fix(rules): shell eval/download/tmp rules skip comment lines (C4) - #883

Open

hyperpolymath wants to merge 20 commits into

mainfrom

fix/comment-line-precision

Commits on Sep 30, 2026

fix(rules): make hypatia compile again and repair PinIntegrity/PrAutomerge (#869)

hyperpolymath
and
claude
committed
6c4190f
fix(pin_integrity): keep a bare claim's first byte in relabel/2; align shell twin

hyperpolymath
and
claude
committed
c6b94a3
fix(mise): drop banned runtimes and Python-only tools (#832 regression)

hyperpolymath
and
claude
committed
727cbb9
docs(rules): clarify pin integrity and PR automerge function contracts
coderabbitai[bot]
committed
9975196
docs(scanner): replace credential examples in suppression comment
coderabbitai[bot]
committed
963edfd
chore(rules): roll back pin integrity and PR automerge fixes
coderabbitai[bot]
committed
9167ac7
Merge branch 'main' into fix/issue-sweep
hyperpolymath
authored
4ff5923
fix(rules): rule precision — WH006/WH013, harvested-registry, npx text, proof suites (#879)

hyperpolymath
and
claude
authored
e51cdf5
fix(rules): eval/download-then-run/hardcoded_tmp skip comment lines (C4)

hyperpolymath
and
claude
committed
ac19abb
fix(secrets): form-ambiguous labels do not apply in proof-assistant sources

hyperpolymath
and
claude
committed
15f8213
fix(RE008): accept an actor gate already ANDed with the PR author

hyperpolymath
and
claude
committed
10a0f8e
fix(WH002, must-have): follow repo-local scripts; accept AsciiDoc policy docs

hyperpolymath
and
claude
committed
81e550e
Merge origin/main into fix/comment-line-precision

hyperpolymath
and
claude
committed
32e8b40
fix(rules): Scorecard Security-Policy accepts SECURITY.adoc (shared set)

hyperpolymath
and
claude
committed
bd86182
fix(rules): http_in_docs requires a public dotted host

hyperpolymath
and
claude
committed
b7d2047
fix(rules): npx_in_workflow ignores npx named in quoted grep/echo args

hyperpolymath
and
claude
committed
57f5469
fix(rules): address CodeRabbit review on #883

hyperpolymath
and
claude
committed
13ab5d3
docs(suppression): keep the proof-fact doc example out of secret shape

hyperpolymath
and
claude
committed
e5d6aff
Merge branch 'main' into fix/comment-line-precision
hyperpolymath
authored
2f647cc
docs(scanner): clarify suppression and workflow rule behavior
coderabbitai[bot]
committed
87e55e4

Navigation Menu

Uh oh!

fix(rules): shell eval/download/tmp rules skip comment lines (C4) - #883

fix(rules): shell eval/download/tmp rules skip comment lines (C4)#883
hyperpolymath wants to merge 20 commits into
mainfrom
fix/comment-line-precision

Commits on Sep 30, 2026

fix(rules): make hypatia compile again and repair PinIntegrity/PrAutomerge (#869)

fix(pin_integrity): keep a bare claim's first byte in relabel/2; align shell twin

fix(mise): drop banned runtimes and Python-only tools (#832 regression)

docs(rules): clarify pin integrity and PR automerge function contracts

docs(scanner): replace credential examples in suppression comment

chore(rules): roll back pin integrity and PR automerge fixes

Merge branch 'main' into fix/issue-sweep

fix(rules): rule precision — WH006/WH013, harvested-registry, npx text, proof suites (#879)

fix(rules): eval/download-then-run/hardcoded_tmp skip comment lines (C4)

fix(secrets): form-ambiguous labels do not apply in proof-assistant sources

fix(RE008): accept an actor gate already ANDed with the PR author

fix(WH002, must-have): follow repo-local scripts; accept AsciiDoc policy docs

Merge origin/main into fix/comment-line-precision

fix(rules): Scorecard Security-Policy accepts SECURITY.adoc (shared set)

fix(rules): http_in_docs requires a public dotted host

fix(rules): npx_in_workflow ignores npx named in quoted grep/echo args

fix(rules): address CodeRabbit review on #883

docs(suppression): keep the proof-fact doc example out of secret shape

Merge branch 'main' into fix/comment-line-precision

docs(scanner): clarify suppression and workflow rule behavior