chore(stack): sync digest provider root with protected main - #385
Conversation
Non-destructively retain the canonical #299 two-file CI/TDD delta while inheriting protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e, including the v0.6.0 release exact-checkout repair. No release identity or protected-main state is changed.
…ive-overrides-20260820 fix(security): raise transitive dependency floors
- Add set -euo pipefail and fail-closed registry lookups (npm, PyPI isolated mode with explicit public index) - Add open-issue queue query excluding PR duplicates; refresh candidate PR set to the live open queue - Paginate REST file/review/check-run calls and GraphQL reviewThreads beyond the first 100 results
…tes-298 fix(ci): run exact-head gates on stacked pull requests
…al-gap-baseline-20260820 docs: add product-technical gap baseline
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
09f941c
into
fix/digest-provider-preflight-221
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| blockExoticSubdeps: true | ||
| minimumReleaseAge: 10080 | ||
| trustPolicy: no-downgrade | ||
| trustPolicyIgnoreAfter: 43200 |
There was a problem hiding this comment.
🔍 New pnpm supply-chain policy keys depend on pnpm version support
pnpm-workspace.yaml adds blockExoticSubdeps, minimumReleaseAge, trustPolicy, and trustPolicyIgnoreAfter. The minute values (10080, 43200) match the documented 7-day and 30-day windows. Worth confirming the pinned pnpm version recognizes these keys; an unrecognized key can be silently ignored, weakening the intended protection.
Was this helpful? React with 👍 or 👎 to provide feedback.
| function assertPathInsideConsumer(resolvedPath, description) { | ||
| const relativePath = relative(verificationDirectory, resolvedPath); | ||
| const canonicalConsumerDirectory = realpathSync(verificationDirectory); | ||
| const canonicalResolvedPath = realpathSync(resolvedPath); | ||
| const relativePath = relative( | ||
| canonicalConsumerDirectory, | ||
| canonicalResolvedPath, | ||
| ); | ||
| assert.equal( | ||
| isAbsolute(relativePath), | ||
| false, |
There was a problem hiding this comment.
📝 Info: Containment checks canonicalize both sides before comparing
The verifiers now realpath both the consumer root and the resolved path before computing relative(). This fixes a macOS case where the tmpdir symlink (/tmp -> /private/tmp) made a contained path look like an escape because only one side was canonicalized. The ESM generated code also asserts containment before await import(...), so an escaped entry is rejected before execution.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
| pull_request: | ||
| branches: [main] | ||
|
|
There was a problem hiding this comment.
📝 Info: pull_request trigger now runs on all base branches
Removing branches: [main] from the pull_request trigger makes CI run for PRs against any base branch, enabling exact-head CI for stacked PRs. The push trigger stays scoped to main. Consistent with the new workflow tests.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Non-destructive stack maintenance only. Merge exact protected
main@fd75c835a2a7c5d9a1f57c3e080364237d69819aintofix/digest-provider-preflight-221so the canonical #222 root inherits current protected-main workflow/contracts, including stacked-PR CI trigger semantics from merged #299. No feature ownership transfer; #222 remains the source owner for its five digest-provider paths.