[yashaskn8]

Purpose

Add a passive, evidence-backed GitHub Actions Workflow Supply-Chain Lens to RepoLens, using existing scanner evidence and fail-closed coverage reporting.

User-visible capability

• Inspect workflow YAML files without executing any repository code, downloading actions, or calling an LLM.
• Flag explicit permissions: write-all and mutable external action/image references with source line evidence.
• Surface contextual pull_request_target PR-head checkout risks only when the reference occurs within the same checkout step; no claim of a confirmed exploit.
• Feed normalized StaticFinding results into the existing evidence store.
• Mark oversized, unreadable, non-UTF-8, symlink, or Windows reparse-point workflow inputs as incomplete rather than clean.

Architecture and 100-feature review

• docs/FEATURE_BATTLE_2026.md records 100 candidate ideas, simulated five-perspective senior engineering ratings, a shortlist, and a four-design architecture comparison.
• Integration is synchronous with RepoLens's established deterministic-scanner orchestration and does not add services, secrets, or migrations.

Hardening and regression fixes

• Defensive limits: 64 workflow files, 256 KiB/file, 2 MiB total, 512 directory entries, 256 findings.
• Added tests for pinned/unpinned references, privilege warnings, no-execution, direct-source evidence, false-positive isolation, symlinks, simulated Windows reparse points, unreadable inputs, oversized inputs, and evidence-store integration.
• Repaired frontend test harnesses to exercise the actual account/approval/pagination callbacks with all their safety guards, without removing security assertions.

Verified CI — 31 October 2026

• CI run #548 completed SUCCESS against PR head 5e93115c61b935af1b54232f6c884bbd3cd9300b.
• Backend: 2,337 passed, 11 skipped, 161 warnings; Python bytecode/imports, migration roundtrip, PostgreSQL/pgvector/Redis integration, and zero-key scripted Evidence Investigator regression gate passed.
• Frontend: TypeScript type-check, lint, regression tests, and production build all passed.
• Windows: path and reparse-point security job passed.
• The earlier frontend fixture failures and the workflow scanner/test integration defects have been corrected without weakening production authorization.
• Code CI success does not certify production deployment. RepoLens still documents hard release blockers for independently enforced acquisition workspace quotas, controlled Git egress, and external-scanner worker isolation. Do not bypass /health/ready or production release preflight.
• Draft PR intentionally awaits independent code/security review and a staging smoke/rollout decision.

Follow-up simulated QA — 31 October 2026 (current head)

• 93e6864 corrects a false positive: a nested on.push.branches value named pull_request_target was mistaken for an actual privileged event. The event detector now recognizes only direct children of the top-level on declaration.
• Two focused regressions cover the non-event branch-name case and preservation of a real sibling pull_request_target event.
• CI run #566 completed SUCCESS on previous head 93e6864ab42632174352609c621b73c23c57192e: backend 2,339 passed, 11 skipped, 161 warnings plus integration/zero-key gates; frontend 242 passed, 0 failed plus type-check/lint/build; Windows reparse/path checks 4 passed. The previously green run #564 applies only to older head 5e93115c61b935af1b54232f6c884bbd3cd9300b.
• No local execution of untrusted repository content. This remains a draft awaiting independent human code/security review. Production blocker #10 remains open pending independently verified quotas, Git egress, scanner isolation, and staging smoke/rollback evidence.

Security boundaries and known limits

• No default branch write, automatic merge, deployment, or bypass of human approval.
• This is deliberately a conservative line-oriented workflow rule set, not a complete YAML/GitHub Actions interpreter. Dynamic expression semantics, alias expansion, all trust-flow cases, and reusable workflows are outside v1 coverage. Partial evidence must not be described as a full security audit.
• Human security review required before declaring feature release-ready.

QA follow-up — 31 October 2026 (scope-aware write-all)

• c333223 addresses the source-reviewed false positive in github-actions.write-all-token: a nested env.permissions: write-all or action input must not be reported as an actual workflow/job GITHUB_TOKEN permission declaration. The bounded line-oriented scanner now requires workflow-root or direct jobs.<job_id> mapping scope for this warning.
• Added five focused regression cases: four non-token permissions keys (workflow environment, job environment, step environment, action input) and one positive job-level permissions: write-all amid misleading environment keys. Existing workflow-root and privileged checkout regressions are retained.
• Verified current-head CI: run #570 completed SUCCESS on c333223317aa6841021153ea56916a239bb60fa2: backend 2,344 passed, 11 skipped, 161 warnings; frontend 242 passed, 0 failed plus type-check/lint/build; Windows 4 passed; PostgreSQL/pgvector/Redis and zero-key scripted Evidence Investigator gates passed. The five new focused cases passed as part of the backend suite. Backend warnings match previous head (161); Node.js 20 action-runtime, Node deprecation and SQLAlchemy warnings remain maintenance items. No repository code was executed locally.
• PR remains draft, unmerged and subject to independent human code/security review. Production release remains BLOCKED under issue #10 pending independent host/workload quotas, Git egress policy, scanner isolation, readiness, staging smoke/recovery/rollback evidence and operations approval. No production gate is waived.

QA follow-up — 31 October 2026 (non-action uses scope)

• d972029 fixes a source-inspected false positive: a YAML uses: example/action@v1 key under env: or an action's with: is ordinary data, not a mutable external action reference. The passive scanner now skips uses keys nested in those mappings, without changing valid step/job uses detection.
• Added three negative parameterized regressions (workflow environment, job environment, step action input) and a positive case preserving a genuine mutable step reference after an environment uses key.
• Verified current-head CI: run #574 completed SUCCESS on d9720294809e22b57608efda633186201c4098f5: backend 2,348 passed, 11 skipped, 161 warnings (four additional focused cases), frontend 242 passed, 0 failed plus type-check/lint/build, Windows security 4 passed, and required PostgreSQL/pgvector/Redis integration plus zero-key scripted evaluation gates passed. Backend warnings remained 161 versus previous green head; existing SQLAlchemy and Node.js deprecations remain. No repository code was executed locally.
• Keep this PR draft for independent code/security review. Production blocker #10 remains OPEN until independently verified workspace quotas, Git egress restrictions, scanner-worker isolation, readiness, staging smoke/recovery/rollback evidence, and operations approval. No merge, default-branch write, deployment, or release waiver.

