Conversation
…narrowing # Conflicts: # CHANGELOG.md
…image-write-inspection
fix(configs): stop three presets opting into read exfiltration
google.golang.org/grpc v1.82.1 is vulnerable to heap exhaustion from HTTP/2 DATA frame fragmentation, fixed upstream in 1.83.1. The pin is an indirect requirement reached through sigstore-go's Rekor client on the opt-in image_trust path, never the core proxy path. Grype matches on module version rather than reachability, so the finding failed both the "Security: Grype & Govulncheck" job and "CI: Verify"'s Docker Build on every branch that ran them, including main at v2.0.0. That is what was reddening Renovate PR #398, not anything the PR changed. govulncheck reports zero reachable vulnerabilities either side of the bump. go build, go vet and go test ./... are green on v1.83.2.
Four independent breaks, all in workflows that only run on a schedule, so
none of them gates a PR and all of them had been red for weeks.
- ci(quality): run Gremlins from the module root. The module moved to the
repo root and this workflow kept working-directory: app plus
./internal/<pkg> package paths. gremlins unleash resolves the module
from the cwd rather than walking up for go.mod, so all six shards failed
in ~1s with "not in a Go module". Reproduced locally: ./internal/filter
does not resolve from the root, ./app/internal/filter does.
- ci(quality): let the badge job take its own skip-and-warn path. The step
inherits -e from GitHub's default bash -e {0}, and set -uo pipefail does
not clear it, so an unparseable report aborted the step before the
warn-and-continue branch below could run. || true on both assignments
also fixes a latent pipefail + head -1 SIGPIPE case that returns 141
from a pipeline which had already parsed the value.
- ci(quality): anchor the Engine API scrape to the version heading. The
bare v1.NN match picks up SVG path coordinates (v1.875, v1.125) from the
page's inline icons, which is why the 2026-09-01 run demanded a bump to
Engine API 1.875. Verified against the live page: the anchored pattern
yields 1.55, matching the existing pin. A three-digit minor now fails
loudly instead of becoming an alert.
- ci(security): pin the ZAP baseline job to ubuntu-24.04, the last
ubuntu-latest of 38 jobs.
The pinned ceiling in app/testdata/docker-api/max-supported-version.txt is
correct at 1.55 and is deliberately not touched.
zizmor started reporting two self-repository findings on release-cut.yml and release-from-tag.yml, which blocks every push from the repo. Neither workflow changed; the audit is new. Two separate problems fell out of chasing it. - ci(quality): pass --config to zizmor explicitly. Auto-discovery resolves the config relative to the repository root, and in a linked worktree that resolves to the main checkout. A push from .claude/worktrees/<name> was auditing the branch's workflows against the main checkout's .github/zizmor.yml, so editing the config on a branch had no effect on that branch's own pre-push run. This repo keeps four worktrees, so that is the normal case, not an edge one. - ci(quality): ignore self-repository for the two release workflows. zizmor wants `uses: $/.github/actions/verify-ci-success` over the workspace-relative form, and it is right: GitHub shipped $/ on 2026-07-30, it resolves to the running commit, and both call sites are already checked out at that ref, so the swap is a behavioural no-op. But actionlint 1.7.12, the current release and the one behind the pinned raven-actions/actionlint gate, rejects it with "invalid format because ref is missing". Verified both directions locally: applying the fix makes zizmor clean and actionlint fail, reverting it flips them back. Reding a required check to satisfy a low-severity style preference is the wrong trade, so it waits for actionlint support. The condition to revisit is written next to the ignore. zizmor is a local pre-push hook only; no CI job runs it.
Prerequisite carried from the CI-quality-fixes branch so this branch can push at all. zizmor 1.30.0's new self-repository audit reports two low findings on release-cut.yml and release-from-tag.yml, exits 12, and refuses every push from the repo. Neither workflow changed. - Pass --config to zizmor explicitly. Auto-discovery resolves the config relative to the repository root, which in a linked worktree is the main checkout, so a push from .claude/worktrees/<name> audits the branch's workflows against a different branch's config. - Ignore self-repository for the two release workflows. zizmor's suggested `uses: $/...` is officially correct and behaviourally identical here, but actionlint 1.7.12 rejects it as "invalid format because ref is missing" and actionlint is a required check. The revisit condition is recorded next to the ignore. Duplicated deliberately: this same commit is on fix/red-scheduled-quality-workflows, which carries the CHANGELOG entry for it. Whichever lands first, the other rebases to nothing.
