ci(benchmarks): gate rendered GFM security regressions

fix(benchmarks): secure GFM report rendering
fix(benchmarks): prevent Markdown inline injection
2026-11-02 11:12:21 +01:00 · 2026-11-02 02:20:18 +00:00 · 2026-11-02 01:51:27 +00:00 · 2026-11-02 01:02:14 +00:00 · 2026-11-02 00:23:49 +00:00 · 2026-11-01 23:36:09 +00:00
3 changed files with 4674 additions and 0 deletions
@@ -264,3 +264,20 @@ jobs:
          ODYSSEUS_TEST_PYTHON=python ODYSSEUS_LAYOUT_BROWSER=chromium npx --no-install playwright test \
            --config tests/e2e/ios-layout.config.cjs \
            --reporter=line
  benchmark-gfm-security:
    name: Benchmark GFM rendering security
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: "3.11"
      # Test-only renderer, pinned independently of application requirements.
      - name: Install GitHub Flavored Markdown renderer
        run: |
          python -m pip install --disable-pip-version-check --only-binary=:all: "cmarkgfm==2025.10.22"
      - name: Verify rendered benchmark report security
        run: python tests/test_audit_c5_benchmark_evidence.py --gfm
Author	SHA1	Message	Date
Alexandre Teixeira	63b391bad7	ci(benchmarks): gate rendered GFM security regressions	2026-11-02 02:20:18 +00:00
Alexandre Teixeira	09c0eef43a	fix(benchmarks): secure GFM report rendering	2026-11-02 01:51:27 +00:00
Alexandre Teixeira	f9867f3e8b	fix(benchmarks): prevent Markdown inline injection	2026-11-02 01:02:14 +00:00
Alexandre Teixeira	2fc5a67dc3	fix(benchmarks): prevent Markdown report injection	2026-11-02 00:23:49 +00:00
Alexandre Teixeira	369eb794d6	fix(benchmarks): prevent sensitive data in audit logs	2026-11-01 23:36:09 +00:00
Alexandre Teixeira	d241a1abb3	feat(benchmarks): add offline C5 evidence auditor	2026-11-01 22:52:44 +00:00