QA follow-up — 31 October 2026 (checkout input scope)

• bfad8ec restricts the contextual github-actions.privileged-untrusted-checkout warning to a direct with.ref input on the same checkout step; env.ref is not an action checkout input. 01eb9ac adds two focused regressions: a negative environment-variable case and a positive checkout-input control.
• Verified current-head CI: run #575 completed SUCCESS against 01eb9ac3401ce16301da068d41f5e8cda63a7d18: backend 2,350 passed, 11 skipped, 161 warnings (two added regressions); frontend 242 passed, 0 failed plus type-check/lint/build; Windows path/reparse tests 4 passed; PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation gates passed. Previous run #574 passed on older head d9720294809e22b57608efda633186201c4098f5 (2,348 backend passed, 11 skipped, 161 warnings). No backend warning-count increase; existing SQLAlchemy and Node/Actions runtime deprecation warnings remain.
• No local execution of untrusted repository code; no merge, main write, deployment, or human approval. PR remains draft. Production blocker #10 remains open pending independent host quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback, and operations/security sign-off.

QA follow-up — 31 October 2026 (matrix/output uses scope)

• Static inspection identified a source-backed false positive: strategy.matrix.include[*].uses and jobs.<id>.outputs.uses are ordinary data keys, but the previous scanner could label them mutable action references. c4a00d07a6ead03d4e9cdd5e67bf4a8fa669fa67 now limits mutable-reference detection to direct jobs.<id>.uses reusable workflows or step uses declarations. This remains a bounded indentation heuristic, not complete YAML parsing.
• ba892407dc7f6e3ef15a2cda9f1c57165d098598 adds two negative regression cases (matrix and job outputs) and one positive case preserving real reusable-job and step action findings. Verified exact-head CI: run #577 completed SUCCESS on ba892407dc7f6e3ef15a2cda9f1c57165d098598: backend 2,353 passed, 11 skipped, 161 warnings (all three added regressions passed); frontend 242 passed, 0 failed with type-check/lint/build; Windows path/reparse 4 passed; backend migrations, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation gates passed. Previous-head run #575 passed on 01eb9ac3401ce16301da068d41f5e8cda63a7d18 with 2,350 backend passed / 11 skipped / 161 warnings. Backend warning count did not increase; existing SQLAlchemy, Node/Actions runtime and deprecated frontend dependency warnings remain maintenance items.
• Keep this PR draft, with independent human security review required. Production blocker #10 remains OPEN pending independently enforced workspace quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback evidence, and security/operations approval. No local untrusted code execution, main write, force-push, merge, deployment, approval waiver, or release-gate bypass.

QA follow-up — 31 October 2026 (quoted uses YAML keys)

• Static source review found that valid quoted YAML keys ('uses': / "uses":) at step/job scope were ignored by the workflow action-reference detector, potentially missing mutable action references and a contextual privileged checkout. 2bd8b9a accepts quoted uses keys within the existing strict job/step scope. 02c5dd7 adds six focused regression cases: quoted step and reusable-job references (both quote styles), quoted environment data as a negative control, and quoted checkout preserving privileged PR-head context detection.
• Verified exact-head CI: run #581 completed SUCCESS on 02c5dd7021c99321ce7523ccc1b3afd5312f3339: backend 2,359 passed, 11 skipped, 161 warnings (all six new focused regressions passed); frontend 242 passed, 0 failed plus type-check/lint/build; Windows 4 passed; migrations, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation gates passed. Previous run #577 on ba892407dc7f6e3ef15a2cda9f1c57165d098598 had 2,353 passed, 11 skipped, 161 warnings. No backend warning-count regression. Existing SQLAlchemy and Node/Actions/dependency deprecation warnings remain maintenance debt. No repository code was executed locally.
• Keep this PR draft pending independent human code/security review. Production issue #10 remains OPEN pending independently enforced quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback and operations/security approval. No release gate is waived.

QA follow-up — 31 October 2026 (quoted permission/ref keys)

• Static source inspection found that valid YAML keys 'permissions' / "permissions" at workflow or job scope and 'ref' / "ref" under a checkout step's with mapping were missed by the security detector. This is a false-negative coverage gap, not a demonstrated exploit. c5c152db23d6ab90abe4b65e6540a7e5a1241bd4 updates only the two scoped matchers; 8840f4ac280dbd2ddd905f9cb7f3072b9d21c90b adds ten parametrized regression cases (four positive token-permission cases, two negative environment-permission cases, two positive privileged checkout cases, two negative environment-ref cases).
• Verified exact-head CI: run #41219708546 completed SUCCESS on 8840f4ac280dbd2ddd905f9cb7f3072b9d21c90b. Backend 2,369 passed / 11 skipped / 161 warnings, including all ten new parametrized regressions; frontend 242 passed / 0 failed, type-check/lint/build; Windows security 4 passed; migration, PostgreSQL/pgvector/Redis integration, and zero-key scripted evaluation gates passed. Previous run #581 on 02c5dd7021c99321ce7523ccc1b3afd5312f3339 had 2,359 passed / 11 skipped / 161 warnings. No backend warning-count increase; SQLAlchemy and Node/Actions deprecations remain maintenance debt. No local repository code was executed.
• PR stays draft, with independent human code/security review required. Production blocker #10 remains OPEN pending independent quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback evidence, and security/operations approval. No release gate is waived.

