From bb9ef6bc499d3eca842c7e7be6d45b69a04aebfe Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 04:58:23 +0000 Subject: [PATCH] Pin the native reader to the policy that registers the no-retries CI bytes 114ad7dc84e43661a1a667dcf21c6b3f60117b6c is the merge of #374, which adds the exact ci.yml/sonar.yml identities from #373 (Acquire::Retries "0" before setup-php, CVE-2026-109518). The reader stays at 4ad153a3 until this moves, so #373 is still refused. Between the two refs the only validator change is that registry entry; native_policy_check.py, qualification_policy.py and requirements.lock are unchanged. Refs #295 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/native-policy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/native-policy.yml b/.github/workflows/native-policy.yml index d908918..00b1a2d 100644 --- a/.github/workflows/native-policy.yml +++ b/.github/workflows/native-policy.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: durable-workflow/.github - ref: 4ad153a3c32cac712177c2241bc9f8f256dbbc86 + ref: 114ad7dc84e43661a1a667dcf21c6b3f60117b6c path: .native-policy-control persist-credentials: false - name: Set up the policy interpreter