From a76900d1c9e7ca794ff1621fbfdec3cf6133a973 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 6 Sep 2026 02:47:11 +0000 Subject: [PATCH 1/2] docs: sync spec 1.0.30 changelog and mapping audit entries The specification header and Section 2 sync table were previously bumped to version 1.0.30 documenting the CTR-001 status-function guard mapping addition, but Section 7.2 (Mapping Audit) and Section 10 (Change Log) were never updated to match, violating the mandatory Section 7.3 sync protocol. Verified the CTR-001 status-function guard (guardIfAgainstStatusFuncBypass / ifExpressionContainsStatusFunc in pkg/workflow/compiler_builtin_job_augmentation.go) is implemented and covered by existing tests in pkg/workflow/compiler_custom_jobs_test.go. Also reviewed open critical/high code-scanning alerts via GitHub MCP; all are outside compiler conformance targets or are self-scan findings from the daily-malicious-code-scan/daily-semgrep-scan workflows, so no new CTR-* rule is required. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- specs/compiler-threat-detection-spec.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/specs/compiler-threat-detection-spec.md b/specs/compiler-threat-detection-spec.md index a1ec22d3e66..f21fd627188 100644 --- a/specs/compiler-threat-detection-spec.md +++ b/specs/compiler-threat-detection-spec.md @@ -322,6 +322,10 @@ The mappings above are pattern-based references and MUST be validated against co When mappings change, this table MUST be updated in the same change set as the implementation update. +### 7.2 Mapping Audit (2026-09-06) + +Audit result: ✅ all listed `CTR-001` through `CTR-026` rows currently include non-empty implementation references and non-empty test coverage targets; no `TODO` placeholders were found in the mapping table. Review window: daily optimizer cycle 2026-09-06, covering commits merged in the prior 48 hours (repository history begins at `8fb0a67`, the sole reachable commit; no additional compiler or parser diffs were available to review beyond the existing baseline). Security-relevant items evaluated: (1) **Spec-to-implementation sync gap**: the specification header and Section 2 sync table were previously bumped to version `1.0.30` (documenting the CTR-001 status-function guard for compiler-owned prerequisites, `guardIfAgainstStatusFuncBypass`/`ifExpressionContainsStatusFunc` in `pkg/workflow/compiler_builtin_job_augmentation.go`), but this Section 7.2 mapping audit and the Section 10 change log were not updated to match, violating the Section 7.3 sync protocol. Verified the guard is implemented and covered by `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncFailureAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAlwaysAddsSuccessGuards`, and `TestApplyBuiltinJobNeedsAugmentations_StatusFuncKeepsCustomJobUnguarded` (`pkg/workflow/compiler_custom_jobs_test.go`); this is a documentation-sync fix only, not a new threat class, so no new `CTR-*` rule is required. (2) Reviewed open code-scanning alerts (severity critical/high) via GitHub MCP: alerts #674/#669/#668/#667 (`go/bad-redirect-check`), #672 (`go/allocation-size-overflow`), and #663 (`js/http-to-file-access`) affect non-compiler tooling (`pkg/cli/add_package_manifest_imports.go`, `pkg/cli/add_package_manifest_includes.go`, `pkg/cli/project_command.go`, `scripts/ensure-docs-slide-pdf.js`) and are outside this specification's conformance targets (Section 3.1: `pkg/workflow/`, `pkg/parser/`, `actions/setup/`); alerts #653 (`workflow-out-of-context`) and #651/#652 (`workflow-go-graphql-injection-sprintf`) are findings from the `daily-malicious-code-scan` and `daily-semgrep-scan` workflows' own self-scans and are tracked by those workflows' remediation processes, not compiler-generated-workflow threat detection. No new compiler-side threat class identified. (3) No `threat-detection-suppress` annotations were found in any live (non-fixture, non-documentation-example) workflow source in this review window, so no `SLA_BREACH` or expiration findings apply. No new `CTR-*` rule required this cycle. + ### 7.2 Mapping Audit (2026-08-31) Audit result: ✅ all listed `CTR-001` through `CTR-026` rows currently include non-empty implementation references and non-empty test coverage targets; no `TODO` placeholders were found in the mapping table. Review window: daily optimizer cycle 2026-08-31, covering commits merged in the prior 48 hours (through `ff62cdb`). Security-relevant items evaluated: (1) **Duplicate Playwright `--no-sandbox` entrypoint arg** (`pkg/workflow/mcp_renderer_builtin.go`, commit `ce08eba4b` "Fix Playwright MCP TOML sandbox configuration"): the unified MCP config renderer's `renderPlaywrightTOML` now emits the same `--no-sandbox` Chromium entrypoint flag already validated for `pkg/workflow/mcp_config_playwright_renderer.go` under the 2026-07-26 audit; this is the identical browser-process-level flag (required for headless Chromium to reach `localhost` inside CI containers), not a workflow sandbox bypass; already covered under CTR-004's established rationale; regression test `pkg/workflow/mcp_config_refactor_test.go` covers the new emission path; no new threat class; no new CTR rule required. (2) No other security-sensitive compiler or parser diffs, and no new `threat-detection-suppress` annotations, were found in the review window. Review window: SPDD daily spec review cycle 2026-07-31 (rotation index 5–9 of 18, covering `specs/compiler-threat-detection-spec.md` among others). Security-relevant items evaluated: (1) **CTR-016/018/019/020/021 sync references**: each of these five rules was individually verified against current `pkg/workflow/` source locations — `safe_update_enforcement.go` (CTR-016), `strict_mode_update_check_validation.go` (CTR-018), `cache.go` + `expression_builder.go` (CTR-019), `pkg/parser/import_bfs.go` (CTR-020), `agent_validation.go` (CTR-021); all