Protect v6.4 alert credentials and prevent stale discovery rollback - #1964
Merged
rcourtman merged 11 commits intoSep 7, 2026
Conversation
Backport-of: 3c77ecb (code and tests only) Change-source: pulse-maintainer
Change-source: pulse-maintainer
Backport reviewed Core 192a72e05c06b2a2ff3a04bb2ef53ded78950e47 with candidate-specific before/after evidence. Change-source: pulse-maintainer Change-source: pulse-maintainer
Literal-only query matching and the separate resolved ntfy transport caller leaked recognised URL credentials. Decode each query name once and project ntfy transport errors before logging or returning them, without changing destinations or error causes. Add synthetic sink-matrix and HTTP projection regressions plus the bounded notification contract in this commit. Change-source: pulse-maintainer (cherry picked from commit 21ed7a8)
…rporate the protected landing of the preceding release-line batch while preserving the exact reviewed Discord and Telegram backport tips and their ancestry.\n\nChange-source: pulse-maintainer Change-source: pulse-maintainer
Incorporate the protected landing of the preceding release-line batch while preserving the exact reviewed Discord and Telegram backport tips and their ancestry. Change-source: pulse-maintainer
Retain the exact gate-captured reconciliation commit in history while keeping its reviewed tree unchanged. Change-source: pulse-maintainer
Change-source: pulse-maintainer
pulse-triage
Bot
changed the title
Continuous development must not change the source of an admitted release. Allow the workflow to run at the qualified preparation PR head after its normal merge, verifying exact source and workflow identity, canonical PR provenance, and ancestry in the governed release line. Later branch commits remain outside that release. Document the immutable-candidate contract and verify source workflow compatibility before qualification. Validation: snapshot identity and workflow contract tests passed, including wrong-head, wrong-base, fork, unmerged and unbound dispatch rejection. The existing release workflow promotion policy test also passed. (cherry picked from commit b64709e) Change-source: pulse-maintainer
The branch is validated by the snapshot guard, but its transfer between workflow steps must also use the canonical GitHub command-file encoder. Keep the source binding unchanged and satisfy the workflow trust audit. Validation: all 41 workflow trust tests and five snapshot tests pass. Contract-Neutral: Encode the already-validated release branch with the shared GitHub command-file helper without changing source identity or release authority (cherry picked from commit ab562c8) Change-source: pulse-maintainer
rcourtman
enabled auto-merge
September 7, 2026 20:29
Backfill could save a stale List snapshot after manual discovery repaired a service, restoring unknown identity and dropping its URL and engine version. Derive and persist missing suggestions from the current record under the store lock instead, without holding it across monitor reads. Add a deterministic SetReadState/manual-refresh interleaving and encrypted restart assertions, plus coverage for current identity, dismissed proposals, deletion and persistence failure. The discovery package passes twenty race-enabled repetitions. Change-source: pulse-maintainer
pulse-triage
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The v6.4 line masks Discord and Telegram credentials, encoded query names, resolved ntfy transport details, and other supported webhook secrets in delivery diagnostics while retaining useful destinations and error context. It also publishes reviewed release snapshots independently of moving branch tips and now prevents availability-suggestion backfill from overwriting a concurrent manual discovery repair.
The discovery backport is an additive correction for the required source-check failure on this proposal. It updates only the current stored record under the store lock, preserving newer service identity, URL, engine version, notes, dismissals, and deletion.
Why
Synthetic release-line evidence reproduced credential disclosure paths in failed alert delivery, making these narrow security backports necessary for dependable alerting. Snapshot dispatch needed exact source identity after branch advancement. The previous PR head
cda22c5738afead4aa79ae0c0e1d0ec0d00f09b9then failed requiredBackend tests (rest-1)because asynchronous backfill restored a staleunknowndiscovery after manual ESPHome repair. Full logs showed the repaired save followed by the stale save; deterministic local overlap evidence reproduced it. The stale backfill was introduced after the manual-repair behavior and is present in v6.4.1, so this is a named regression rather than new product scope.Included candidates and range
Range:
fade3116735e3173d0019d294260de5a73882c17..d2f7bd0f2522f3466e4003ab12a75612dd279937.Candidates:
20260907T170524Z-release-line(f3366a34ab9861768cdafa122f3c4b2ef62489ad),20260907T173010Z-release-line(71c721ccee8bea8a64a130fdbc0ea78292ff748b),20260907T181017Z-release-line(e7a5b2c9072dd8bc498c44aa38dc7d294db1edbc), and20260907T201516Z-release-line(bad8c4fc6bdc10e3399cc14534fc2981547a8a51..49a005005409389294a0c93721a9d7379cbd5421), plus publication correctiond2f7bd0f2522f3466e4003ab12a75612dd279937. Reconciliation commits preserve all reviewed tips and ancestry.Validation
git diff --check, and the canonical completion guard passed across the exact release range.cda22c5738, frontend, backend API and REST-0, build/smoke, all eight E2E shards and verdict, audit, public docs, secret scan, agent lifecycle, and advisory Benchmarks passed. Required REST-1 failedTestService_RunManualDiscoveryRefreshRepairsFreshUnknownKnownService; that failure is preserved and was not dismissed as flaky.d2f7bd0f25,go test -race ./internal/servicediscovery -count=20passed in 9.283s. Its four implementation/test blobs exactly match reviewed main repair653a28192a.Protected checks must evaluate exact head
d2f7bd0f2522f3466e4003ab12a75612dd279937. Historical release-candidate latency failures remain adverse and are not cleared here. This is source integration only, not release approval, exact-candidate qualification, or installed recipient proof.How Pulse handles triage
How Pulse handles triage