (at 24:27) | Rejected status code: 404 Not Found
Errors in scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html
[ERROR] error: (at 1:78) | Cannot resolve root-relative link '/': To resolve root-relative links in local files, provide a root dir
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/bundle.main.841ee8bbb7cc9d85b79e.css (at 1:536) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-16x16.png (at 1:401) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-32x32.png (at 1:336) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon.ico (at 1:450) | File not found. Check if file exists and path is correct
Errors in talos/control-planes/wireguard.yaml
[404] https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ (at 49:5) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ --[308]--> https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig
Hint: Followed 12 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 92 errors
h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
docs/adr/headless-cms.md:66:401 error MD013/line-length Line length [Expected: 400; Actual: 450]
docs/adr/headless-cms.md:67:401 error MD013/line-length Line length [Expected: 400; Actual: 457]
docs/crossplane-sync-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 427]
docs/crossplane-sync-recovery.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 577]
docs/dr/alerting.md:263:28 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:22:389 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:23:264 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:35 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:161 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:239 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:114 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:263 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:269 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it leaks"]
docs/dr/crypto-custody.md:276 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it is *lost* (no..."]
docs/dr/restore-drill.md:161 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:23:102 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:23:487 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:34 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:44 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:53 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:263 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:708:92 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/spire-server-ha.md:93 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/dr/velero-cnpg.md:11 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/github-management.md:38:401 error MD013/line-length Line length [Expected: 400; Actual: 419]
docs/github-management.md:40:401 error MD013/line-length Line length [Expected: 400; Actual: 522]
docs/node-autoscaling.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/oidc-kubectl.md:111 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/operations/email-client-identity.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/gateway-receiver-boundary.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/ingress-client-address.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/production-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 491]
docs/release-recovery.md:10:401 error MD013/line-length Line length [Expected: 400; Actual: 576]
docs/release-recovery.md:12:401 error MD013/line-length Line length [Expected: 400; Actual: 793]
docs/release-recovery.md:14:401 error MD013/line-length Line length [Expected: 400; Actual: 477]
docs/runtime-security.md:130 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/rwx-storage.md:38 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:60 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
k8s/bases/infrastructure/controllers/tetragon/README.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 505]
k8s/bases/README.md:10:141 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:39 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:138 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:91 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:207 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:9:234 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/judge-openbao-quorum/README.md:25:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
scripts/README.md:15:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:16:185 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:98 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:20:255 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
(Truncated to last 6666 characters out of 10096)
⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated.
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Why
The shared sign-in broker needs a source-bound security correction before fresh adoption, including the portal's dedicated broker.
What
Build and publish a minimal, reviewed distribution with the dependency correction and verified secure connections. Keep runtime adoption as a separate reviewed change.
Part of #5811