mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-07 16:19:09 +00:00
Adam Moussa
45567e007f
Two low-severity follow-ups from the security review of the #1701 port. Restore the recorded baseline scope after a workflow-push elevation instead of a hardcoded RUNTIME. An install granted workflows:write but not actions:read resolves its standing token to core; hardcoding RUNTIME on restore requested the ungranted actions:read, 422'd, and fired a false "SECURITY: failed to downscope" error on every approved workflow push before the core fallback recovered. The guard now captures the run's recorded scope before elevating (via the new get_recorded_proxy_permissions) and restores exactly that, falling back to the guaranteed core scope only when the baseline restore fails. Classify installation-token mint failures. get_github_app_installation_token_ with_expiry now treats HTTP 422 (a permission the installation hasn't granted) as the ladder's expected descend signal and keeps it at debug, while a non-422 failure (network/5xx/timeout) is surfaced at WARNING even when errors are otherwise suppressed — so a transient blip no longer silently downscopes a whole run under a debug-only trace. The reduced-scope warning no longer asserts a missing grant as the sole cause. |
||
|---|---|---|
| .. | ||
| dashboard | ||
| integrations | ||
| middleware | ||
| skills | ||
| tools | ||
| utils | ||
| webhooks | ||
| analyzer.py | ||
| chat.py | ||
| ci_autofix.py | ||
| ci_monitor.py | ||
| completion.py | ||
| dispatch.py | ||
| encryption.py | ||
| prompt.py | ||
| reconcile.py | ||
| review_style_collector.py | ||
| review_style_guidance.py | ||
| reviewer.py | ||
| reviewer_diff.py | ||
| reviewer_eval_store.py | ||
| reviewer_findings.py | ||
| reviewer_groups.py | ||
| reviewer_publish.py | ||
| reviewer_reconcile.py | ||
| reviewer_trace_context.py | ||
| scheduler.py | ||
| server.py | ||
| webapp.py | ||