Dotta c119c4bee6 fix(ci): validate the PR base snapshot (#12449) ...

## Summary

- validate the event base ref/SHA against the live PR state instead of
requiring the moving `master` branch tip to remain unchanged while a
hosted gate queues
- retain exact event/live merge parent and tree validation, plus
author/sender/rerun checks

## Canary finding

A seven-minute hosted-gate queue allowed `master` to advance. Requiring
the live branch tip to equal the event base snapshot would route
otherwise valid trusted runs back to GitHub-hosted indefinitely on a
busy repository.

## Validation

- actionlint and workflow-contract tests pass
- internal routing harness passes
- replaced PR base snapshot, stale head, changed merge parent/tree, and
untrusted actors all remain fail-closed
- AWS routing remains disabled during rotation

2026-08-28 11:35:41 -05:00

..

ISSUE_TEMPLATE

chore(github): expand issue forms (#7628)

2026-06-05 22:27:12 -07:00

scripts

ci: enforce migration order against PR target (#12433)

2026-08-28 08:47:22 -05:00

workflows

fix(ci): validate the PR base snapshot (#12449)

2026-08-28 11:35:41 -05:00

CODEOWNERS

chore: add @nickyleach to CODEOWNERS (#8289)

2026-06-18 13:34:55 -07:00

dependabot.yml

fix(observability): pin the Sentry browser SDK and gate the optional Sentry server peer on the exact version (#12270)

2026-08-27 07:20:03 -07:00

PULL_REQUEST_TEMPLATE.md

fix(ci): make PR-template inline-description contract explicit (#10558)

2026-07-31 09:46:26 -07:00