Repository navigation
Prepare v0.3.0 trust workflow - #1
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1ff1c8d93b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if prefixURL.Opaque != "" || candidateURL.Opaque != "" { | ||
| return hasURINamespacePrefix(strings.ToLower(candidateURL.Opaque), strings.ToLower(prefixURL.Opaque)) | ||
| } | ||
| return hasURINamespacePrefix(candidateURL.EscapedPath(), prefixURL.EscapedPath()) |
There was a problem hiding this comment.
When a resource URI percent-encodes a path segment, the policy matcher compares EscapedPath() strings, so a deny prefix like file:///workspace/secrets does not match file:///workspace/%73ecrets/key. In policies that rely on resource_uris.deny, that lets an advertised resource evade the high-severity denial even though it resolves to the same namespace; match on normalized/decoded paths instead.
Useful? React with 👍 / 👎.
| return map[string]any{ | ||
| "title": artifact.Title, | ||
| "description": artifact.Description, | ||
| "uri": artifact.URI, | ||
| "uri_template": artifact.URITemplate, |
There was a problem hiding this comment.
For resource and resource-template artifacts, this contract hash omits parsed metadata such as mimeType and resource size because those fields never make it into the hashed artifact map. If a reviewed resource changes only its MIME type or advertised size, a baseline scan will keep the same contract hash and miss the drift instead of emitting AG-BASE002.
Useful? React with 👍 / 👎.
No description provided.