fix(codeql): wake required jobs with the exchanged target app token - #2040

Open

seonghobae wants to merge 144 commits into

mainfrom

fix/codeql-wake-target-app-token

Commits on Sep 5, 2026

test(codeql): reproduce rerun dead-end after pre-runner cancellation
seonghobae
committed
4c62031
fix(codeql): recover reruns with no dispatch verdict
seonghobae
committed
fabc998
docs(codeql): trace pre-runner rerun recovery evidence
seonghobae
committed
e47de34
chore(codeql): restack rerun recovery on protected main
seonghobae
committed
db15e4c
chore(codeql): adopt latest verification guidance without force restack
seonghobae
committed
9691960
docs(codeql): align ADR with evidence-driven rerun recovery
seonghobae
committed
67a6bc9
merge(main): adopt concurrent CI governance deltas
seonghobae
committed
510e337
chore(codeql): adopt latest protected main
seonghobae
committed
0599331
chore(codeql): adopt protected main into rerun recovery
seonghobae
committed
2d4624a

Commits on Sep 6, 2026

Commits on Sep 7, 2026

fix(codeql): require preserved SARIF before terminal publication

seonghobae
and
codex
committed
b966f82
fix(codeql): verify live base before consuming terminal verdicts

seonghobae
and
codex
committed
8c11d86
test(codeql): bind rerun recovery fixture to live base

seonghobae
and
codex
committed
3d8a8b6
fix(codeql): require preserved SARIF before status
seonghobae
committed
82ca0b8
merge(codeql): integrate canonical SARIF publication guard

seonghobae
and
codex
committed
8c4fd55
fix(codeql): bind terminal verdict receipt to base
seonghobae
committed
1a5957b
test(codeql): prove old-base receipt redispatch
seonghobae
committed
4b025af
test(scheduler): reproduce central Actions credential leakage
seonghobae
committed
8cc62ce
fix(scheduler): scope Actions credentials by run host
seonghobae
committed
7bf3451
test(scheduler): reproduce workflow-token mutation fallback
seonghobae
committed
ebcc671
fix(scheduler): prove workflow-starting mutation token
seonghobae
committed
e2204ee
test(ci): reproduce missing stacked Python and runtime checks
seonghobae
committed
890bac2
fix(ci): cover stacked Python and runtime reviews
seonghobae
committed
14f7c85

