PaperClipAI

0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-11 23:36:51 +02:00

Files

T

Dotta 3b295b05dc fix(ci): validate equivalent PR merge refs (#12441 )

## Summary

- validate the live master ref and event base SHA before AWS routing
- accept GitHub synthetic merge commits only when the event and live
commits have the exact expected base/head parents and identical tree
- preserve fail-closed routing for malformed, stale, replaced, or
untrusted events

## Canary finding

A trusted reopened PR produced two synthetic merge SHAs with different
timestamps but identical current base/head parents and tree. The former
exact-SHA comparison safely fell back to GitHub-hosted runners, but
could not route a valid event to AWS.

## Validation

- `actionlint .github/workflows/pr-trusted.yml .github/workflows/pr.yml`
- `node --test ./scripts/__tests__/e2e-shard.test.mjs`
- real-event gate simulation selects the Fleet label for equivalent
merge commits
- negative simulations keep an untrusted sender and replaced head on
`ubuntu-latest`
- AWS routing remains disabled during rotation

2026-08-28 11:16:42 -05:00

agent-runtime-images.yml

build(deps): bump actions/checkout from 6 to 7 (#8461 )

2026-06-23 10:13:39 -07:00

commitperclip-review.yml

fix(build): enforce Node 24 across Paperclip (#11792 )

2026-08-21 10:17:52 -07:00

docker.yml

Install the declared Sentry server package into the hosted image (#12330 )

2026-08-27 19:10:49 -07:00

e2e.yml

fix(build): enforce Node 24 across Paperclip (#11792 )