Repository navigation
ci: refuse patch-fragment source files; security policy timelines - #596
Merged
Merged
Conversation
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters (2)
📒 Files selected for processing (33)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
hyperpolymath
changed the title
Rescue of the D37 phase-zero recovery commit 632b54a (2026-08-24), rebuilt on main. main had independently superseded everything else in it (pins, actions.lock, permissions, the fixer.rs restoration, the hypatia.rs refactor, the 6a2 -> descriptiles move). What remains: - repo-integrity-guard: fail when a tracked source file begins with patch syntax (@@, *** Begin Patch, diff --git), the way fixer.rs was once a 14-line patch fragment. - .gitignore: ignore .claude/worktrees/ so an agent worktree cannot be committed as a gitlink again. - SECURITY.md: reporting timelines, supported versions, safe harbour; keeps the pointer to SECURITY.adoc. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014BxjiTAaTZCHVWn2U5NWhL
hyperpolymath
force-pushed
the
rescue/d37-phase-zero-recovery
branch
from
October 7, 2026 10:01
f1ea64c to
d19776e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR is a rescue of the D37 phase-zero recovery commit
632b54a(2026-08-24), rebuilt as the single commitd19776eonmain(the original commit left the branch so GitGuardian no longer sees its test-canary password; kept locally inrefs/rescued/pr596/).mainhad independently landed most of the original work, so every one of the 33 conflicts resolves tomain's version:actions.lockand permissions edits (e-pin the estate reusables to the last accepted standards ref #550–fix(ci): resync actions.lock and add a lock-sync recurrence gate #566, fix(ci): lock entry points at the commit, not the tag object #594);fixer.rsrestoration. At the old base that file was a 14-line malformed patch fragment;76ac79donward restored it;hypatia.rs?refactor;6a2/→descriptiles/move. A2ML is retired, so it is not re-homed;api.adocdeletion (feat(echidnabot): pinned sync from hyperpolymath/echidnabot + drift gate [mass-delete-ok] #586).Net change against
main, 3 files:repo-integrity-guard.yml: a new step, Source files must not be patch fragments. It fails when a tracked*.rs/ex/exs/res/js/ts/py/shfile starts with@@,*** Begin Patchordiff --git. That is exactly howfixer.rswas broken..gitignore: ignores.claude/worktrees/, so an agent worktree can't be committed as a gitlink again. That had happened withactions-policy, whichmainhas since dropped.SECURITY.md: adds reporting expectations (acknowledgement within 48 hours, assessment within 7 days, 90-day coordinated disclosure), a supported-versions statement and a safe-harbour clause. It keepsmain's pointer toSECURITY.adoc, which has none of these.Closes: none
Type of change
main.SECURITY.md)📌 New pins
Head SHA:
d19776e. This PR adds or changes no pins. Everyuses:ref andactions.lockentry ismain's, byte for byte.How has this been verified?
git diff --stat origin/main d19776eshows 3 files changed, +41/−10, and nothing else.planted_frag.rsstarting with@@ -1,2 +1,2 @@and staged it with intent-to-add. The guard reported::error file=planted_frag.rs::Source file begins with patch syntaxwith rc=1. The planted file was then removed.actionlint .github/workflows/repo-integrity-guard.ymlwas clean.grepofSECURITY.adocfor hour/day/harbour/disclosure/acknowledge found nothing, so theSECURITY.mdadditions are not duplicates.Checklist
git commit -S).d19776eshowsG.main. The repo's CI ond19776eis the check, and I ran the guard step locally (above).SPDX-License-Identifier. There are no new files;SECURITY.mdkeeps its existingMPL-2.0header.Notes for reviewers
SECURITY.mdresponse-time commitments are the owner's text from632b54a, kept verbatim.🤖 Generated with Claude Code
https://claude.ai/code/session_014BxjiTAaTZCHVWn2U5NWhL