QA follow-up — 31 October 2026 (inline trigger mapping scope)

• Source inspection found a contextual false positive: on: {push: {branches: [pull_request_target]}} contains a branch filter, not a privileged pull_request_target event. The old inline matcher searched for that token anywhere in the value.
• Implementation 2b65691 distinguishes scalar, flow-list, and direct flow-map event declarations from nested mapping values. Regression commit 384ac36 adds six positive/negative event-declaration cases while preserving genuine privileged checkout findings.
• Exact-head verification: CI run #587 completed SUCCESS on 384ac3691d688354e951cac5f4d28ef23e562931. Backend 2,375 passed / 11 skipped / 161 warnings (all six added regression cases passed); frontend 242 passed / 0 failed plus type-check/lint/build; Windows path/reparse security 4 passed; migrations, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation passed. Prior green head 8840f4ac280dbd2ddd905f9cb7f3072b9d21c90b had 2,369 backend passed / 11 skipped / 161 warnings. No backend warning-count increase; existing SQLAlchemy and Node/Actions deprecations remain. No untrusted repository code was executed locally.
• Keep PR draft pending independent human security review. Issue #10 remains OPEN until independently enforced quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback evidence, and operations/security approval. No production gate is waived.

QA follow-up — 1 November 2026 (fork repository checkout)

• 0fadc56 extends the contextual pull_request_target + actions/checkout rule to detect a direct with.repository: ${{ github.event.pull_request.head.repo.full_name }} input. GitHub explicitly identifies this fork-checkout pattern as security-sensitive, even without an explicit with.ref. It remains a MEDIUM-confidence contextual risk, not evidence of execution or exploit.
• Six focused regression cases were added: three quoted/unquoted direct repository inputs and three negative controls (environment data, non-privileged trigger, base repository). 019d31d clarifies the scope comment. All six regression cases passed in current-head CI.
• Current-head CI run #591 completed SUCCESS on exact head 019d31dcc35525854b117aadaa18921332b6dcca: backend 2,381 passed, 11 skipped, 161 warnings (six additional regression cases versus previous head), frontend 242 passed, 0 failed plus TypeScript/lint/build, Windows security 4 passed, and database migration, PostgreSQL/pgvector/Redis and scripted zero-key evaluation gates passed. The previous run #587 on 384ac3691d688354e951cac5f4d28ef23e562931 had 2,375 backend passed / 11 skipped / 161 warnings; no warning-count regression.
• Draft PR remains unmerged; this simulated QA is not independent human approval. Production issue #10 remains open and release BLOCKED pending host/workload quotas, restricted Git egress, scanner isolation, staging smoke/recovery/rollback, and security/operations signoff. No untrusted repository code was executed locally.

QA follow-up — 1 November 2026 (UTF-8 BOM first-line coverage)

• Source review found a narrow false-negative: UTF-8-BOM-prefixed workflow YAML is valid per YAML 1.2.2, but decoding as plain UTF-8 leaves U+FEFF before the first key. The line-oriented scanner could miss first-line permissions: write-all or on: pull_request_target, suppressing relevant findings.
• Implementation 99fca36 uses strict utf-8-sig decoding to strip only a leading UTF-8 BOM. Regression tests b14aa4a cover first-line token-permission detection and privileged PR-head checkout context with BOM, preserving line-number evidence.
• Exact-head CI verified: run #41234999770 completed SUCCESS on b14aa4aa1ecac8d127b5652266a9e1449ca19a7f. Backend 2,383 passed / 11 skipped / 161 warnings, including both new BOM regressions; frontend 242 passed / 0 failed with type-check/lint/build; Windows security 4 passed. Previous head 019d31dcc35525854b117aadaa18921332b6dcca passed CI #41230145811 with 2,381 passed / 11 skipped / 161 warnings. No backend warning-count increase; SQLAlchemy, Node/Actions runtime and frontend dependency deprecations remain maintenance debt.
• PR stays draft; simulated review is not independent human approval. Issue #10 stays OPEN. Host/workload-enforced workspace quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback, and security/operations sign-off remain unverified. No local execution of untrusted repository code, main write, force-push, merge, deployment, or release-gate waiver.

QA follow-up — 1 November 2026 (explicit PR head/merge checkout refs)

• Implementation 4f37d56 expands the existing contextual github-actions.privileged-untrusted-checkout detector to direct checkout with.ref inputs containing refs/pull/${{ github.event.pull_request.number }}/head or /merge under pull_request_target. These patterns are documented in GitHub's June 18, 2026 checkout security guidance. A finding does not prove execution or an exploit, and checkout protections may block these inputs.
• Regression commit 2b85724 adds nine focused cases: six positive head/merge refs across unquoted/single-/double-quoted forms, plus negative controls for env.ref, unprivileged events, and a different step. No untrusted repository code was executed locally.
• Verified exact-head CI: run #595 completed SUCCESS on 2b857249f173aff8ab0b68b03a4bfbdb4d3ea4c0: backend 2,392 passed / 11 skipped / 161 warnings (nine added regression cases), frontend 242 passed / 0 failed plus type-check/lint/build, Windows 4 passed, migration lifecycle, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation all passed. Previous run #593 on b14aa4aa1ecac8d127b5652266a9e1449ca19a7f had 2,383 backend passed / 11 skipped / 161 warnings. No backend warning-count increase; SQLAlchemy, Node.js/Actions runtime and deprecated frontend dependency warnings remain maintenance debt.
• Keep PR draft, unmerged, and pending independent human code/security review. Issue #10 remains OPEN and production BLOCKED until host-enforced quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback, and operations/security approval are independently verified.

