fix(security): bind repository scanners to exact PR head - #799

Open

seonghobae wants to merge 26 commits into

mainfrom

fix/security-scan-exact-head

Commits on Aug 7, 2026

test(security): require literal PR-head scanner checkout

seonghobae
authored and
pr-auto-rebase[bot]
committed
1a25b12
ci(security): execute exact-head scanner contract

seonghobae
authored and
pr-auto-rebase[bot]
committed
7d20fb7
test(security): require literal-head SARIF attribution

seonghobae
authored and
pr-auto-rebase[bot]
committed
e75172d
fix(security): scan and publish literal PR-head evidence

seonghobae
authored and
pr-auto-rebase[bot]
committed
a7028f2
ci(security): verify exact-head checkout and SARIF contracts

seonghobae
authored and
pr-auto-rebase[bot]
committed
115b2fc
docs(security): record literal-head scanner evidence

seonghobae
authored and
pr-auto-rebase[bot]
committed
fc37844
docs: record exact-head security scanner repair

seonghobae
authored and
pr-auto-rebase[bot]
committed
323c07b
test(security): prove unavailable dependency review fails closed
seonghobae
committed
682088b
test(security): execute dependency-review fail-closed contract
seonghobae
committed
2d1603f
fix(security): fail closed on unavailable dependency review
seonghobae
committed
7c0b6f9
docs(security): document fail-closed dependency review evidence
seonghobae
committed
3c1653a
docs(security): record dependency-review fail-closed gate
seonghobae
committed
5996f89
test(security): accept explicit unavailable-status diagnostic
seonghobae
committed
dfa2878
docs(security): surface exact-head scanner operator contract
seonghobae
committed
a5f39a4
test: require bounded body-discarding dependency probe
seonghobae
committed
acc0da8
chore(security): stage bounded dependency-review probe
seonghobae
committed
c395c0f
fix(security): bound dependency-review support probe
seonghobae
committed
3ccb616
chore(security): remove staged timeout patch artifact
seonghobae
committed
e7690e3
chore(ci): stage bounded PR 799 repair
seonghobae
committed
4dfde68
ci: bootstrap verified PR 799 repair
seonghobae
committed
3a382eb
fix(ci): reap fatal review process groups
github-actions[bot]
committed
3ff61fd
chore(stack): isolate exact-head scanner repair on current main
seonghobae
committed
e4b7f0c
chore(ci): restage bounded PR 799 repair
seonghobae
committed
667e9dd
ci: rerun verified PR 799 repair
seonghobae
committed
6732b24
chore(ci): remove temporary PR 799 repair workflow
seonghobae
committed
9ad6b70
chore(ci): remove encoded PR 799 repair payload
seonghobae
committed
a6cd746

Navigation Menu

Uh oh!

fix(security): bind repository scanners to exact PR head - #799

fix(security): bind repository scanners to exact PR head#799
seonghobae wants to merge 26 commits into
mainfrom
fix/security-scan-exact-head

Commits on Aug 7, 2026

test(security): require literal PR-head scanner checkout

ci(security): execute exact-head scanner contract

test(security): require literal-head SARIF attribution

fix(security): scan and publish literal PR-head evidence

ci(security): verify exact-head checkout and SARIF contracts

docs(security): record literal-head scanner evidence

docs: record exact-head security scanner repair

test(security): prove unavailable dependency review fails closed

test(security): execute dependency-review fail-closed contract

fix(security): fail closed on unavailable dependency review

docs(security): document fail-closed dependency review evidence

docs(security): record dependency-review fail-closed gate

test(security): accept explicit unavailable-status diagnostic

docs(security): surface exact-head scanner operator contract

test: require bounded body-discarding dependency probe

chore(security): stage bounded dependency-review probe

fix(security): bound dependency-review support probe

chore(security): remove staged timeout patch artifact

chore(ci): stage bounded PR 799 repair

ci: bootstrap verified PR 799 repair

fix(ci): reap fatal review process groups

chore(stack): isolate exact-head scanner repair on current main

chore(ci): restage bounded PR 799 repair

ci: rerun verified PR 799 repair

chore(ci): remove temporary PR 799 repair workflow

chore(ci): remove encoded PR 799 repair payload