Repository navigation

🐛 fix(release): close audit gaps and trim inputs - #18

Merged

gaborbernat merged 44 commits into

mainfrom

fix/audit-round13

Oct 25, 2026

Merged

🐛 fix(release): close audit gaps and trim inputs#18
gaborbernat merged 44 commits into
mainfrom
fix/audit-round13

Commits on Oct 25, 2026
- fix(hooks): run only the checked root hook config
  gaborbernat
  committed
  90f0fc3
- fix(hooks): prove tagged revisions before builds
  gaborbernat
  committed
  6f37f2f
- fix(release): check tag ancestry before hooks
  gaborbernat
  committed
  f094b32
- fix(hooks): reject non-Python hook dependencies
  gaborbernat
  committed
  50c7f0f
- fix(marketplace): accept retries after reconciling
  gaborbernat
  committed
  3e073b0
- test(marketplace): cover unidentified deployments
  gaborbernat
  committed
  174dfc5
- fix(mise): check the binary digest before it runs
  gaborbernat
  committed
  8c6a25a
- fix(mise): keep line endings and reject null digests
  gaborbernat
  committed
  f7668af
- fix(lock): require normalized dependency groups
  gaborbernat
  committed
  055984f
- fix(lock): report a non-table producer setting
  gaborbernat
  committed
  172cad6
- style: format round 13 fixes
  gaborbernat
  committed
  c0e3a4e
- fix(hooks): let humans add cooled managed pins
  gaborbernat
  committed
  2692172
- fix(lock): accept the upgraded resolver pin
  gaborbernat
  committed
  a20ac72
- fix(lock): pin uv from the resolver group only
  gaborbernat
  committed
  dfb0635
- fix(news): check the lock when workflows change
  gaborbernat
  committed
  1101041
- test(news): cover primary lock edits and removal
  gaborbernat
  committed
  e920d8e
- fix(hooks): recheck after earlier heads mature
  gaborbernat
  committed
  a135c0f
- fix(hooks): explain an invalid cooldown minimum
  gaborbernat
  committed
  5573523
- test(hooks): require the App on the updater branch
  gaborbernat
  committed
  f211eb7
- test(hooks): give the frozen hook test a unique name
  gaborbernat
  committed
  495e6f4
- feat(lock)!: drop the Nab primary lock path
  gaborbernat
  committed
  df1a6e5
- perf(lock): install Nab only when a step needs it
  gaborbernat
  committed
  e58e7d9
- refactor(lock)!: detect the resolver upgrade repo
  gaborbernat
  committed
  8d32650
- refactor(notes)!: write notes to a fixed path
  gaborbernat
  committed
  efbdbe5
- refactor(release)!: read the patch from a fixed path
  gaborbernat
  committed
  a9e48f9
- refactor(pypi): inline the listing wait
  gaborbernat
  committed
  4768364
- refactor(lock): drop checks the parser already makes
  gaborbernat
  committed
  4b3d58a
- test(lock): bound the local tool exemption
  gaborbernat
  committed
  3df4112
- test(pypi): match the missing directory error
  gaborbernat
  committed
  5abe719
- perf(lock): skip checks repeated on the same lock
  gaborbernat
  committed
  687923d
- refactor(release): share the tagged source check
  gaborbernat
  committed
  adc7bb2
- refactor(release): share the local tool install
  gaborbernat
  committed
  5fd0697
- build: drop the unused Nab policy table
  gaborbernat
  committed
  954c165
- test(marketplace): check the job run against None
  gaborbernat
  committed
  6bfe4f6
- test: measure the test suite at full coverage
  gaborbernat
  committed
  95804dc
- test: autospec network and platform mocks
  gaborbernat
  committed
  f244f53
- test: drop tests that restate workflow YAML
  gaborbernat
  committed
  6eb9760
- test(release): check the tag list given to tags
  gaborbernat
  committed
  769c2b9
- docs(changelog): note the 3.0.1 caller permissions
  gaborbernat
  committed
  7536922
- docs: describe the round 13 release changes
  gaborbernat
  committed
  a01fd0f
- refactor(release): expose the local tool like locked ones
  gaborbernat
  committed
  c573c63
- refactor(lock)!: rename the cutoff patch check
  gaborbernat
  committed
  7304ef8
- refactor: tighten round 13 code and tests
  gaborbernat
  committed
  585d1e3
- refactor(tools): inline single-use constants
  gaborbernat
  committed
  522211e

Commits

Commits on Oct 25, 2026