Commits on Sep 8, 2026

fix(codeql): settle exact multi-language reruns
seonghobae
committed
51c9df5
Merge protected main into scheduler repair stack
seonghobae
committed
a7ff488
Merge updated scheduler stack parent into #2003
seonghobae
committed
8842c44
Merge updated scheduler stack parent into #2004
seonghobae
committed
f6b6a4a
test(scheduler): align cancellation doubles with host-scoped runner
seonghobae
committed
b18b7ca
test(scheduler): prove workflow-starting credentials in fixtures
seonghobae
committed
7f32c68
Merge updated #2002 test contract into #2003
seonghobae
committed
71e7678
Merge updated #2003 scheduler fixture contract into #2004
seonghobae
committed
9fb02c9
fix(codeql): bind self-status to exact handler evidence
seonghobae
committed
b9b98cf
fix(codeql): harden self-repository fallback provenance
seonghobae
committed
3349848
test(codeql): reject HTTP-successful untrusted status creator
seonghobae
committed
23cc2df
fix(codeql): authenticate published status creator
seonghobae
committed
af8334e
test(codeql): return authenticated status creators in fixtures
seonghobae
committed
c1351dc
merge(main): replace unauthenticated CodeQL fallback with provenance contract
seonghobae
committed
61b88b8
fix(codeql): bind exact dispatch settlement evidence
seonghobae
committed
1a3133f
test(codeql): reproduce mixed-verdict settlement gap
seonghobae
committed
e25800f
fix(codeql): retain complete mixed-verdict settlement identity
seonghobae
committed
ef5ef47
test(codeql): require complete direct-evidence pagination
seonghobae
committed
86898d3
fix(codeql): paginate direct settlement evidence
seonghobae
committed
df35cfe
fix(test): repair CodeQL pagination shim syntax
seonghobae
committed
211b763
fix(test): repair CodeQL settlement shim syntax
seonghobae
committed
0764ac2
fix(codeql): integrate complete producer evidence
seonghobae
committed
4da013b
fix(codeql): preserve producer source across handler advances
seonghobae
committed
49fd5fe
fix(codeql): select the unique evidence-complete handler
seonghobae
committed
ccd4dd3
test(codeql): prove App receipts require producer evidence
seonghobae
committed
e9589ed
fix(codeql): authenticate App receipts with dispatch evidence
seonghobae
committed
e9c69e1
test(codeql): bind App receipts to exact evidence
seonghobae
committed
3ca05c3
fix(codeql): recover live base and reject receipt ambiguity
seonghobae
committed
e07e8fd
test(codeql): complete successor evidence fixtures
seonghobae
committed
723d1c3
test(codeql): reproduce stale-base and receipt ambiguity cycles
seonghobae
committed
48baf18
fix(codeql): converge mixed handler settlement
seonghobae
committed
2b60f0e
fix(codeql): integrate live-base and receipt ambiguity repair
seonghobae
committed
855f017
fix(codeql): wake required jobs with the exchanged target app token
seonghobae
committed
0a1ebb1
fix(codeql): reconcile attempt-wide base settlement
seonghobae
committed
87228f9
test(codeql): cover denied wake credential fallback
seonghobae
committed
afc477c
fix(codeql): retry wake with configured credentials
seonghobae
committed
b75ab70
fix(codeql): try every wake credential before succeeding a clean scan
seonghobae
committed
459af0c
fix(codeql): require predecessor language-gate evidence
seonghobae
committed
7ca416e
test(codeql): cover wake read credential fallback
seonghobae
committed
eacf5e1
fix(codeql): retry wake identity reads
seonghobae
committed
ba1781a
merge: integrate remote wake credential retry
seonghobae
committed
1a863ac
merge: integrate remote wake identity-read retry history
seonghobae
committed
c035e48
fix(codeql): keep post_wake for rerun and retry identity reads
seonghobae
committed
11f4bd9
fix(codeql): recover attempt after base advance
seonghobae
committed
ebf054e
test(codeql): require dispatch validation for App receipts
seonghobae
committed
acea6d9
fix(codeql): authenticate App dispatch validation
seonghobae
committed
27fdc97
docs(codeql): bind validation RED to published commit
seonghobae
committed
fe8b73e
test(codeql): reproduce late base-advance deadlock
seonghobae
committed
b924580
fix(codeql): recover forward base advance during handler scan
seonghobae
committed
3c8da48
fix(codeql): bound terminal recovery
seonghobae
committed
4566b15
fix(codeql): report ambiguous evidence
seonghobae
committed
e092426
test(codeql): expose dispatch payload limit
seonghobae
committed
310e9e6
fix(codeql): accept bounded rerun request payload
seonghobae
committed
e28d7c6
fix(codeql): bound repository dispatch payload
seonghobae
committed
80c139c
test(codeql): bind nested rerun request
seonghobae
