Repository navigation
fix: verify serving Telegram token versions with protected outputs - #618
Merged
Merged
Conversation
Pigbibi
force-pushed
the
codex/readonly-serving-route-identity
branch
from
October 13, 2026 14:02
56a3c01 to
9c2d74d
Compare
6 of 14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
旧通知诊断读取服务 template 与 Secret Manager latest，可能把运行 revision 的固定版本误判为相同 bot。现在从实际正流量 revision 读取唯一容器的绑定，精确版本按原引用读取；latest、split、歧义和失败保持 unknown/null，不通过次优 token 或模板回退制造匹配。
GET getMe 只比较本项目参考 bot，中央 canonical route、chat/topic 仍 unknown。公开输出保留固定状态、三态相等关系、序号及有效 workflow 源提交；原配置通过同值 reusable secrets 在 runner header 前注册掩码，不输出私有身份或自由错误。未改变生产设置、secret、IAM、路由、发送与交易行为。
同步最新 main（含独立镜像诊断）后完成组合验证：1647 passed / 5 既有 skipped、105 focused、Ruff、全 workflow actionlint 1.7.12 + ShellCheck 0.10、锁文件、pin、依赖与 10 条 inert startup 路径通过。原 JSON secret 边界测试保留，仅明确新增六字段的 required/source 合同，增加 12 个拒绝反例。
全 workflow lint 同时发现既有生命周期 workflow 两处 SC2155：export 与命令替换混用会掩盖 cat 失败。本 PR 仅拆开 export/赋值，正常与 disabled 行为保持；10 次合成 shell 探测确认缺文件在既有 runner -e 下停止，不调用真实生命周期业务。
关联 QuantRuntimeSettings#632。工程最终 CI、正常合并后再运行 main 的真实只读诊断；本批不代表自然通知、中央批准或生产恢复验收。