timothy/ersatztv
1
0
Fork 0
Code Issues 57 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

[PROBE — DO NOT MERGE] ersatztv#672 experiment D: can another head-resolved workflow's credentials write the gate status? #696

Closed
timothy wants to merge 1 commits from scratch/672-head-d into scratch/672-base-d
pull from: scratch/672-head-d
merge into: :scratch/672-base-d
Conversation 0 Commits 1 Files Changed 2
+12 -1090
timothy commented 2026-07-28 21:30:35 +02:00
Owner
Copy Link
Copy Source

Throwaway probe PR for ersatztv#672. Do not merge; branches deleted after the result is read.

The #672 fix hardens review-verdict.yml. This probe asks whether that is sufficient: docker-build.yml also triggers on pull_request (so it is head-resolved) and carries ETV_STATUS_AUTH, credentials already used to read commit statuses.

The head replaces docker-build.yml with a minimal job that tries to POST a probe-named context with those credentials. It never posts the real review-verdict/h10.

  • HTTP 201 → the same bypass exists through a second workflow; the #672 fix narrows the hole rather than closing it
  • HTTP 403/401 → those credentials cannot write statuses, and the fix stands on its own

Refs #672

**Throwaway probe PR for ersatztv#672. Do not merge; branches deleted after the result is read.** The #672 fix hardens `review-verdict.yml`. This probe asks whether that is sufficient: `docker-build.yml` also triggers on `pull_request` (so it is head-resolved) and carries `ETV_STATUS_AUTH`, credentials already used to *read* commit statuses. The head replaces `docker-build.yml` with a minimal job that tries to POST a **probe-named** context with those credentials. It never posts the real `review-verdict/h10`. - HTTP 201 → the same bypass exists through a second workflow; the #672 fix narrows the hole rather than closing it - HTTP 403/401 → those credentials cannot write statuses, and the fix stands on its own Refs #672
timothy added 1 commit 2026-07-28 21:30:36 +02:00
scratch(672): probe D — can docker-build.yml's creds write a status?
review-verdict/h10-PROBE672D ersatztv#672 probe D: posted by docker-build.yml credentials
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 2s
Details
review-verdict/h10 Awaiting review verdict for d79de01
Details
Review verdict / Set review-verdict status (pull_request) Successful in 6s
Details
d79de01155
timothy closed this pull request 2026-07-28 22:45:01 +02:00
timothy deleted branch scratch/672-head-d 2026-07-28 22:45:01 +02:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#696