Repository navigation
chore(ci): harden workflows + add zizmor security analysis - #190
Merged
Merged
Conversation
- Add Security Analysis workflow running oxc-project/security-action
- Set persist-credentials: false on all actions/checkout steps
- Add top-level permissions: {} and least-privilege per-job permissions
- Drop pnpm cache from publish.yml setup-node and ignore residual zizmor cache-poisoning warnings (mitigated by --frozen-lockfile + provenance)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
cpojer
pushed a commit
that referenced
this pull request
Sep 11, 2026
…en usage enforcement (#190) Admin suspend/unsuspend/plan-change only touched the slug routing entry, leaving custom-domain (`domain:<host>`) routes, sandbox-block / ai-block KV, and the UsageCounter DO latches out of sync — so a project stayed 429'd on its custom domain after an admin unsuspend (the void.cloud case). - routing.ts: reason-aware `applyRoutingSuspension` (force / matchReason so an admin suspension outranks a usage one and a usage reconcile never lifts an admin block); `setProjectsRoutingSuspension` fans out to the slug AND every domain route (including crash-window pending domains). - admin/users.tsx: suspend stamps edge KV first, DB last (fail-closed + retryable); unsuspend clears edge + DO latch first, DB last; plan-change optimistically clears request+sandbox+AI; reserved usage reasons rejected and partial failures surfaced as a retryable 500 instead of a false success. - usage-counter.ts: retry-safe cleanup — flip suspension latches only AFTER the KV/DB writes succeed (rollover, reevaluate-sandbox, record) and defer the rollover billingPeriodStart mutation past the awaits, so a mid-cleanup throw is retried instead of stranding ai-block / sandbox-block keys (sandbox has no /init re-stamp, so a latch-before-write there failed open). - index.ts: latch-driven self-healing request reconcile every scheduled pass. 959/959 api tests, typecheck/lint/fmt clean. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security Analysisworkflow running oxc-project/security-action on PRs and on pushes that touch.github/workflows/**.persist-credentials: falseon everyactions/checkoutstep.permissions: {}plus least-privilege per-job permissions (contents: read, preservingid-token: writeonpublish).cache: pnpmfrompublish.ymlsetup-node(release path runs--frozen-lockfile+ provenance, so a poisoned pnpm cache could otherwise compromise published artifacts) and add inline# zizmor: ignore[cache-poisoning]for the residual Low-confidence warnings.