QA follow-up — 1 November 2026 (exact checkout input matching)

• Source inspection found a false-positive in the contextual github-actions.privileged-untrusted-checkout rule: the with.ref and with.repository matchers accepted a PR-head expression as a prefix of a different string, such as ${{ github.event.pull_request.head.sha }}-suffix. That value is not the exact PR-head SHA or fork repository; this is not evidence of an exploit.
• Implementation 542d3ba requires a complete, optionally quoted expression for the two inputs. Regression tests 34da3cc add three composed-value negative cases and two exact quoted-value positive controls. No untrusted repository code was executed locally.
• Verified exact-head CI: run #597 completed SUCCESS on 34da3cc0f6e23214e604c955454dd95657c22372: backend 2,397 passed / 11 skipped / 161 warnings (all five new regression cases passed); frontend 242 passed / 0 failed, type-check/lint/build; Windows 4 passed; migrations, PostgreSQL/pgvector/Redis integration, and scripted zero-key evaluation passed. Prior run #595 on 2b857249f173aff8ab0b68b03a4bfbdb4d3ea4c0 had 2,392 backend passed / 11 skipped / 161 warnings. No backend warning-count increase; existing SQLAlchemy, Node/Actions runtime and deprecated frontend dependency warnings remain maintenance debt.
• Keep PR draft, unmerged and pending independent human code/security review. Production blocker #10 remains OPEN pending independently verified workspace quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback, and security/operations approval. No production gate is waived.

QA follow-up — 1 November 2026 (checkout input key ordering)

• Found a source-attested false negative in backend/app/analysis/workflow_security.py: valid GitHub Actions step mappings may place with.ref or with.repository before uses: actions/checkout@<sha>. The previous single-pass detector activated only after uses, missing privileged PR-head/fork checkout inputs on earlier lines.
• Implementation f3494d8 records same-step candidate input lines until the checkout action is identified, retaining direct with scope and resetting at step boundaries. Regression tests 982ce5e add five cases: reordered ref and repository positives; other-action/cross-step, env.ref, and unprivileged-event negatives.
• Verified exact-head CI: run #599 completed SUCCESS on 982ce5ef745506c80b1a4fefc0134a6912f41c08: backend 2,402 passed / 11 skipped / 161 warnings (five new cases passed); frontend 242 passed / 0 failed, typecheck/lint/build passed; Windows 4 passed; migration, PostgreSQL/pgvector/Redis integration and scripted zero-key evaluation passed. Prior run #597 had 2,397 backend passed / 11 skipped / 161 warnings. No backend warning-count regression; SQLAlchemy, Node/Actions runtime and frontend dependency deprecations remain.
• This remains a bounded, line-oriented contextual risk detector, not a full YAML parser or evidence that untrusted code executed. No untrusted repository code was run locally. PR stays draft and unmerged, pending independent human review. Issue #10 remains OPEN / production BLOCKED pending independent host-enforced workspace quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback, and security/operations sign-off. No release gate was waived.

QA follow-up — 1 November 2026 (step-leading with mapping)

• Static source review identified a narrow false negative: a valid workflow step can begin with - with: and place its sibling uses: actions/checkout@<sha> afterward. The previous indentation stack did not recognize the leading list-item mapping, so direct with.ref and with.repository PR-head/fork inputs were missed in pull_request_target context.
• Implementation 5f4007c records list-item mapping keys at their actual key column and recognizes step boundaries before pushing mappings. Regression commit 2dc2a3b adds four cases: two positive ref/repository detections, a negative env.ref control, and cross-step isolation. The rule remains contextual, not evidence of untrusted code execution.
• Exact-head CI: run #604 completed SUCCESS on 2dc2a3b48a1680a5471c2f966063156050b5a7a3: backend 2,406 passed / 11 skipped / 161 warnings (all four added regressions passed); frontend 242 passed / 0 failed with type-check/lint/build; Windows security 4 passed; migrations, PostgreSQL/pgvector/Redis integration, and zero-key scripted evaluation passed. Previous run #599 on 982ce5ef745506c80b1a4fefc0134a6912f41c08 had 2,402 passed / 11 skipped / 161 warnings. No backend warning-count increase. SQLAlchemy, Node/Actions runtime, and frontend dependency deprecations remain maintenance debt.
• PR remains draft and unmerged pending independent human code/security review. Production blocker #10 remains OPEN pending independently verified host/workload quotas, restricted Git egress, scanner-worker isolation, truthful readiness, staging smoke/recovery/rollback, and security/operations approval. No untrusted repository code was executed locally; no main write, force-push, merge, deployment, approval waiver, or release-gate bypass.

QA follow-up — 1 November 2026 (literal PR refs)

• Static inspection found a contextual false negative: a privileged actions/checkout step using a literal with.ref: refs/pull/123/head or /merge was not recognized; the matcher handled only the ${{ github.event.pull_request.number }} expression form. GitHub's June 18 checkout guidance identifies these PR ref shapes as sensitive.
• Implementation 85b437f recognizes literal numeric refs while retaining exact input and quote matching. Regression tests b239e4f add five focused cases (two positive head/merge detections; three negative scope/trigger/suffix controls).
• Exact-head CI verified: run #608 completed SUCCESS on b239e4f0aafe5df88d0ea4a839cde00446bb049a: backend 2,411 passed / 11 skipped / 161 warnings, including all five new focused regressions; frontend 242 passed / 0 failed with type-check/lint/build; Windows 4 passed; migration, PostgreSQL/pgvector/Redis integration, and scripted evaluation gates succeeded. Previous run #604 on 2dc2a3b48a1680a5471c2f966063156050b5a7a3 had 2,406 backend passed / 11 skipped / 161 warnings. No backend warning-count increase; SQLAlchemy, Node/Actions and frontend dependency deprecations remain.
• This remains passive, MEDIUM-confidence contextual detection, not proof of execution or a security certification. Keep PR DRAFT pending independent human review. Production blocker #10 remains OPEN/BLOCKED pending independently enforced workspace quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback evidence, and security/operations approval. No release gate is waived.

