Integrate the reviewed delivery-trust candidate while preserving commits af0e8f8d39 and 6575ebd928 unchanged in history.
Change-source: pulse-maintainer
Reject job-level permission expansion and unsafe checkout selection in the closed-PR capacity workflow, and report cancellation requests separately from runs that completed during the API race.
Change-source: pulse-maintainer
Cancel queued and running validation workflows for a closed pull request head so obsolete matrices cannot hold the hosted-runner limit and delay required checks. Keep the privileged close hook bound to reviewed default-branch code and cover reopen, branch-reuse, identity, and API-race boundaries.
Change-source: pulse-maintainer
test_staged_root_sourced_doc_with_stale_mirror_fails errored in the
"Script smoke tests & backend build" job on PR #1857 (run 33609703555)
with OSError [Errno 39] Directory not empty: '.git' raised from
TemporaryDirectory cleanup. The test body passed; a background git
process spawned by init/add/commit (auto-gc, fsmonitor, or maintenance)
was still writing under .git when shutil.rmtree ran. The suite passes on
main most of the time and locally, so this is a race, not a logic bug.
Disable gc.auto, core.fsmonitor and maintenance.auto for the throwaway
repos, and point GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM at os.devnull so a
runner's host config cannot re-enable them. Construct both temp
directories with ignore_cleanup_errors=True as a belt-and-braces fallback
so a straggler can never fail a test whose assertions already passed.
Recognize bare sequence entries and every valid block scalar header across executable action inputs, run scripts, and step environment boundaries.
Change-source: pulse-maintainer
Docs under frontend-modern/public/docs are byte-for-byte copies of repo
docs, but the only guard was a CI vitest the git hooks never run. On
2026-09-01 two commits (f4886c2dfb, f313882a7b) each edited a mirrored
doc without its copy, passed the hooks, and broke main's Frontend job.
Add scripts/check_docs_mirror.py with an index-blob --staged mode wired
into the pre-commit hook: a commit that stages either side of an
out-of-sync pair (or an orphan shipped copy) fails with the exact sync
command, while pre-existing drift from other commits only warns. The
worktree mode runs as a named step in the public-docs workflow, with
unit tests in scripts/tests picked up by the existing runner. The
docsLinks vitest stays as the CI backstop.
Build-time generation of public/docs was considered and rejected: the
shipped set is a curated subset (61 of 421 docs), so generation still
needs a hand-maintained manifest while adding build, dev-server, and
test-order coupling.
The dependency-floor smoke test asserted exact go list output, so the
maintainer lane's legitimate x/crypto v0.55.0 bump (which moved x/net to
v0.57.0) failed the Script smoke tests job on main even though both
versions clear the advisory floor. Compare versions with sort -V against
the advisory-safe minimum instead: upgrades pass, only a downgrade below
the floor fails. Verified the failing direction and the equal-version
case locally.
Use the current supported Go 1.26 security patch across source, release, dev, and production container build surfaces. Keep the immutable official builder pin and governance proofs aligned with the exact toolchain.
Change-source: pulse-maintainer
Advance local, release, and container build surfaces together so reachable standard-library advisories cannot re-enter shipped binaries. Pin the official amd64 builder manifest and govern the updated floor with installability and dev-runtime proofs.
Change-source: pulse-maintainer
6417319b1 split frontend-modern/vite.config.ts out of the
dev-runtime-orchestration path policy into its own frontend-build-output
policy so production build output counts as proof. The
test-hot-dev-bg.sh manifest governance check still pinned the old
policy id, so the Script smoke tests job on main has failed since that
commit. Pin vite.config.ts to frontend-build-output; every other
manifest expectation is unchanged.
Reproduced the [FAIL] locally before the change; the full
test-hot-dev-bg.sh suite passes after it.
The internal/api race suite now routinely exceeds the old 20-minute package timeout on hosted runners while passing. Set a governed 30-minute package timeout and 40-minute release job ceiling, pin the relationship with contract tests, and refresh the rc.4 packet with the fixes landed since preparation.
pulse-triage[bot]