Dismiss CodeQL #14 (untrusted-checkout-toctou) with guard test#436

Merged

igerber merged 12 commits into

mainfrom

dismiss-codeql-14

May 15, 2026

Commits on May 14, 2026

Dismiss CodeQL #14 with documented rationale + guard test
igerber
committed
Address PR #436 R1 P1s: pin all dismissal invariants + fail-closed guard
igerber
committed
Address PR #436 R2 P1s: step/branch-scope assertions; fail-closed guards
igerber
committed
Address PR #436 R3 P1: pin EXACT BASE_SHA staging command, not substrings
igerber
committed
Address PR #436 R4 P1: scope staging assertion to build-prompt step + ordering/overwrite check
igerber
committed
Address PR #436 R5 P1: token-boundary py-exec match + ln-symlink overwrite + regression tests
igerber
committed
Address PR #436 R6 P1: shlex-based shell tokenization for fail-closed parsing
igerber
committed