weichen 9374986b63 Lock CI checkout credential scope to the injected server and allowlist ...

Why: 复核轮遗留的安全测试草稿按「常量=传输端点」设计，与 PR #213 已合入的
「注入基址=传输端点」语义相反，原样提交会红。适配为锁定真实不变量。
Evidence: python3 -m unittest tests.test_ci_credentials 8/8 OK（含新用例：
任一注入拼写检出成功、凭据仅落白名单路径且令牌分离、非 http(s) 注入 fail-closed）。
Impact: 仅测试文件；不改 ci.yaml 行为。
Refs: PR #213 run 950 诊断（GITHUB_SERVER_URL=http://172.17.0.1:3000）。

2026-10-05 13:45:58 +00:00

..

test_ci_credentials.py

Lock CI checkout credential scope to the injected server and allowlist

2026-10-05 13:45:58 +00:00

test_evidence.py

Close review gaps in cleanup and evidence handling

2026-10-05 13:07:10 +00:00

test_task.py

Merge current main while preserving governance repairs

2026-10-05 13:11:50 +00:00

test_write_guard.py

Make development gates preserve work and verifiable evidence

2026-10-05 12:36:02 +00:00