QA follow-up — 1 November 2026 (block-scalar step names)

• Static source inspection found a false-negative coverage gap: a valid YAML step beginning with - name: | or - name: > could hide a subsequent sibling uses: declaration. The scanner skipped the block-scalar header before recording the step boundary and used the list-marker indentation instead of the mapping key column, swallowing sibling action inputs.
• Fix 78ef49c recognizes the step boundary before skipping scalar content and uses the actual mapping key column for the scalar body boundary. This preserves detection of mutable action references and contextual privileged PR-head checkout inputs without treating scalar text as executable actions.
• Four focused regressions passed: literal and folded step-name forms, privileged checkout after a multiline name, and a negative control ensuring block-scalar body text cannot impersonate a uses declaration.
• Verified exact-head CI: run #620 completed SUCCESS on 78ef49cf3e4055149c2e2b47e51f972ac31900f0: backend 2,415 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed plus type-check/lint/build; Windows path/reparse security 4 passed; migration, PostgreSQL/pgvector/Redis integration, and scripted evaluation checks succeeded. Previous run #608 on b239e4f0aafe5df88d0ea4a839cde00446bb049a had 2,411 passed / 11 skipped / 161 warnings. No backend warning-count increase; existing SQLAlchemy, Node/Actions runtime and dependency deprecations remain.
• This is a passive, bounded YAML heuristic, not a complete security audit or proof of execution. PR remains DRAFT pending independent human code/security review. Production blocker #10 remains OPEN pending independently enforced host/workload quotas, restricted Git egress, isolated scanner workers, truthful readiness, production-equivalent staging smoke/recovery/rollback evidence, and security/operations approval. No repository code was executed locally; no main write, force-push, merge, deployment, approval waiver, or release-gate bypass.

[yashaskn8]

QA / security review — 2026-10-31 (draft; not approved for merge)

Evidence checked: PR #6 remains draft, targets main, and has no submitted human review or review threads at the time of inspection. Earlier CI run 540 completed with backend (including PostgreSQL/pgvector/Redis and scripted agent gate) passed, Windows path-security passed, and frontend failed (228 passed / 14 failed out of 242; build skipped). That result belongs to an older commit, not this head.

Feature-branch changes: The source scanner had a demonstrable false negative for quoted on / pull_request_target keys; added three parameterized regressions and corrected the scoped event parser in 18d7233. It also missed the normal - name: ... then uses: actions/checkout@... step form; fixed step tracking in 04ef209 and added regression in 988c1c5. No untrusted repository code was run locally; the new tests have not yet been confirmed passing in CI.

External security context: GitHub's September 17, 2026 Actions execution-protections GA says its default pull_request_target restriction for applicable public repositories is scheduled for enforcement on December 2, 2026; GitHub also hardened checkout for PR-target events. These controls complement, not replace, passive source findings. Do not weaken/opt out of these protections for this PR.

Remaining blockers: Current-head CI must complete green (including new workflow-security tests, frontend build, Windows checks and integration gates); a human must review the scoped YAML heuristics and evidence quality. The detector is not a full YAML/inter-job trust interpreter, dynamic uses expressions are not fully evaluated, and platform-specific file replacement/reparse races need explicit review. Production release eligibility remains intentionally fail-closed; no gate was bypassed. Do not merge, deploy or mark ready solely on this review.

[yashaskn8]

Simulated senior-engineering QA follow-up — 2026-10-31 (COMMENT only; not approval)

Current feature head remains 93e6864ab42632174352609c621b73c23c57192e; CI run #566 is green (backend 2,339 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed; Windows 4 passed). No new branch commit or verified warning-count increase was found. Node.js 20 action-runtime and SQLAlchemy deprecation warnings remain maintenance items, not production release evidence.

Source-review edge case requiring a focused regression: backend/app/analysis/workflow_security.py currently matches permissions: write-all with _WRITE_ALL.fullmatch(raw_line) regardless of YAML mapping scope. A workflow containing an env: mapping with a permissions: write-all environment variable could therefore be reported as granting broad GITHUB_TOKEN permissions even though the key is not a workflow/job permissions declaration. This is a static code inference, not a test-confirmed regression. Recommend a regression covering environment-variable keys versus actual workflow/job token permissions, followed by a scope-aware fix that preserves genuine findings; do not claim this is resolved without CI proof. The line-oriented parser has documented incomplete YAML semantics, so an ad-hoc regex suppression could introduce false negatives.

Independent human code/security review is still absent. Release blocker #10 stays open until host/workload quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback and independent approval are verified. No code change, merge, deployment, or release-gate bypass in this follow-up.

[yashaskn8]

Simulated senior-engineering QA — 31 Oct 2026 (comment only; NOT approval)

Fix: c333223317aa6841021153ea56916a239bb60fa2 limits github-actions.write-all-token to workflow-root and direct jobs.<job_id> declarations. Prior source inspection showed nested env.permissions: write-all could be falsely classified as broad GITHUB_TOKEN access. Added four negative cases (workflow/job/step environment and action with input) plus a positive job-scope regression. This is a bounded indentation/mapping heuristic, not a full YAML interpreter.

Current-head verification: Actions run #570 SUCCESS on c333223317aa6841021153ea56916a239bb60fa2: backend 2,344 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed with type-check/lint/build; Windows 4 passed; integration and zero-key scripted evaluation gates succeeded. The backend warning count remains 161 versus previous successful head. Existing SQLAlchemy and Node/Actions runtime deprecation warnings are still maintenance debt.

External guidance: GitHub workflow syntax confirms permissions is effective at workflow or job scope; secure pull_request_target guidance continues to caution against privileged checkout/execution of untrusted PR code. GitHub documents default policy enforcement for affected public repositories on 2 Dec 2026.

