Repository navigation
fix: refuse release redirects with Workers-compatible fetch mode - #22
Conversation
|
@codex review Please independently review exact head d830abf. The live failure is now reproduced in the actual Workers runtime; the fixed GET-only probe reads the existing draft successfully. Assess redirect refusal and credential containment in both provider and separate signing-reader paths, retained one-mutation fencing, and whether the new negative cases preserve all authority boundaries. The existing release remains unpublished and no retry/publication is claimed. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
The protected live canary 39122966755 stopped in preparation with release_policy_rejected before recovery or publication. A GET-only reproduction in the Workers runtime identified the cause: redirect: "error" throws TypeError before sending the GitHub request. Node fixtures had incorrectly required that unsupported mode.
Change the release adapter and separate receipt signer's GitHub metadata reader to manual redirects. Their existing exact-200 checks still reject every redirect; no caller credential is forwarded to a redirected host. Tests cover 301/302/303/307/308, zero durable reservations and no follow-up request. Approval, identity, target, signing keys, recovery grants and the permanent single-PATCH fence are unchanged.
Validation: build, all release-provider tests and both Wrangler dry-runs pass. A second local Workers-runtime GET-only check on the fixed build successfully observed the same unchanged draft, tag and assets through three HTTP 200 reads. Sanitised before/after runtime evidence and the exact failed workflow artifact digest are committed. This read-only probe is not production consequence acceptance.
Please independently review the complete changed paths and redirect refusal boundary on d830abf. After CI and review, activation must pin the actual merge SHA and a separately reviewed canary workflow revision. No npm publication or independent adoption credit is claimed. Related: AyobamiH/donestate#193.