Repository navigation
Pin the native reader to the policy that registers the no-retries CI bytes - #375
Merged
Merged
Conversation
…bytes 114ad7d is the merge of #374, which adds the exact ci.yml/sonar.yml identities from #373 (Acquire::Retries "0" before setup-php, CVE-2026-109518). The reader stays at 4ad153a until this moves, so #373 is still refused. Between the two refs the only validator change is that registry entry; native_policy_check.py, qualification_policy.py and requirements.lock are unchanged. Refs #295 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Member
Author
|
Security PASS at bb9ef6b (CI 9 green). One line: the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #295. Third step of the staged change: #374 merged, then this PR, then #373. It's the same one-line pattern as #365 and #366.
native-policy.ymlchecks out the reviewer at a pinned ref and reads the reviewed-bytes registry from it. The pin is still4ad153a3, the merge of #364, which predates #374. SoValidate native policy subjectkeeps refusing #373 (run 43368725978):Protected pilot requires closed literal commands or exact reviewed workflow bytes.Change: one line. The reviewer checkout ref moves from
4ad153a3…to114ad7dc84e43661a1a667dcf21c6b3f60117b6c, the merge of #374.What else moves with the ref (
4ad153a3..114ad7dc, files underscripts/andqualification/):protected_policy_context.py: +7 lines, the Register the no-retries CI and Sonar workflow bytes #374 registry entry.php_linux_upstream_pins.py: new file from Check daily that pinned php-ubuntu assets are still published (#358) #369, not used by the native check.qualification/php-linux-bootstrap.jsonremoved andREADME.mdedited, from Pin only the PHP archives setup uses #371.native_policy_check.py,qualification_policy.pyandqualification/requirements.lockare unchanged.Checked locally against 114ad7d's
protected_policy_context.validate_context:ci.ymlandsonar.yml(headdb27d1c8) are accepted.native-policy.ymlis accepted as closed literal commands.This PR's own run of the check uses the new ref, because
pull_requestruns the workflow from the PR. After it merges, re-run #373's check.🤖 Generated with Claude Code