Release decision: PR remains draft, no submitted human approval; production blocker #10 stays OPEN. CI does not independently verify enforced workspace quotas, restricted Git egress, scanner-worker isolation, truthful readiness, production-equivalent staging smoke/recovery/rollback, or security/operations sign-off. No merge, main write, deployment, waiver, or local execution of untrusted repository code was performed.

[yashaskn8]

Simulated senior-engineering QA — 31 Oct 2026 (not human approval)

New verified fix: d9720294809e22b57608efda633186201c4098f5 suppresses github-actions.mutable-action-reference false positives when uses: is ordinary YAML data under env: or an action with: input. Added three negative regression inputs and one positive control confirming a real mutable step action is still flagged. The scanner remains a conservative, incomplete YAML heuristic.

Current-head CI: run #574 completed SUCCESS on the exact SHA: backend 2,348 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed plus type-check, lint and build; Windows 4 passed; PostgreSQL/pgvector/Redis and zero-key scripted evaluation gates passed. Previous green head c333223 had 2,344 backend passed / 11 skipped / 161 warnings, so the new four cases passed with no backend warning-count increase. Existing SQLAlchemy and Node/Actions deprecations remain maintenance debt.

Release decision: PR stays draft, with no submitted independent human review. Issue #10 remains OPEN: infrastructure-enforced workspace quotas, restricted Git egress, external scanner isolation, truthful readiness, staging smoke/recovery/rollback, and independent security/operations sign-off are not established by CI. No untrusted repository code was executed locally; no main write, force-push, merge, deployment, or gate waiver was performed.

[yashaskn8]

Simulated senior-engineering QA — 31 October 2026 (comment only; NOT approval)

New source-backed correction: Workflow uses declarations with valid quoted YAML keys ('uses': / "uses":) were missed by the previous unquoted-only matcher. 2bd8b9ab8b5965154b5b74440f3f8a130713689b supports quoted keys while preserving job/step scope; 02c5dd7021c99321ce7523ccc1b3afd5312f3339 adds six regression cases: both quote styles for step and reusable-job uses, a negative env-data case, and contextual privileged checkout detection.

Verified exact-head CI: run #581 SUCCESS on 02c5dd7021c99321ce7523ccc1b3afd5312f3339. Backend 2,359 passed / 11 skipped / 161 warnings, including all six new tests; frontend 242 passed / 0 failed, type-check/lint/build passed; Windows path/reparse 4 passed; migration, PostgreSQL/pgvector/Redis integration and zero-key scripted gates passed. Previous green run #577 on ba892407dc7f6e3ef15a2cda9f1c57165d098598 had 2,353 passed / 11 skipped / 161 warnings. No backend warning-count increase; SQLAlchemy and Node/Actions/dependency deprecation warnings remain.

Security/release boundary: The detector is still a bounded line-oriented YAML heuristic, not full expression/trust-flow analysis. GitHub workflow syntax and secure pull_request_target guidance remain applicable; GitHub's September 2026 update schedules default policy enforcement for affected public repositories on 2 December 2026. Independent human code/security review remains required. PR stays draft; production issue #10 remains OPEN pending independently enforced quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback and security/operations approval. No local untrusted code execution, main write, force-push, merge, deployment, approval waiver, or release-gate bypass.

[yashaskn8]

Simulated senior-engineering QA — 31 October 2026 (COMMENT only; not independent human approval)

Scoped false-negative correction: Valid quoted YAML keys 'permissions' / "permissions" and 'ref' / "ref" were not recognized by the workflow permission and privileged-checkout rules. Implementation c5c152db23d6ab90abe4b65e6540a7e5a1241bd4 changes only the two key matchers; tests 8840f4ac280dbd2ddd905f9cb7f3072b9d21c90b add 10 focused parametrized cases, including positive workflow/job permission and checkout input cases and negative env-data controls. These are evidence-based heuristics, not full YAML parsing.

Exact-head verification: CI run #41219708546 completed SUCCESS on 8840f4ac280dbd2ddd905f9cb7f3072b9d21c90b: backend 2,369 passed / 11 skipped / 161 warnings, including all 10 new tests; frontend 242 passed / 0 failed plus type-check/lint/build; Windows path/reparse checks 4 passed; migrations, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation passed. Prior exact-head run #581 had 2,359 backend passed / 11 skipped / 161 warnings, so no backend warning-count regression. SQLAlchemy and Node/Actions deprecations persist.

Current security guidance: GitHub's September 17 announcement says applicable public repositories' default pull_request_target restriction will be enforced 2 December 2026; June 18 checkout guidance describes fork-head checkout safeguards and their limits. Neither is proof of RepoLens production readiness.

Release decision: PR #6 stays draft, unmerged, pending independent human code/security review. Issue #10 remains OPEN with no independent evidence yet of host-enforced workspace quotas, restricted Git egress, scanner isolation, readiness validation, staging smoke/recovery/rollback, or operations/security approval. No local untrusted repository code execution, main write, force-push, merge, deployment, approval waiver or release-gate bypass was performed.

[yashaskn8]

Simulated senior-engineering QA — 31 Oct 2026 (COMMENT only; not independent approval)

Scoped false-positive fix: Inline on: flow mappings such as {push: {branches: [pull_request_target]}} were previously treated as privileged pull_request_target events because the detector matched the token anywhere inside the inline value. Implementation 2b65691eb95d221429e5c7b2ee7d968429f33379 distinguishes direct scalar/list/map events from nested filter data. Tests 384ac3691d688354e951cac5f4d28ef23e562931 add six cases covering nested negative controls and genuine direct event declarations.

Verified exact-head CI: run #587 SUCCESS on 384ac3691d688354e951cac5f4d28ef23e562931: backend 2,375 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed, type-check/lint/build passed; Windows 4 passed; migrations, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation passed. Previous head 8840f4ac280dbd2ddd905f9cb7f3072b9d21c90b: 2,369 passed / 11 skipped / 161 warnings. No warning-count increase. Existing SQLAlchemy and Node/Actions runtime deprecations remain.