committed
2117695
test(codeql): require nested rerun payload parsing
seonghobae
committed
da98bdc
docs(codeql): record dispatch payload RCA
seonghobae
committed
f0562e8
docs(codeql): bind payload limit evidence
seonghobae
committed
9307973
test(codeql): fail when clean scan cannot wake exact shard
seonghobae
committed
ff2f7ab
test(codeql): close receipt review gaps
seonghobae
committed
aed803d
fix(codeql): fail closed when exact shard wake is not accepted
seonghobae
committed
e17d1e7
test(codeql): require versioned dispatch head envelope
seonghobae
committed
e7f893a
fix(codeql): accept versioned dispatch head envelope
seonghobae
committed
e99cce8
test(codeql): reject unversioned head envelope
seonghobae
committed
57b944e
fix(codeql): require head envelope schema
seonghobae
committed
4955a8b
test: execute versioned codeql head envelope
seonghobae
committed
0caa75a
test(codeql): execute versioned head envelope path
seonghobae
committed
5e65ab5
test: reject non-string CodeQL head schema
seonghobae
committed
77c3dcb
fix: validate CodeQL head envelope types
seonghobae
committed
7cab524
test(codeql): expose cross-channel producer ambiguity
seonghobae
committed
1ed0ca8
fix(codeql): unify authenticated verdict evidence
seonghobae
committed
9b84832
test(codeql): expose wake credential shadowing
seonghobae
committed
da1cbe5
fix(codeql): preserve wake credential fallback
seonghobae
committed
8cb0a28
docs(codeql): bind verdict and wake evidence
seonghobae
committed
2f3ff51
test(codeql): require nested rerun envelope compatibility
seonghobae
committed
5761a2b
merge: preserve CodeQL envelope base repair
seonghobae
committed
7fe4300
test(codeql): restore exact tree and expose cross-channel ambiguity
seonghobae
committed
060597a
fix(codeql): unify authenticated verdict evidence
seonghobae
committed
631ccfc
test(codeql): expose wake credential shadowing
seonghobae
committed
be87023
fix(codeql): accept nested rerun request envelope
seonghobae
committed
5e95eb0
fix(codeql): preserve wake credential fallback
seonghobae
committed
3762301
fix: preserve missing-schema rejection contract
seonghobae
committed
d116229
docs(codeql): bind verdict and wake evidence
seonghobae
committed
9f06558
test(codeql): require one attempt settlement owner
seonghobae
committed
1eaf07d
docs(gap): bind strict CodeQL envelope evidence
seonghobae
committed
057ef77
fix(codeql): settle dispatch wake once per attempt
seonghobae
committed
4876772
test(codeql): reject conflicting rerun representations
seonghobae
committed
dd2796d
fix(codeql): reject conflicting rerun identities
seonghobae
committed
57c8143
test(codeql): require source-bound settlement evidence
seonghobae
committed
e0800ad
fix(codeql): bind run-wide settlement evidence
seonghobae
committed
d93a78a
merge: stack CodeQL wake repair on head envelope
seonghobae
committed
5043c17
test(codeql): reject malformed head envelopes
seonghobae
committed
79a7b35
fix(codeql): validate original head envelope
seonghobae
committed
0fb9151
test(codeql): reject conflicting head identities
seonghobae
committed
7f0615b
fix(codeql): reject conflicting head identities
seonghobae
committed
4434a5d
docs(gap): bind dual head identity evidence
seonghobae
committed
bfca56f
merge: reconcile strict CodeQL head identity
seonghobae
committed
3720dd8
merge: carry strict head envelope into wake repair
seonghobae
committed
2b5b9a9
test(codeql): bind producer merge provenance and dual head identity
seonghobae
committed
e930551
fix(codeql): verify live producer merge provenance
seonghobae
committed
5c30993
merge: stack head envelope on review trigger repair
seonghobae
committed
45ef97c
merge: preserve stacked check admission after provenance repair
seonghobae
committed
9054b5e
test(codeql): require full failed-job rerun matrix
seonghobae
committed
940242d
fix(codeql): bind rerun matrix to failed job set
seonghobae
committed
c8d7caa
test(codeql): pin every identity and credential invariant
seonghobae
committed
a22dd5b
test(codeql): reproduce stale status publication cycle
seonghobae
committed
72d71b0
fix(codeql): retire superseded status publication
seonghobae
committed
d4a9563
test(codeql): reject head-only status migration bridge
seonghobae
committed
6901dd6
fix(codeql): require base-bound authenticated receipts
seonghobae
committed
d7bb95f
fix(codeql): authenticate protected handler evidence
seonghobae
committed
91a94a2
fix(codeql): bridge protected handler rollout
seonghobae
committed
6706c23

Uh oh!

Commits

Commits on Sep 5, 2026

Commits on Sep 6, 2026

Commits on Sep 7, 2026

Commits on Sep 8, 2026