feat: PR security checks — suspicious paths, committer identity, auto-merge override#1109

Merged

myakove merged 15 commits into

mainfrom

feat/issue-1106-pr-security-checks

Jun 10, 2026

Commits on Jun 10, 2026

feat: PR security checks — suspicious paths, committer identity, auto-merge override
myakove
committed
feat: add mandatory security checks, /security-override command, required status checks
myakove
committed
fix: address Qodo findings
myakove
committed
fix: expand auto-merge override, add config sanitization tests, document global-only security
myakove
committed
fix: re-raise CancelledError in disable_automerge, validate mandatory flag
myakove
committed
fix: respect security-override label in auto-merge override
myakove
committed
fix: avoid 'token' keyword in log message triggering sensitive data mask
myakove
committed
refactor: replace security-override label with check run pass, restore 3-level config
myakove
committed
fix: use latest check run to prevent override bypass via stale checks
myakove
committed
fix: prevent stuck security checks and auto-merge comment spam
myakove
committed
refactor: merge duplicate override output dicts in issue_comment_handler
myakove
committed
fix: validate security_mandatory as boolean and check comment author in dedup
myakove
committed
fix: use all API users for auto-merge comment dedup to handle token rotation
myakove
committed
Merge branch 'main' into feat/issue-1106-pr-security-checks
myakove
authored
fix: validate committer-identity-check boolean + guard security-override when no checks enabled
myakove
committed