implementation references and test coverage targets in Section 7.1 are current and accurate; no drift detected. (2) **Section 6 Optimizer Failure Safeguards** (§6.6): the three failure modes (API unavailability, runner timeout, rate-limit exhaustion) are specified normatively but are not currently covered by a dedicated unit or integration test; flagged as a coverage gap for the next implementation cycle — a future PR should add tests in `pkg/workflow/` or an integration harness that exercises the `OPTIMIZER_DEGRADED`, `OPTIMIZER_TIMEOUT`, and `OPTIMIZER_RATE_LIMITED` diagnostic paths. No new threat class; no new CTR rule required this cycle. @@ -431,6 +435,14 @@ These optimizer-protocol IDs cover Section 6 norms; they do not add or replace t ## 10. Change Log +### 1.0.30 (2026-09-06) + +- Daily optimizer review cycle. The specification header and Section 2 sync table had already been bumped to `1.0.30` (documenting the CTR-001 mapping addition for the status-function guard on compiler-owned prerequisites), but the corresponding Section 7.2 mapping audit entry and this change log entry were missing, leaving the specification out of sync with itself per the Section 7.3 sync protocol. +- Added Section 7.2 Mapping Audit (2026-09-06) entry confirming the CTR-001 status-function guard (`guardIfAgainstStatusFuncBypass`, `ifExpressionContainsStatusFunc` in `pkg/workflow/compiler_builtin_job_augmentation.go`) is implemented and covered by `pkg/workflow/compiler_custom_jobs_test.go` (`TestApplyBuiltinJobNeedsAugmentations_StatusFuncAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncFailureAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAlwaysAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncKeepsCustomJobUnguarded`). +- Reviewed open code-scanning alerts (critical/high severity) via GitHub MCP; all findings affect files outside this specification's conformance targets (`pkg/cli/`, `scripts/`) or are self-scan findings from the `daily-malicious-code-scan`/`daily-semgrep-scan` workflows themselves, not compiler-generated-workflow threats. No new `CTR-*` rule required. +- No `threat-detection-suppress` annotations were found in any live workflow source in this review window; no `SLA_BREACH` findings apply. +- No new threat class was identified requiring a new `CTR-*` rule this cycle; this entry closes the outstanding spec-to-changelog sync gap for version `1.0.30`. + ### 1.0.29 (2026-08-31) - Daily optimizer review cycle. Reviewed compiler and parser changes merged in the prior 48 hours (through commit `ff62cdb`). The only security-sensitive diff identified was `ce08eba4b` "Fix Playwright MCP TOML sandbox configuration" (#56800), which adds a `--no-sandbox` Chromium entrypoint arg to the unified MCP config renderer's `renderPlaywrightTOML` (`pkg/workflow/mcp_renderer_builtin.go`) so the refactored TOML-emission path matches the existing behavior of `pkg/workflow/mcp_config_playwright_renderer.go`. From b0a6b1fab1bd4929db4ae73d465c1ec3b5457ba6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 6 Sep 2026 19:29:31 +0000 Subject: [PATCH 2/2] docs: compact compiler threat changelog Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- specs/compiler-threat-detection-spec.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/specs/compiler-threat-detection-spec.md b/specs/compiler-threat-detection-spec.md index f21fd627188..18106a451b2 100644 --- a/specs/compiler-threat-detection-spec.md +++ b/specs/compiler-threat-detection-spec.md @@ -437,11 +437,8 @@ These optimizer-protocol IDs cover Section 6 norms; they do not add or replace t ### 1.0.30 (2026-09-06) -- Daily optimizer review cycle. The specification header and Section 2 sync table had already been bumped to `1.0.30` (documenting the CTR-001 mapping addition for the status-function guard on compiler-owned prerequisites), but the corresponding Section 7.2 mapping audit entry and this change log entry were missing, leaving the specification out of sync with itself per the Section 7.3 sync protocol. -- Added Section 7.2 Mapping Audit (2026-09-06) entry confirming the CTR-001 status-function guard (`guardIfAgainstStatusFuncBypass`, `ifExpressionContainsStatusFunc` in `pkg/workflow/compiler_builtin_job_augmentation.go`) is implemented and covered by `pkg/workflow/compiler_custom_jobs_test.go` (`TestApplyBuiltinJobNeedsAugmentations_StatusFuncAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncFailureAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAlwaysAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncKeepsCustomJobUnguarded`). -- Reviewed open code-scanning alerts (critical/high severity) via GitHub MCP; all findings affect files outside this specification's conformance targets (`pkg/cli/`, `scripts/`) or are self-scan findings from the `daily-malicious-code-scan`/`daily-semgrep-scan` workflows themselves, not compiler-generated-workflow threats. No new `CTR-*` rule required. -- No `threat-detection-suppress` annotations were found in any live workflow source in this review window; no `SLA_BREACH` findings apply. -- No new threat class was identified requiring a new `CTR-*` rule this cycle; this entry closes the outstanding spec-to-changelog sync gap for version `1.0.30`. +- Reconciled the existing `1.0.30` CTR-001 status-function mapping with its missing Section 7.2 audit and Section 10 changelog entries, as required by Section 7.3. +- Confirmed the guard implementation and tests; reviewed critical/high code-scanning alerts and live workflow sources. Findings were outside this specification's compiler targets or were self-scan findings; no new `CTR-*` rule or `SLA_BREACH` finding applies. ### 1.0.29 (2026-08-31)