feat(automation): add hourly protected PR and OpenCode product loops - #271

Draft

seonghobae wants to merge 87 commits into

mainfrom

feat/hourly-opencode-commercial-loop

Commits on Aug 5, 2026

security: rebuild audit pseudonymization on current main
seonghobae
committed
5261356
test(security): require strong policy override keys
seonghobae
committed
28966e6
fix(security): reject weak policy override keys
seonghobae
committed
2e9c4a2
docs(security): document policy override key strength
seonghobae
committed
ac70dd7
fix: trigger CI due to strix timeout
seonghobae
committed
27106a5
chore: remove stray CI trigger script
seonghobae
committed
b3ad882
test: cover disabled policy signing startup path
seonghobae
committed
0e7770b
docs: consolidate unreleased changelog entries
seonghobae
committed
a86ab46
build: enforce zero missed production lines and branches
seonghobae
committed
eb34323
ci: verify exact PR head with coverage gates
seonghobae
committed
164aecf
ci: fuzz the exact pull request head
seonghobae
committed
294b30b
docs: record exact-head and coverage gates
seonghobae
committed
febb3fd
test: add shared security provider fixture
seonghobae
committed
9cf1ff8
test: cover null policy secret normalization
seonghobae
committed
3214bc0
test: cover tenant delete fail-closed branches
seonghobae
committed
62dac96
test: cover validation security edge cases
seonghobae
committed
0416068
test: cover conversion filename boundary
seonghobae
committed
6b61330
test: cover artifact deletion failure
seonghobae
committed
70f3399
test: cover repository delete edge cases
seonghobae
committed
d73571b
test: cover exception log sanitization
seonghobae
committed
36254ee
test: cover download filename and digest edges
seonghobae
committed
a1533de
fix: redact rejected parameter values
seonghobae
committed
31c4b4d
docs: record rejected-value redaction
seonghobae
committed
c0c0c45
test: cover every override header separator
seonghobae
committed
a308f0f
refactor: trust normalized policy secret contract
seonghobae
committed
39dc005
refactor: remove unreachable blank filename branch
seonghobae
committed
6e311ed
fix(ci): isolate exact-head evidence finalization runs
seonghobae
committed
8ca8958
fix(ci): use repository-native evidence verifier
seonghobae
committed
61ab219
docs(evidence): ingest verified Netty 4.1.136 evidence
github-actions[bot]
committed
2831bb9
fix(security): restore reviewed Netty 4.1.136 remediation
seonghobae
committed
fa1659a
test(evidence): verify complete Netty SBOM graph coherence
seonghobae
committed
6d9a3d7
docs(security): record deterministic Netty SBOM provenance
seonghobae
committed
20513e3
docs(evidence): correct CycloneDX generation contract
seonghobae
committed
67cd42c
docs(changelog): record deterministic Netty buyer evidence
seonghobae
committed
06452c3
test(security): require auditable policy overrides
seonghobae
committed
1907593
fix(security): fail closed without override audit key
seonghobae
committed
0189136
docs(security): require auditable override startup
seonghobae
committed
c57af8b
docs(changelog): record auditable override gate
seonghobae
committed
5073573
test(security): require standalone override auditability
seonghobae
committed
ff10462
refactor(security): expose reusable override key validation
seonghobae
committed
f08d789
fix(security): enforce override auditability in standalone service
seonghobae
committed
9c33db4
test(fuzz): use separated override audit keys
seonghobae
committed
10bfb26
test(web): use separated override audit keys
seonghobae
committed
162166a
test(service): use separated override audit keys
seonghobae
committed
967fe25
test(audit): reject unauditable policy signing
seonghobae
committed
92ce1c6
docs(security): cover standalone override validation
seonghobae
committed
422c465
docs(changelog): record standalone override guard
seonghobae
committed
cacd637
test(build): require warning-free public Javadocs
seonghobae
committed
08b14b7
build(docs): gate warning-free public Javadocs
seonghobae
committed
f86581f
docs(api): explain tenant context claims
seonghobae
committed
c0d2c7b
docs(api): explain conversion status payload
seonghobae
committed
21bbc79
docs(api): explain admin job list payload
seonghobae
committed
648e71b
docs(api): explain conversion acceptance payload
seonghobae
committed
f454056
docs(api): explain viewer bootstrap payload
seonghobae
committed
8d3d180
docs(api): explain error response envelope
seonghobae
committed
f96d7d4
docs(api): complete public Javadocs
seonghobae
committed
4b1f65d
docs(api): finish warning-free Javadoc surface
seonghobae
committed
e08e0e0
docs(changelog): record executable Javadoc gate
seonghobae
committed
ecbc0a9
docs(agents): make verify and Javadocs authoritative
seonghobae
committed
fcc77fd
docs(acceptance): make verify evidence authoritative
seonghobae
committed
58c9cff
docs(governance): use current sibling repository names
seonghobae
committed
bf7083d
perf(io): remove filesystem TOCTOU prechecks
seonghobae
committed
91091dd
test(ci): require non-skipped Maven report acceptance
seonghobae
committed
dca468e
feat(ci): fail on skipped or empty Maven reports
seonghobae
committed
231ce19
fix(ci): reject skipped or empty Maven test reports
seonghobae
committed
1e3d6f6
docs(ci): require zero-skipped Maven report evidence
seonghobae
committed
040909f
docs(changelog): record zero-skipped CI gate
seonghobae
committed
6ee5c40
test(ci): require bounded entity-free XML reports
seonghobae
committed
b34b931
fix(ci): bound and sanitize Maven XML evidence
seonghobae
committed
eeee286
docs(ci): define bounded XML report parsing
seonghobae
committed
fa25f04
docs(changelog): record safe Maven report parsing
seonghobae
committed
9a83d0f
fix(ci): eliminate report size-check race
seonghobae
committed
7b6f60a
test(ci): reject encoded XML declaration bypasses
seonghobae
committed
98870b0
fix(ci): enforce UTF-8 Maven report evidence
seonghobae
committed
72b30b6
docs(ci): require UTF-8 Maven XML evidence
seonghobae
committed
08b31c1
docs(changelog): record encoded XML rejection
seonghobae
committed
95b046a
test(ci): reject failing Maven report evidence
seonghobae
committed
a93127b
fix(ci): reject failing Maven report evidence
seonghobae
committed
5d1040e
docs(ci): reject contradictory Maven outcomes
seonghobae
committed
fff6161
docs(changelog): record report outcome checks
seonghobae
committed
3c9bea3
test(ci): assert singular Maven outcome diagnostics
seonghobae
committed
d089e6b
test: require complete Maven report counts
seonghobae
committed
e3104fc
fix: reject incomplete Maven report counts
seonghobae
committed
260d98f
docs: record fail-closed report attributes
seonghobae
committed
6e7e864
docs: define complete Maven report evidence
seonghobae
committed
2656321

Commits on Aug 6, 2026