Lock CI checkout credential scope to the injected server and allowlist #215

Merged

weichen merged 1 commits from fix/ci-checkout-credential-scope into main

2026-10-05 13:50:07 +00:00

Author	SHA1	Message	Date
weichen	9374986b63	Lock CI checkout credential scope to the injected server and allowlist ci / test (pull_request) Successful in 2m10s Details Why: 复核轮遗留的安全测试草稿按「常量=传输端点」设计，与 PR #213 已合入的「注入基址=传输端点」语义相反，原样提交会红。适配为锁定真实不变量。 Evidence: python3 -m unittest tests.test_ci_credentials 8/8 OK（含新用例：任一注入拼写检出成功、凭据仅落白名单路径且令牌分离、非 http(s) 注入 fail-closed）。 Impact: 仅测试文件；不改 ci.yaml 行为。 Refs: PR #213 run 950 诊断（GITHUB_SERVER_URL=http://172.17.0.1:3000）。	2026-10-05 13:45:58 +00:00

Author

SHA1

Message

Date

weichen

9374986b63

Lock CI checkout credential scope to the injected server and allowlist

ci / test (pull_request) Successful in 2m10s

Details

Why: 复核轮遗留的安全测试草稿按「常量=传输端点」设计，与 PR #213 已合入的
「注入基址=传输端点」语义相反，原样提交会红。适配为锁定真实不变量。
Evidence: python3 -m unittest tests.test_ci_credentials 8/8 OK（含新用例：
任一注入拼写检出成功、凭据仅落白名单路径且令牌分离、非 http(s) 注入 fail-closed）。
Impact: 仅测试文件；不改 ci.yaml 行为。
Refs: PR #213 run 950 诊断（GITHUB_SERVER_URL=http://172.17.0.1:3000）。

2026-10-05 13:45:58 +00:00