fix(ci): sandbox firewall fix + proactive network guard#1

Open

fvegiard wants to merge 21 commits into

devfrom

fix/ci-firewall-telemetry

Commits on Jun 21, 2026

fix(ci): make gh auth status non-fatal + disable telemetry in sandboxed runners
fvegiard
committed
feat(ci): add proactive network-firewall-guard workflow
fvegiard
committed
fix(ci): add OMO telemetry vars + remove em dash (reviewer feedback)
fvegiard
committed
fix(ci): rewrite network-firewall-guard - no self-scan, recognize mitigations, PR-only diff, repo summary pattern
fvegiard
committed
fix(guard): push=changed-only, value-check opt-outs, OMO_CODEX prefix, temp-file findings

fvegiard
and
claude
committed
fix(guard): fix YAML parse error — use body-file instead of multi-line --body

fvegiard
and
claude
committed
test: register network-firewall-guard in workflow summary expectations

fvegiard
and
claude
committed
fix(guard): use full push range and scan guard file itself

fvegiard
and
claude
committed
fix(guard): avoid self-scan false positives on comment and grep-pattern lines

fvegiard
and
claude
committed
fix(guard): handle zero-SHA new-branch push + require both PostHog opt-outs

fvegiard
and
claude
committed
fix(guard): accept unquoted YAML opt-outs + add opt-outs to ci.yml lazycodex job

fvegiard
and
claude
committed
fix(guard): case-sensitive posthog, exact grep-skip, OR mitigation

fvegiard
and
claude
committed
fix(guard): safe path iteration + require non-fatal || fallback

fvegiard
and
claude
committed
fix(locks): treat EPERM as lock contention on Windows

fvegiard
and
claude
committed
fix(guard): persist-credentials false + full truthy/falsy opt-out values

fvegiard
and
claude
committed
fix(guard): single-quote support, drop warn, anchor variable names

fvegiard
and
claude
committed
fix(guard): remove self-triggering lowercase posthog/npx-lazycodex phrases

fvegiard
and
claude
committed
fix(guard): address rounds 3-4 review comments

fvegiard
and
claude
committed
fix(guard): round-5 review — anchor fallbacks, restrict opt-outs, harden token step

fvegiard
and
claude
committed
fix(guard): remove semicolon from gh auth fallback boundary

fvegiard
and
claude
committed
chore: remove network-firewall-guard.yml

fvegiard
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): sandbox firewall fix + proactive network guard#1

fix(ci): sandbox firewall fix + proactive network guard#1
fvegiard wants to merge 21 commits into
devfrom
fix/ci-firewall-telemetry

Commits on Jun 21, 2026

fix(ci): make gh auth status non-fatal + disable telemetry in sandboxed runners

feat(ci): add proactive network-firewall-guard workflow

fix(ci): add OMO telemetry vars + remove em dash (reviewer feedback)

fix(ci): rewrite network-firewall-guard - no self-scan, recognize mitigations, PR-only diff, repo summary pattern

fix(guard): push=changed-only, value-check opt-outs, OMO_CODEX prefix, temp-file findings

fix(guard): fix YAML parse error — use body-file instead of multi-line --body

test: register network-firewall-guard in workflow summary expectations

fix(guard): use full push range and scan guard file itself

fix(guard): avoid self-scan false positives on comment and grep-pattern lines

fix(guard): handle zero-SHA new-branch push + require both PostHog opt-outs

fix(guard): accept unquoted YAML opt-outs + add opt-outs to ci.yml lazycodex job

fix(guard): case-sensitive posthog, exact grep-skip, OR mitigation

fix(guard): safe path iteration + require non-fatal || fallback

fix(locks): treat EPERM as lock contention on Windows

fix(guard): persist-credentials false + full truthy/falsy opt-out values

fix(guard): single-quote support, drop warn, anchor variable names

fix(guard): remove self-triggering lowercase posthog/npx-lazycodex phrases

fix(guard): address rounds 3-4 review comments

fix(guard): round-5 review — anchor fallbacks, restrict opt-outs, harden token step

fix(guard): remove semicolon from gh auth fallback boundary

chore: remove network-firewall-guard.yml