Harden safe-output field validation - #51133

Merged

pelikhan merged 28 commits into

mainfrom

security/safe-output-field-allowlist

Aug 8, 2026

Commits on Aug 7, 2026

Harden safe-output field validation
pelikhan
committed
9d80a26
Merge branch 'main' into security/safe-output-field-allowlist
pelikhan
authored
0a76fb9
Update safe outputs specification

Copilot
and
pelikhan
authored
80b0655
Start PR finisher pass

Copilot
and
pelikhan
authored
2a01f29
Address safe output review findings

Copilot
and
pelikhan
authored
5be5797
Merge branch 'main' into security/safe-output-field-allowlist
pelikhan
authored
4b35746
Update generated workflow locks

Copilot
and
gh-aw-bot
authored
c7aef55
Address safe-output review edge cases

Copilot
and
gh-aw-bot
authored
d909c06
Include commit SHA helper in setup bundle

Copilot
and
gh-aw-bot
authored
df26e06
Reject unnormalized validated safe-output fields

Copilot
and
gh-aw-bot
authored
fbf9d62
Clarify unnormalized safe-output field errors

Copilot
and
gh-aw-bot
authored
70398c7
Simplify safe-output validation diagnostics

Copilot
and
gh-aw-bot
authored
bee34d4
Allow safe add_comment comment ID allowlists

Copilot
and
pelikhan
authored
89f954a
Tighten add_comment target URL parsing

Copilot
and
pelikhan
authored
08021cb
Use issue URL for comment target derivation

Copilot
and
pelikhan
authored
178ff31
Merge branch 'main' into security/safe-output-field-allowlist
pelikhan
authored
65c5eea
Refresh branch and fix validation fallout

Copilot
and
gh-aw-bot
authored
c35f9fe
Start safe output spec follow-up

Copilot
and
gh-aw-bot
authored
b9f7fe8
Add changeset
github-actions[bot]
authored
716d34c
Improve test quality: migrate tracker_id_integration_test.go to testify assertions (#51178)

authored
ac6e292
Update safe output comment ID spec

Copilot
and
gh-aw-bot
authored
23a10f0
Merge branch 'main' into security/safe-output-field-allowlist
pelikhan
authored
891190d
Fix lint-go: use maps.Copy and drop unneeded nil check

Copilot
and
pelikhan
authored
a15b0f7
Fix filename quoting bypass in post-apply size/protection checks

Copilot
and
pelikhan
authored
9c43ee3
Address matt-pocock review: comment_id mutation, upload targetFileName re-derivation

Copilot
and
pelikhan
authored
0efed9c
Clarify comment_id stripping intent per code review feedback

Copilot
and
pelikhan
authored
c16df32
Merge remote-tracking branch 'origin/main' into security/safe-output-field-allowlist
Copilot
authored
985206c
Refresh branch with main and recompile workflows

Copilot
and
gh-aw-bot
authored
e4d30d7

Navigation Menu

Uh oh!

Harden safe-output field validation - #51133

Harden safe-output field validation#51133
pelikhan merged 28 commits into
mainfrom
security/safe-output-field-allowlist

Commits on Aug 7, 2026

Harden safe-output field validation

Merge branch 'main' into security/safe-output-field-allowlist

Update safe outputs specification

Start PR finisher pass

Address safe output review findings

Merge branch 'main' into security/safe-output-field-allowlist

Update generated workflow locks

Address safe-output review edge cases

Include commit SHA helper in setup bundle

Reject unnormalized validated safe-output fields

Clarify unnormalized safe-output field errors

Simplify safe-output validation diagnostics

Allow safe add_comment comment ID allowlists

Tighten add_comment target URL parsing

Use issue URL for comment target derivation

Merge branch 'main' into security/safe-output-field-allowlist

Refresh branch and fix validation fallout

Start safe output spec follow-up

Add changeset

Improve test quality: migrate tracker_id_integration_test.go to testify assertions (#51178)

Update safe output comment ID spec

Merge branch 'main' into security/safe-output-field-allowlist

Fix lint-go: use maps.Copy and drop unneeded nil check

Fix filename quoting bypass in post-apply size/protection checks

Address matt-pocock review: comment_id mutation, upload targetFileName re-derivation

Clarify comment_id stripping intent per code review feedback

Merge remote-tracking branch 'origin/main' into security/safe-output-field-allowlist

Refresh branch with main and recompile workflows