- fix(ci): match the exact `v1.NN API changes` heading, not any `v1.NN API` / `API v1.NN` pair, so meta tags such as `<meta content="API v1.125">` can't outsort the real version - fix(ci): `|| true` on the extraction pipeline so a no-hit scrape reaches the step's own ::error diagnostic instead of aborting under `set -e` before it, the same bug class fixed in the badge job on this branch - fix(ci): reject minors >= 100 rather than > 999; two-digit minors are the only plausible shape and a three-digit one is markup - chore(ci): scope the zizmor self-repository ignore to the two `uses:` lines (release-cut.yml:61, release-from-tag.yml:155) so any other workspace-relative reference in either file still fires
The monthly Gremlins matrix hardcoded filter, proxy, config, httpjson, logging and cmd, so the 97.8% badge described a sixth of app/internal. The matrix now comes from scripts/ci/mutation-matrix.sh at run time: every package with both source and tests, minus the testcert/testhelp fixtures, 34 legs today. The badge job reads its expected-report count from the same discover step, so the count and the matrix cannot drift, and the sync test runs the script instead of counting YAML entries. Matrix and package values move into env so the run scripts carry no inline expressions. The badge job summary gains a per-package killed/lived/efficacy table. Pushing a mutation/* branch runs this file from that branch, which workflow_dispatch cannot do until the file is on main; badge commits stay gated to the default branch. max-parallel matches the nightly fuzz ceiling so a leg is never lost to runner concurrency, and the concurrency group includes the ref so a branch run cannot cancel the monthly one. - ci(quality): derive the Gremlins matrix from a discover job - test(ci): check discover wiring and run the matrix script - docs(changelog): record the widened matrix and the expected score drop
Prerequisite carried from the CI-quality-fixes branch so this branch can push at all. zizmor 1.30.0's new self-repository audit reports two low findings on release-cut.yml and release-from-tag.yml, exits 12, and refuses every push from the repo. Neither workflow changed. - Pass --config to zizmor explicitly. Auto-discovery resolves the config relative to the repository root, which in a linked worktree is the main checkout, so a push from .claude/worktrees/<name> audits the branch's workflows against a different branch's config. - Ignore self-repository for the two release workflows. zizmor's suggested `uses: $/...` is officially correct and behaviourally identical here, but actionlint 1.7.12 rejects it as "invalid format because ref is missing" and actionlint is a required check. The revisit condition is recorded next to the ignore. Duplicated deliberately: this same commit is on fix/red-scheduled-quality-workflows, which carries the CHANGELOG entry for it. Whichever lands first, the other rebases to nothing. (cherry picked from commit 7f330ec)
Run 33650478849 expanded zero Gremlins legs: the script's JSON carried a top-level count beside include, and strategy.matrix reads any key other than include/exclude as a dimension, so the job failed to expand and the badge step saw 0 of 34 reports. The script now emits only include, the discover step derives count from its length, and the sync test asserts the matrix JSON has exactly one key.
… migration pages G6: registry allowlist doc no longer claims push is checked, only pull. G11: presets.mdx documents Homarr's undocumented removeAll gap and opt-in snippet. G18: migration.mdx notes ALLOW_* works independent of POST, unlike real Tecnativa. G20: configuration.mdx gets a Multiple Listeners section for listeners/allowed_profiles/mount_on. G21: configuration.mdx corrects socket_mode to cover both 0600 and 0660. G22: admin.mdx corrects the disabled-admin response from 404 to default-deny 403. G23: configuration.mdx lists all ten granular ALLOW_* compat vars, not five. G24: configuration.mdx documents the five serve override flags next to Precedence. G25: configuration.mdx's audit-log sample gets the four trace-correlation fields. G26: migration.mdx's CetusGuard table gets the backend-TLS row and repeated -frontend-addr note. G27: migration.mdx's CetusGuard section notes the TLS 1.2->1.3 cutover requirement. G38: CLAUDE.md scopes the stdlib-only claim to execution, not package linkage. G41: migration.mdx fixes the config path and names the granular endpoint-config gates. G42: presets.mdx corrects the drydock preset's Denies/Allows lines. G43: drydock-with-compose.yaml and presets.mdx document the post_start exec denial. G45: drydock.yaml's distribution-grant comment is reattributed away from drydock.
…n-matrix Run 33651423252 expanded all 34 legs and every one died in under a minute with "not in a Go module": the step still ran from app/ while go.mod lives at the repo root. #399 fixes that on its branch (no working-directory, ./app/internal/... paths, root-level report paths, || true on the report greps). Merging it here so the widened matrix runs on the fixed step; the matrix script now emits ./app/internal/<pkg>. Conflicts: zizmor.yml takes #399's line-scoped ignores; the matrix block keeps the fromJSON discover output; the score loop keeps the per-package parsing and gains #399's guarded greps.
…ed packages Review findings on #401. The badge job carried contents: write and a persisted credential into runs triggered from mutation/* branches, where the workflow file is whatever the branch says. Aggregation now lives in a read-only score job that runs on every trigger and publishes the per-package table; the badge commit is its own job with a job-level if on the default branch, so it is never scheduled for a branch run and the credential never exists there. Package discovery walks app/internal recursively (buildkitproto has ten generated sub-packages; none has tests today, so the matrix is still 34 legs), skipping testdata trees, with nested paths named path-with-dashes. A report that says "No results to report." counts as zero killed, zero lived: dockerclient produced one on the first widened run and the badge job rejected the whole set over it. - test(ci): derive the eligible set recursively and compare it to the matrix - test(ci): assert the write permission appears only in the default-branch job
…urces G28 G29 G32 G33 G34 G35
CetusGuard accepts TLS 1.2 and sockguard's listener requires 1.3, so the keypair is reusable but the handshake isn't guaranteed. Website half of G27; the migration guide half is in the batch A PR.
