jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-31 02:02:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): enforce fail-closed verification gate and redact JUnit XML secrets

Browse Source
This commit is contained in:
Alexandre Teixeira
2026-10-31 00:23:16 +00:00
parent 84c7eabfce
commit 8257c661ad
6 changed files with 557 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/maintainers/native-test-coverage.md
+4 -1
View File
@@ -28,7 +28,10 @@ ownership, failed sanitization and missing tooling purge sensitive artifacts.
Unsupported or malformed sensitive records cause the affected archive to be removed
fail-closed. An independent fail-closed verification step (.github/scripts/verify_sanitized_artifacts.py)
runs after test suite execution or abnormal runner termination to prevent publishing
unsanitized diagnostics while preserving safe JUnit reporting.
unsanitized diagnostics while preserving safe JUnit reporting. The verifier returns a nonzero
exit code upon any inspection or deletion failure, publishable XML is restricted to recognized
JUnit reports with sensitive tokens redacted, and workflow upload steps execute only when
independent verification succeeds (steps.<id>.outcome == 'success').
Never upload the fixture directory, database or browser storage state.
The stroke budget now excludes measured synthetic event-delivery pacing and also