No additional repository bug issues found; issue #8 still tracks historical main frontend failures. This is a bounded line-oriented heuristic, not full YAML evaluation or security certification.

Release decision: BLOCKED. PR remains draft, awaiting independent human code/security review. Issue #10 stays OPEN pending independently enforced workspace quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback evidence and security/operations approval. No untrusted repository code was executed locally, and no main write, force-push, merge, deployment, human-approval waiver or release-gate bypass was performed.

[yashaskn8]

Simulated senior-engineering QA — 1 Nov 2026 (COMMENT only; not human approval)

Verified targeted fix: 0fadc56993f99756ed96d827ad55effd060b6bda extends the existing MEDIUM-confidence github-actions.privileged-untrusted-checkout warning to a direct checkout with.repository: ${{ github.event.pull_request.head.repo.full_name }} in a pull_request_target workflow. GitHub's checkout security announcement explicitly identifies this fork-repository input as a sensitive pattern. The finding is contextual and does not assert that untrusted code was executed. 019d31dcc35525854b117aadaa18921332b6dcca clarifies the scope comment.

Regression evidence: Six new cases passed: three direct repository inputs (plain, single-quoted and double-quoted keys) and three negatives (environment variable, ordinary pull_request event, base-repository expression). CI run #591 completed SUCCESS against exact head 019d31dcc35525854b117aadaa18921332b6dcca: backend 2,381 passed / 11 skipped / 161 warnings, frontend 242 passed / 0 failed with type-check/lint/build, Windows 4 passed, migrations/integration and zero-key scripted evaluation successful. Previous exact-head run #587 had 2,375 backend passed / 11 skipped / 161 warnings. No backend warning-count increase. Existing SQLAlchemy and Node.js/Actions deprecations remain.

Residual risks: This is line-oriented passive inspection, not complete YAML expression, trust-flow or workflow execution analysis. GitHub's September 17, 2026 policy announcement schedules default pull_request_target policy enforcement for affected public repositories on December 2, 2026. No claim is made about RepoLens's applicable repository policy.

Release decision: PR #6 stays draft, unmerged for independent human code/security review. Issue #10 remains OPEN / production BLOCKED until independent host/workload workspace quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback and security/operations approval are verified. No local execution of repository code, write to main, force-push, merge, deploy or gate bypass.

[yashaskn8]

Simulated senior-engineering QA — 1 November 2026 (COMMENT only; not human approval)

Source-backed false-negative fix: YAML 1.2.2 permits a UTF-8 byte-order mark at the start of a document. The workflow scanner decoded it as U+FEFF, which hid first-line permissions: write-all and on: pull_request_target from the line-oriented detectors. Implementation 99fca36e58f44283aae0cc44e9422f1ffbf845e9 switches to strict utf-8-sig decoding (only leading BOM removed); regression commit b14aa4aa1ecac8d127b5652266a9e1449ca19a7f adds two focused cases preserving source line numbers. Reference: YAML 1.2.2 §5.2.

Verified exact-head CI: run #41234999770 completed SUCCESS on b14aa4aa1ecac8d127b5652266a9e1449ca19a7f: backend 2,383 passed / 11 skipped / 161 warnings (both new cases passed); frontend 242 passed / 0 failed plus type-check/lint/build; Windows 4 passed. Previous run #41230145811 on 019d31dcc35525854b117aadaa18921332b6dcca had 2,381 passed / 11 skipped / 161 warnings. No backend warning-count regression. Existing SQLAlchemy, Node/Actions runtime and deprecated frontend dependencies remain maintenance items.

Security and release: This is a bounded passive YAML heuristic, not a complete parser or security certification. GitHub privileged-workflow guidance remains applicable; affected public repositories' default pull_request_target restrictions are scheduled for 2 December 2026. Draft PR #6 remains unmerged and requires independent human code/security review. Production blocker #10 stays OPEN until independently enforced workspace quotas, restricted Git egress, scanner-worker isolation, truthful readiness, staging smoke/recovery/rollback and security/operations approval are verified. No local execution of untrusted repository code, write to main, force-push, merge, deployment, approval waiver or release-gate bypass.

[yashaskn8]

Simulated senior-engineering QA — 1 November 2026 (COMMENT only; not human approval)

Verified narrow false-negative correction: GitHub documents refs/pull/${{ github.event.pull_request.number }}/head and /merge as unsafe fork-checkout ref shapes under pull_request_target. The passive scanner previously recognized github.event.pull_request.head.sha/ref and fork with.repository, but not these explicit refs. Implementation 4f37d562ba65d31b90a0064bda278d07e6629bd5 adds a direct with.ref matcher. Tests 2b857249f173aff8ab0b68b03a4bfbdb4d3ea4c0 add nine focused regressions (six positives and three scope/trigger negatives). This is a MEDIUM-confidence contextual warning, not proof of exploitation. GitHub checkout guidance, June 18, 2026.

Exact-head CI: run #595 SUCCESS on 2b857249f173aff8ab0b68b03a4bfbdb4d3ea4c0: backend 2,392 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed, TypeScript/lint/build passed; Windows security 4 passed; migrations, PostgreSQL/pgvector/Redis integration and zero-key scripted evaluation passed. Prior run #593 on b14aa4aa1ecac8d127b5652266a9e1449ca19a7f had 2,383 backend passed / 11 skipped / 161 warnings. No backend warning regression. Existing SQLAlchemy, Node 20/Actions runtime, and npm deprecation warnings remain.

Decision: PR #6 stays OPEN / DRAFT / UNMERGED, awaiting independent human code/security review. Issue #10 stays OPEN: host-enforced per-scan quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback and security/operations approval require independent infrastructure evidence. No production gate waiver. No local execution of untrusted repository code, default-branch write, force-push, merge, or deployment.

