Repository navigation
Mechanical fixes from second audit pass - #59
Merged
Merged
Conversation
…icy fidelity, and resource hygiene Second audit pass (aska-digital/ion). Re-applies the still-valid fixes from the mimar audit that the rename did not carry over, plus one extension: - approve/core: count quorum actors case-insensitively so one identity cannot approve twice through case variants (relates to #27). - execute/base: validate every push refspec destination against the default branch and the ion/ prefix, not just the last; the broker only sees the last refspec's branch. - approve/bus: accept sync envelopes with seq null instead of crashing. - config: validate policy.branch_protection types at load instead of crashing mid-run. - analyze/policy: record unknown (not silence) for secret_scanning on private repos under a paid plan. - collect/github: drop the collaborators field from the GraphQL query and normalise; nothing consumes it. - collect/github: log a warning when the security-extras REST read fails instead of degrading silently. - fleet: clean the preview workdir in a finally block so a failing fixer does not leak full clones. Each fix carries a regression test that fails with the fix reverted.
This was referenced Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mechanical fixes from a second audit pass, now against
aska-digital/ion. Re-applies the still-valid fixes from the earliermimaraudit that the rename did not carry over, plus one extension. Each one has a test that fails without it.Changes
ion/approve/core.py(evaluate): quorum now counts approvers by lowercased actor. A bus seatAdaand a GitHub loginadapreviously counted as two approvers toward quorum. Relates to #27.ion/execute/base.py(safe_push): every refspec destination is checked against the default branch and theion/prefix, not just the last. The broker only sees the last refspec's branch, sogit push origin docs:refs/heads/docs ion/x:refs/heads/ion/xwould previously have pusheddocsas well.ion/approve/bus.py(sync_bus): a bus envelope withseq: nullno longer crashes the sync withint(None).ion/config.py:policy.branch_protectionsettings are validated at load (require_prboolean,required_approvalsinteger >= 0, and the rest). A typo likerequired_approvals: "many"previously crashed mid-run insidelowers_protection.ion/analyze/policy.py: a private repo on a paid plan now gets a secret-scanning finding ofunknowninstead of no finding at all. The conditional-expression-as-statement only recordedblocked_by_planon the free plan and silently skipped the rest.ion/collect/github.py: thecollaboratorsfield is dropped from the GraphQL query and fromnormalise. Nothing in the codebase reads it, so it was paying query cost against the API budget on every page for dead data.ion/collect/github.py(fetch_security_extras): a failed REST read now logs a warning with the repo name before returningNone. Previously a persistent 403 or rate limit degraded tosecret_scanning: "unknown"with no diagnostic anywhere.ion/fleet.py(preview): the preview workdir is removed in afinallyblock. A fixer that raised mid-loop previously leaked full repo clones under the work directory.Validation
pytest -q: 246 passed (239 existing, 7 new). Each new test was re-run with its fix reverted to confirm it fails.scripts/check_licenses.py: 0 not allowed.