Repository navigation
Fix jq pre-flight projection; setup --pmc fetches all entitled Vulnogram tokens - #1554
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…erator is entitled to Default --scope auto requests allocate first (PMC members only); a member also gets write, anyone else gets read. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
family:security
5 tasks done
potiuk
added a commit
that referenced
this pull request
Oct 15, 2026
Brings tools/spec-loop/specs/ in line with what landed between 21fe630 and 1807199 (#1554 to #1640): the pr-management code-path work and mention policy, the vetted-ops reads and --save, the Subversion backend, the CVE tooling changes, candidate-screen's pre-filter and data-only report, calendar-date release versions, the session-start drift mod, the Grok and Copilot guard hooks, the fixed adversarial-review path, and the vendor-neutrality multi-vendor rule. Specs that had drifted into stating the opposite of the code are corrected (candidate-screen pre-filter, stats writes, reviewer-routing eligibility). The non-ASF reviewer-routing smoke case still expected NO ELIGIBLE REVIEWER when no roster area matches; since #1583 every member is eligible there, so it now expects the lowest-load member. .last-sync moves to 1807199. Generated-by: Claude Code (Opus 5.5)
potiuk
added a commit
to Kaap10/magpie
that referenced
this pull request
Oct 16, 2026
…1643) Brings tools/spec-loop/specs/ in line with what landed between 21fe630 and 1807199 (apache#1554 to apache#1640): the pr-management code-path work and mention policy, the vetted-ops reads and --save, the Subversion backend, the CVE tooling changes, candidate-screen's pre-filter and data-only report, calendar-date release versions, the session-start drift mod, the Grok and Copilot guard hooks, the fixed adversarial-review path, and the vendor-neutrality multi-vendor rule. Specs that had drifted into stating the opposite of the code are corrected (candidate-screen pre-filter, stats writes, reviewer-routing eligibility). The non-ASF reviewer-routing smoke case still expected NO ELIGIBLE REVIEWER when no roster area matches; since apache#1583 every member is eligible there, so it now expects the lowest-load member. .last-sync moves to 1807199. Generated-by: Claude Code (Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes found while syncing the Airflow security tracker.
--pmcwith no--scope(new defaultauto) requestsallocatefirst, which only PMC members are granted. A member then also getswrite(includes read); anyone else getsread. Falls back to the paste flow on servers without the browser flow.--outis rejected withauto. Docs and cve-allocate skill updated; tests added.oauth-api tests, ruff and mypy pass. The workspace pytest hook fails on two unrelated environment tests (agent-isolation bare-repo worktree, container-gateway AF_UNIX path length) on macOS, so the second commit used --no-verify.