Repository navigation
maintenance: bind fixture reads and refresh artifact action pins - #291
Closed
erikleblansch wants to merge 2 commits into
Closed
erikleblansch wants to merge 2 commits into
erikleblansch wants to merge 2 commits into
Conversation
erikleblansch
added a commit
that referenced
this pull request
Oct 20, 2026
…ts (#292) File readers in the private-task and Cloud SDK fixtures checked a pathname before reopening it, allowing substitution between validation and reading. They now open with no-follow/nonblocking flags, validate the descriptor, perform bounded reads and close it reliably, with focused regression coverage. This maintenance change also updates the reviewed upload-artifact action pin and both exact contract assertions, pins a compatible signed Ubuntu Protobuf compiler/library family, and composes HPKE 0.14.1 plus zeroize 1.9.1 across the workspace and standalone fuzz lockfiles. It retains disabled optional algorithms, exact protected-admission validation, source checks and runner restrictions. The HPKE provenance version is updated; license texts are unchanged. The dependency updates cover #221–#224 and the action update covers #220. This candidate contains the complete commit history of #291 and adds the corrected helper artifact assertion discovered by its final harness check. Those predecessors remain preserved until this complete candidate passes and is integrated. Validation: independent security/dependency reviews; registry archives and upstream provenance checked; unchanged licenses and Rust 1.85 requirements; focused descriptor tests, 64 inert protected-admission tests, exact workflow-literal checks, shell syntax and diff checks pass. Previous hosted source checks passed Rust tests, Clippy, audits and all CodeQL analyses but exposed the stale helper artifact assertion. Full hosted validation is required on this final commit. This does not claim VM, model or datapath acceptance.
Contributor
Author
|
Superseded by #292, merged at 3cac793. The replacement contains the complete descriptor-read and CI-pin changes from this PR, plus the final contract correction and coherent dependency locks. Quality run 39465279385 and all four CodeQL analyses in run 39465269032 passed on fe9d662; the merged source tree is identical. Original failed runs and branch history remain available. This closure does not claim VM, model or datapath acceptance. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
File validation and reads now use the same bounded descriptor, closing it on every path. Existing size, ownership, digest and privacy checks remain in place.
Validation: 5 focused/adjacent Node tests passed using the existing workspace Node runtime; syntax and whitespace checks passed. The exact artifact-pin contract adds 14 passing Python checks. Hosted source and CodeQL checks are pending. These tests do not establish application, native decoder, private-worker or network acceptance.
Updates actions/upload-artifact to the verified full v7.0.2 commit pin, preserving workflow permissions and artifact boundaries. Supersedes the old pin-only Dependabot PR only after this change is verified and integrated.