fix: autorelease unattended hardening - #27

Merged

loadinglucian merged 30 commits into

mainfrom

fix/autorelease-unattended-hardening

Aug 3, 2026

Commits on Aug 3, 2026

feat: derive maintained branches from support snapshot in plugin
loadinglucian
committed
b121f0c
fix: restore policy.lua via cleanup trap in plugin test
loadinglucian
committed
ec66bfd
feat: reject snapshot diffs with stale policy.lua
loadinglucian
committed
06fc525
fix: require the generated policy.lua path in admitted plans
loadinglucian
committed
8e30907
fix: check snapshot and policy.lua agreement for either diff path
loadinglucian
committed
eb188df
feat: admit trusted automation readiness records without owner review
loadinglucian
committed
ae1b3a5
fix: bind readiness exemption to the merged commit and a single-file diff
loadinglucian
committed
f32a6c4
fix: match php-bin secret patterns in admission diff scanning
loadinglucian
committed
438a701
fix: protect gate harness scripts and tests from admitted patches
loadinglucian
committed
066c424
fix: restore schema validator parity with php-bin
loadinglucian
committed
fdfde26
refactor: unify merge admission check assertions in one script
loadinglucian
committed
c70b01e
fix: correct admission assert rationale and cover check-name path
loadinglucian
committed
0ee8d82
refactor: emit agent task criteria from one script
loadinglucian
committed
9c3a36b
feat: gate consumer runs on shared-file parity with php-bin
loadinglucian
committed
39816b0
fix: fail closed when the shared-file manifest is empty or unreadable
loadinglucian
committed
7b57c35
refactor: reuse canonical action filename helper
loadinglucian
committed
90e4f08
chore: run every workflow step under bash with pipefail
loadinglucian
committed
962ceb4
fix: name the shared file php-bin returned unencoded
loadinglucian
committed
10ff764
refactor: drop the local event scan from the policy comparison
loadinglucian
committed
4e228be
refactor: check public language over tracked files with one tool
loadinglucian
committed
99baf61
fix: compare admission paths case-sensitively
loadinglucian
committed
a6bafa2
refactor: drop the plan field no consumer step reads
loadinglucian
committed
87f3088
fix: gate the merge job on a validation outcome, not a job result
loadinglucian
committed
5d3fa6c
fix: keep the rejected seal when a repair replaces it
loadinglucian
committed
d2d7b30
test: cover the merge admission entry point end to end
loadinglucian
committed
fd3d9cd
fix: fail the public-language check when it lists no files
loadinglucian
committed
96779e0
fix: set the validate output only after its artifact uploads
loadinglucian
committed
1c48c2f
docs: scope the notification claim and document unattended lifecycle
loadinglucian
committed
3c0a825
docs: name a published version in the still-installs promise
loadinglucian
committed
d82c70c
fix: group the grep tolerance so the listing failure stays fatal
loadinglucian
committed
55ba456

Navigation Menu

Uh oh!

fix: autorelease unattended hardening - #27

fix: autorelease unattended hardening#27
loadinglucian merged 30 commits into
mainfrom
fix/autorelease-unattended-hardening

Commits on Aug 3, 2026

feat: derive maintained branches from support snapshot in plugin

fix: restore policy.lua via cleanup trap in plugin test

feat: reject snapshot diffs with stale policy.lua

fix: require the generated policy.lua path in admitted plans

fix: check snapshot and policy.lua agreement for either diff path

feat: admit trusted automation readiness records without owner review

fix: bind readiness exemption to the merged commit and a single-file diff

fix: match php-bin secret patterns in admission diff scanning

fix: protect gate harness scripts and tests from admitted patches

fix: restore schema validator parity with php-bin

refactor: unify merge admission check assertions in one script

fix: correct admission assert rationale and cover check-name path

refactor: emit agent task criteria from one script

feat: gate consumer runs on shared-file parity with php-bin

fix: fail closed when the shared-file manifest is empty or unreadable

refactor: reuse canonical action filename helper

chore: run every workflow step under bash with pipefail

fix: name the shared file php-bin returned unencoded

refactor: drop the local event scan from the policy comparison

refactor: check public language over tracked files with one tool

fix: compare admission paths case-sensitively

refactor: drop the plan field no consumer step reads

fix: gate the merge job on a validation outcome, not a job result

fix: keep the rejected seal when a repair replaces it

test: cover the merge admission entry point end to end

fix: fail the public-language check when it lists no files

fix: set the validate output only after its artifact uploads

docs: scope the notification claim and document unattended lifecycle

docs: name a published version in the still-installs promise

fix: group the grep tolerance so the listing failure stays fatal