… matching Adds direct table-driven tests for the collection-keyword exclusion boundaries in libpod_paths.go and paths.go (container/pod/network/volume/ secret identifier matchers, needsOwnerFilter, imageIdentifier), plus targeted tests for the namespace-sharing and embedded-reference verdict accumulation in middleware.go, the request-body size boundary in mutateJSONBody, and the response-size and unclassifiable-section-logging boundaries in system_data_usage.go. Targets 50 of the 51 lived mutants from the run-33653294202 ownership mutation report; one CONDITIONALS_BOUNDARY mutant on a length-vs-zero guard is equivalent and left unaddressed.
The comment said buildAdminValidator mirrors the offline `sockguard validate` pipeline, named validateAndCompileRules, and promised an operator's CI gate and the running proxy reach the same verdict for the same YAML. It calls validateAndCompileRulesStructural, which skips every filesystem dereference, so a candidate naming TLS material that is missing, unreadable, or not PEM passes the endpoint and fails the CLI. The body comment right below it always said so; the doc comment contradicted it.
Three Security entries (the non-array list body refusal, the representation headers on a rewritten body, and LogPath / GraphDriver.Data under redact_mount_paths), one Tests entry for the matcher differential, and one Documentation entry for the admin validator comment. Filed under Security rather than Fixed because every neighbour in that section is the same kind of change: a read-side disclosure or a fail-open closed.
…tion fix(libpod)!: isolate unsafe stats and image batch reads
…-changelog-website # Conflicts: # CHANGELOG.md # README.md
docs(site): align the docs pages with dev/v2.0
…bsite docs: align README, CHANGELOG and website with dev/v2.0
fix(visibility): fail closed on non-array list bodies and finish read-side redaction
docs(release): prepare v2.1.0 GA surfaces
Contributor
Author
|
@coderabbitai review |
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
September 4, 2026 00:59
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
|
Important Review skippedToo many files! This PR contains 361 files, which is 261 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (361)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
release-cut asserts renovate.json targets the branch the prerelease is cut from, and v2.1.0-rc.1 cuts from dev/v2.1. Contract test and the RELEASING.md star-chart example follow.
chore(config): point Renovate at dev/v2.1 for the v2.1.0 line
|
Deployment failed for project sockguard-website with the following error: Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit |
The v2.1.0-rc.1 CHANGELOG entry was 125,426 bytes, over GitHub's 125,000-character release body cap. GitHub silently truncated the published body, and the byte-equality check in release-from-tag.yml caught the mismatch and skipped every downstream job (Docker push, QA-6, Homebrew). extract-changelog-entry.mjs gains an optional --max-bytes flag. When the extracted entry exceeds it, the output is cut at the last line boundary that fits and a short footer pointing back at CHANGELOG.md is appended, all while staying under the byte cap. Default behavior (no flag) is unchanged, so release-cut.yml's validation step keeps working as-is. release-from-tag.yml now passes --max-bytes 120000 on its extraction, leaving a safety margin under GitHub's limit.
rc.1 failed to publish because its release notes exceeded GitHub's body limit (see fix/release-notes-body-limit). rc.2 re-cuts rc.1 with no proxy changes, using the now-capped release-notes tooling. The 2.1.0 entry now names rc.2 as the promoted candidate.
fix(release): cap release notes at GitHub's body limit
biggest-littlest
approved these changes
Sep 4, 2026
biggest-littlest
left a comment
biggest-littlest
left a comment
Member
There was a problem hiding this comment.
Promotion of the v2.1.0 line, tri-tool gate green on the rc image, tree matches dev/v2.1.
ALARGECOMPANY
approved these changes
Sep 4, 2026
ALARGECOMPANY
left a comment
ALARGECOMPANY
left a comment
Member
There was a problem hiding this comment.
Promotion of the v2.1.0 line, tri-tool gate green on the rc image, tree matches dev/v2.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the v2.1.0 release line to main. Everything on dev/v2.0 since v2.0.0 landed through reviewed PRs: the libpod write-inspection and owner-isolation fail-closed chain (#384, #386, #389, #390, #395, #394), the docs alignment pass (#422, #423), the read-side hardening from the adversarial review (#424), and the release metadata (#425).
v2.1.0-rc.1is cut from the same tree so the tri-tool conformance gate can run against a published image before this merges. Proxy behaviour is identical between rc.1 and the GA tag; the GA delta is release metadata only.Merge as a merge commit, not a squash, so the reconcile ancestry holds.