[yashaskn8]

Simulated senior-engineering QA — 1 November 2026 (COMMENT only; not independent approval)

Source-backed false-positive correction: The contextual github-actions.privileged-untrusted-checkout matcher previously accepted PR-head/fork-repository expressions as prefixes of different with.ref or with.repository values (for example, ${{ github.event.pull_request.head.sha }}-suffix). Implementation 542d3baf86b226d2d65d1d6c31d66fe62d400608 now matches complete, optionally quoted expressions; regression commit 34da3cc0f6e23214e604c955454dd95657c22372 adds three negative composed-input cases and two positive exact-quoted controls. The finding remains contextual, not proof of execution or exploitation.

Verified exact-head CI: run #597 SUCCESS on 34da3cc0f6e23214e604c955454dd95657c22372: backend 2,397 passed / 11 skipped / 161 warnings, including all five new cases; frontend 242 passed / 0 failed with type-check/lint/build; Windows 4 passed; migration, PostgreSQL/pgvector/Redis and scripted zero-key evaluation gates passed. Previous run #595 on 2b857249f173aff8ab0b68b03a4bfbdb4d3ea4c0 had 2,392 backend passed / 11 skipped / 161 warnings. No backend warning-count increase; existing SQLAlchemy and Node/Actions/dependency deprecations remain.

Release decision: Keep PR draft and unmerged for independent human code/security review. Issue #10 remains OPEN, with production BLOCKED pending independent workspace quotas, restricted Git egress, scanner isolation, truthful readiness, staging smoke/recovery/rollback and security/operations signoff. No untrusted repository code was executed locally; no main write, force-push, merge, deployment, human approval waiver or release-gate bypass.

[yashaskn8]

Simulated senior-engineering QA follow-up (1 Nov 2026; not human approval): Found and corrected a false negative for privileged actions/checkout when the direct with.ref or with.repository input appears before uses in the same YAML step. Implementation f3494d81; five regression cases 982ce5ef cover two positives and three negative controls. Exact-head CI #599 SUCCESS: backend 2,402 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed; Windows 4 passed; migration, integration, and scripted evaluation passed. Previous exact-head CI had 2,397 backend passed and 161 warnings; no backend warning-count increase. Existing SQLAlchemy, Node/Actions and frontend dependency deprecations remain. The scanner is passive and line-oriented, not a full YAML interpreter or security certification. PR #6 stays DRAFT / UNMERGED for independent human review. Production issue #10 stays OPEN / BLOCKED pending independently enforced workspace quotas, restricted Git egress, isolated scanner workers, truthful readiness, staging smoke/recovery/rollback and security/operations approval. No local execution of untrusted repository code, main write, force-push, merge, deployment or release-gate waiver.

[yashaskn8]

Simulated senior-engineering QA follow-up (2026-11-01): step-leading - with: false-negative fixed by 5f4007c, with four focused regressions in 2dc2a3b. Exact-head CI #604 succeeded: backend 2,406 passed / 11 skipped / 161 warnings; frontend 242 passed / 0 failed; Windows security 4 passed; migrations, PostgreSQL/pgvector/Redis and zero-key evaluation passed. No warning-count increase from #599. This is not human approval or production certification. Keep PR draft and issue #10 open pending independent quota, Git egress, scanner isolation, readiness, staging smoke/recovery/rollback, and security/operations evidence.

[yashaskn8]

Simulated senior-engineering QA — 1 Nov 2026 (not independent human approval). Found a source-backed false negative: privileged actions/checkout with a literal numeric with.ref: refs/pull/123/head or /merge was not detected, although GitHub's checkout guidance treats these PR refs as security-sensitive. Implementation 85b437f extends exact ref matching and preserves quote pairing; regression tests b239e4f add two positive and three negative controls. All five passed in exact-head CI #608 SUCCESS: backend 2,411 passed / 11 skipped / 161 warnings, frontend 242 passed / 0 failed, Windows 4 passed; migrations, integration, scripted evaluation, typecheck/lint/build passed. Previous #604 had 2,406 backend passed and 161 warnings: no warning-count regression. Existing SQLAlchemy, Node/Actions runtime, and frontend dependency warnings remain. Scanner detection is contextual (MEDIUM confidence), not proof of code execution or a complete audit. Keep PR draft/unmerged for independent human review and issue #10 open/blocked until independently verified quotas, Git egress, scanner isolation, readiness, staging smoke/recovery/rollback and security/operations sign-off. No release gate waived.

[yashaskn8]

Simulated senior-engineering QA follow-up (1 Nov 2026; not independent human approval):

• Identified a static scanner false negative: a YAML step starting with - name: | or - name: > hid subsequent sibling uses / checkout inputs.
• Fix + four focused regressions: 78ef49c
• Exact-head CI https://github.com/yashaskn8/RepoLens/actions/runs/41307320712 SUCCESS: backend 2,415 passed, 11 skipped, 161 warnings (all four new regressions passed); frontend 242 passed, 0 failed; Windows 4 passed; migrations, integration, scripted evaluation, typecheck/lint/build passed.
• Previous head b239e4f0aafe5df88d0ea4a839cde00446bb049a had 2,411 backend passes and 161 warnings: no warning-count regression.
• This is passive, bounded evidence, not full YAML interpretation or proof of exploit. Existing Node/Actions and SQLAlchemy deprecations remain maintenance concerns.
• Keep PR draft; production remains BLOCKED. Issue Production release gate: enforce acquisition and scanner isolation #10 is open with no independently verified host quotas, restricted Git egress, scanner isolation, readiness, staging smoke/recovery/rollback, or security/operations approval. No local untrusted-code execution, main write, force-push, merge, deployment, or gate waiver.