Repository navigation
Conversation
intel352
marked this pull request as ready for review
October 8, 2026 21:34
intel352
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This backports optional JWT audience and issuer enforcement to the v0.74.7 maintenance baseline. Authentication, profile and refresh enforce configured boundaries; omitted audience preserves legacy behavior and invalid explicit settings fail closed. Enabling an environment boundary requires a fresh login.
The maintenance release keeps ordinary tests and artifacts, publishes exact version/full-SHA image tags only, sets GitHub latest=false, and removes broadcasts and moving aliases. Genuine protected-main ancestry remains the normal release gate.
The only ancestry exception is v0.74.8 from this PR. A separate reviewed admission record must first merge to main and bind the actual maintenance merge commit, identical reviewed source/release trees, exact successful Maintenance JWT CI, and the equivalent JWT fix merged on main. Both merged PRs, v0.74.7 lineage, maintained-branch reachability and the fixed auth patch are verified. Missing or mismatched evidence denies release. Squash merges are supported without changing repository protections or merge settings. Only the provenance job gains Actions read access; publication permissions remain unchanged.
Validation: 17 real Git-history guard regressions pass, including forged replacement ancestry, tag-local records, failed/unavailable CI, wrong merged PRs and altered release content. Independent security and antagonistic reviews approve source tree 801f186120559be816f31a826dd8fe046ae4685b. Automatic exact-head Maintenance JWT CI is required for 67817c5; prior-head CI is insufficient. Focused JWT/source checks on the inherited backport were completed before this guard change.
Upstream fix: #1042. Release remains held until that fix and this PR genuinely merge, then a separate main admission PR is reviewed and merged. This PR creates no admission record or tag and performs no deployment. See docs/MAINTENANCE_RELEASE.md for exact record fields and sequencing.