Timothy

timothy pushed to main at timothy/ersatztv

2026-10-30 00:52:58 +01:00

4ba56848f6 Merge pull request 'fix(931): a missing semgrep fails the security-scan release gate' (#933) from 931-scan-semgrep-fail into main

f71e2fd0d0 docs(931): a failing setup command's exit is its own status, and the Hosts row names no excluded host

0e64328ca2 docs(931): state the scan host's requirement instead of naming hosts, and every script exit

2e4de81309 fix(931): pin the main-path semgrep block in --selftest and state every exit the script produces

e04f75e9ec docs(931): name the host that can pass the SAST gate and the script's own exit 2

Compare 7 commits »

timothy deleted branch 931-scan-semgrep-fail from timothy/ersatztv

2026-10-30 00:52:57 +01:00

timothy closed issue timothy/ersatztv#931

2026-10-30 00:52:56 +01:00

security-scan.sh: a missing semgrep must FAIL the release gate, not WARN + exit 0 (and correct the ci-cd.md cause line)

timothy merged pull request timothy/ersatztv#933

2026-10-30 00:52:55 +01:00

fix(931): a missing semgrep fails the security-scan release gate

timothy commented on pull request timothy/ersatztv#934

2026-10-30 00:52:33 +01:00

fix(929): pin Pkcs 9.0.21; hold ImageSharp 3.1.12 with TIFF decoding disabled

Review-verdict: MERGEABLE @ 71d660f

Orchestrator verdict at 71d660f21 (a pure rebase of bd24d21e2 onto main after #938; the patch is unchanged). Round 2 reviews all merge, Codex cross-family…

timothy commented on pull request timothy/ersatztv#933

2026-10-30 00:52:31 +01:00

fix(931): a missing semgrep fails the security-scan release gate

Review-verdict: MERGEABLE @ f71e2fd

Orchestrator verdict at f71e2fd0d (a pure rebase of c645c9b96 onto main after #938; the patch is unchanged). Final review round clean. CI green, including…

timothy commented on issue timothy/ersatztv#913

2026-10-30 00:50:51 +01:00

Scripted playout build almost certainly 401s: ScriptedScheduleController is under the global API auth filter and the script is handed no credential

Closing record

Outcome: PR http://192.168.1.95:3000/timothy/ersatztv/pulls/939 (head 324dbdbca). Confirmed and fixed; merge closes this issue. Root cause: ScriptedScheduleController…

timothy created pull request timothy/ersatztv#939

2026-10-30 00:50:29 +01:00

fix(913): scripted playout callbacks authenticate with a build-scoped token

timothy pushed to 913-scripted-playout-401 at timothy/ersatztv

2026-10-30 00:50:15 +01:00

324dbdbca0 fix(913): scripted playout callbacks authenticate with a build-scoped token

timothy created branch 913-scripted-playout-401 in timothy/ersatztv

2026-10-30 00:50:15 +01:00

timothy pushed to 929-vuln-pkcs-imagesharp-v4 at timothy/ersatztv

2026-10-30 00:03:56 +01:00

71d660f213 test(929): the ICC carrier list includes BMP and is checked against a round trip of every configured format

bed50e2b77 test(929): pin by allocation that decode and clone do not parse a hostile ICC profile

59749babd9 test(929): only ImageSharpDecoding may choose the decode configuration, and the test map names the IL scan

f30a54172b docs(929): the record names what holds each bound, and Renovate is held

52c383e832 test(929): pin the ImageSharp call surface the 3.1.12 hold depends on

Compare 12 commits »

timothy pushed to 931-scan-semgrep-fail at timothy/ersatztv

2026-10-30 00:03:50 +01:00

f71e2fd0d0 docs(931): a failing setup command's exit is its own status, and the Hosts row names no excluded host

0e64328ca2 docs(931): state the scan host's requirement instead of naming hosts, and every script exit

2e4de81309 fix(931): pin the main-path semgrep block in --selftest and state every exit the script produces

e04f75e9ec docs(931): name the host that can pass the SAST gate and the script's own exit 2

3f7febf656 fix(931): pin the script's own exit in --selftest and fail the gate on a semgrep that errors

Compare 11 commits »

timothy deleted branch 935-jq-repin-17 from timothy/ersatztv

2026-10-30 00:03:22 +01:00

timothy pushed to main at timothy/ersatztv

2026-10-30 00:03:12 +01:00

bcf6f7e04d Merge pull request 'fix(935): script-tests jq tripwire accepts {1.6, 1.7} until server-management#1080' (#938) from 935-jq-repin-17 into main

403bf011c1 fix(935): repoint the superseded jq key, re-wrap the preflight header, reword the floor note

00424bf090 fix(935): pin the run: key in the wiring test, drop a dangling record key, reword a stale runner claim

8acba80a1a fix(935): state the measured fact (both hosts 1.7 on 2026-10-28), not an unmeasured mixed fleet

41d604f0ae fix(935): script-tests jq tripwire accepts exactly {1.6, 1.7} until server-management#1080 pins the fleet

Compare 5 commits »

timothy closed issue timothy/ersatztv#935

2026-10-30 00:03:09 +01:00

script-tests jq tripwire: runner fleet now ships jq 1.7; re-pin --expect and update the jq contract

timothy merged pull request timothy/ersatztv#938

2026-10-30 00:03:08 +01:00

fix(935): script-tests jq tripwire accepts {1.6, 1.7} until server-management#1080

timothy commented on pull request timothy/ersatztv#938

2026-10-30 00:02:52 +01:00

fix(935): script-tests jq tripwire accepts {1.6, 1.7} until server-management#1080

Review-verdict: MERGEABLE @ 403bf01

Orchestrator verdict at 403bf011c: 3 independent reviews (one cross-family attempt fell back to a cold same-family review) all merge, nits only. Own CI green:…

timothy commented on issue timothy/ersatztv#913

2026-10-29 23:41:37 +01:00

Scripted playout build almost certainly 401s: ScriptedScheduleController is under the global API auth filter and the script is handed no credential

Adversarial review — 0721d5de214833ecc19099c48ec3c6fc65981d9c

Reviewed git diff origin/main...HEAD in wt-913 for correctness and security. No code changes made.

Blocking code findings:…

timothy commented on issue timothy/ersatztv#935

2026-10-29 23:39:22 +01:00

script-tests jq tripwire: runner fleet now ships jq 1.7; re-pin --expect and update the jq contract

Closing record

Outcome: PR http://192.168.1.95:3000/timothy/ersatztv/pulls/938 (head 403bf011c): the script-tests jq preflight accepts exactly {1.6, 1.7} until server-management#1080 pins…

timothy pushed to 935-jq-repin-17 at timothy/ersatztv

2026-10-29 23:39:02 +01:00

403bf011c1 fix(935): repoint the superseded jq key, re-wrap the preflight header, reword the floor note

00424bf090 fix(935): pin the run: key in the wiring test, drop a dangling record key, reword a stale runner claim

8acba80a1a fix(935): state the measured fact (both hosts 1.7 on 2026-10-28), not an unmeasured mixed fleet

41d604f0ae fix(935): script-tests jq tripwire accepts exactly {1.6, 1.7} until server-management#1080 pins the fleet

Compare 4 commits »