feat(cli): review and apply saved SECURITY.md drafts - #489
feat(cli): review and apply saved SECURITY.md drafts#489mldangelo-oai wants to merge 67 commits into
Conversation
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: b1de4d9394
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review Please review exact head Local TypeScript and formatting checks passed. The combined policy, CLI, API, and configuration suites passed: 189 tests passed, 8 platform-specific tests skipped, and 0 tests failed. Exact-head native Windows package and matrix checks are pending. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 326af9b988
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head The Unix permission-race regression failed on the preceding head and passes with this change. Local TypeScript, formatting, and combined policy, CLI, API, and configuration checks passed; exact-head native Windows package and matrix checks are pending. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ee5fe1c43
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head Real Unix permission-metadata and verification-retry regressions failed on the preceding head and now pass. Local TypeScript, formatting, and combined policy, CLI, API, and configuration checks passed; exact-head native Windows and macOS checks are pending. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95f168ba41
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head Real read-only and rollback access-control regressions, cross-filesystem recovery, retry races, existing alias verification, and atomic concurrent-writer protections pass locally. Exact-head native Windows and macOS checks are pending. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a47da34698
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the exact current head Local validation: 196 tests passed, 11 platform-specific tests skipped, and no tests failed. Fresh Linux, macOS, and Windows CI is running. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: afbdd0e8ff
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact current head Local validation: 196 tests passed, 12 platform-specific tests skipped, and no tests failed. Fresh native Windows, Linux, and macOS CI is running. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a1ed9c1c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const temporary = join( | ||
| dirname(target.targetPath), | ||
| `.SECURITY.md.${randomUUID()}.tmp`, | ||
| ); |
There was a problem hiding this comment.
On SELinux systems with a filename-specific type transition for SECURITY.md, creating the inode under this randomized .tmp name gives it the temporary file's context, and the later hard-link or rename does not recompute the label for the final name. Because the new-policy path has no metadata reference, post-write verification never notices that the installed policy has the wrong mandatory-access context. The earlier existing-policy context preservation does not cover this branch; create or relabel the inode using the target's expected context and verify it after installation.
AGENTS.md reference: sdk/typescript/AGENTS.md:L27-L27
Useful? React with 👍 / 👎.
|
@codex review Please review exact current head The separate open review item concerning filename-specific SELinux context transitions for a brand-new policy remains unresolved and is intentionally not changed by this Windows-only update. Local validation: 196 tests passed, 13 platform-specific tests skipped, and no tests failed. Fresh native Windows, Linux, and macOS CI is running. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f061f012d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact current head The separate open review item concerning filename-specific SELinux context transitions for a brand-new policy remains unresolved and is intentionally not changed by this update. Local validation: 197 tests passed, 14 platform-specific tests skipped, and no tests failed. Fresh native Windows, Linux, and macOS CI is running. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bfac0391e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact current head The separate open review item concerning filename-specific SELinux context transitions for a brand-new policy remains unresolved and is intentionally not changed by this update. Local validation: 198 tests passed, 14 platform-specific tests skipped, and no tests failed. Fresh native Windows, Linux, and macOS CI is running. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9b4f0678b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact current head The separate open review item concerning filename-specific SELinux context transitions for a brand-new policy remains unresolved and is intentionally not changed by this update. Filesystem change-generation checks do not make their final observation and the following operating-system move one atomic operation. Local validation: 199 tests passed, 14 platform-specific tests skipped, and no tests failed. Fresh native Windows, Linux, and macOS CI is running. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Summary
Add an owner-controlled way to review and apply a saved
SECURITY.mddraft.policy --applyloads the draft without starting Codex, validates its repository and component scope, shows the exact diff, and writes only after confirmation or an explicit--write.This PR remains stacked on #536.
Changes
Testing
Checks on
645bd253eadd71d9c4dbfae14069604380b0d920:./node_modules/.bin/tsc --noEmit: passed../node_modules/.bin/prettier --check src/security-policy.ts tests-ts/security-policy.test.ts: passed.git show --format= --check HEAD: passed.bun test --timeout 120000 tests-ts/security-policy.test.ts tests-ts/cli-policy.test.ts tests-ts/api-policy.test.ts tests-ts/config.test.ts: 199 passed, 14 platform-specific tests skipped, 0 failed.Risk and rollout
Applying a draft replaces the selected
SECURITY.mdonly after explicit approval. It does not stage, commit, or publish the policy. If verification fails after the write, the command reports the installed path and any recovery path for owner reconciliation. Windows descriptor operations fail closed and do not broaden sandbox or filesystem permissions or adjust token privileges. Existing Linux policy-context preservation uses only the existing account's permissions. Recovery generation checks detect concurrent content or metadata changes according to filesystem change-time precision; they do not make the final check and the subsequent operating-system move one atomic operation. This PR adds no npm dependencies.Open review item: Filename-specific SELinux context transitions when creating a brand-new policy remain unresolved and are not changed by this update.
Merge #536 first, then retarget this PR to
mainand rerun exact-head validation before merge.Public disclosure review
The second attestation remains unchecked because preexisting public history includes contributor metadata and automated review artifacts.