2026-10-25T21:01:35.591Z ##[warning]The platform stopped this job's container while step "Run the shard's tests" ran. The job can only read (no secrets, deployment environment or token that can write), so Diffinery started the job again from the beginning on a new runner (restart 1 of 2). 2026-10-25T21:01:49.955Z Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@2fd4b6853eae 2026-10-25T21:01:49.968Z Runner: image diffinery-runner:4d3bf17f06575e64ab4155b3, in cdg12, WEUR, container a581071377219a2fa019809a437b452d4f053e407e2e13f93874b8d6bc38ee37 2026-10-25T21:01:49.969Z Runner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a size 2026-10-25T21:01:49.969Z Host: AMD EPYC (family 25, model 1), 4 vCPUs, 2000 MHz 2026-10-25T21:01:49.969Z Workspace: /workspace/diffinery 2026-10-25T21:01:50.041Z ##[group]Run actions/checkout@v4 2026-10-25T21:01:50.041Z ##[endgroup] 2026-10-25T21:01:50.044Z Syncing repository: codician/diffinery 2026-10-25T21:01:50.128Z Fetching the repository (depth 1) 2026-10-25T21:01:50.880Z remote: Enumerating objects: 899, done. 2026-10-25T21:01:51.093Z Receiving objects: 0% (1/899) Receiving objects: 1% (9/899) Receiving objects: 2% (18/899) Receiving objects: 3% (27/899) Receiving objects: 4% (36/899) Receiving objects: 5% (45/899) Receiving objects: 6% (54/899) Receiving objects: 7% (63/899) Receiving objects: 8% (72/899) Receiving objects: 9% (81/899) Receiving objects: 10% (90/899) Receiving objects: 11% (99/899) Receiving objects: 12% (108/899) Receiving objects: 13% (117/899) Receiving objects: 14% (126/899) Receiving objects: 15% (135/899) Receiving objects: 16% (144/899) Receiving objects: 17% (153/899) Receiving objects: 18% (162/899) Receiving objects: 19% (171/899) Receiving objects: 20% (180/899) Receiving objects: 21% (189/899) Receiving objects: 22% (198/899) Receiving objects: 23% (207/899) Receiving objects: 24% (216/899) Receiving objects: 25% (225/899) Receiving objects: 26% (234/899) Receiving objects: 27% (243/899) Receiving objects: 28% (252/899) Receiving objects: 29% (261/899) Receiving objects: 30% (270/899) Receiving objects: 31% (279/899) Receiving objects: 32% (288/899) Receiving objects: 33% (297/899) Receiving objects: 34% (306/899) Receiving objects: 35% (315/899) Receiving objects: 36% (324/899) Receiving objects: 37% (333/899) Receiving objects: 38% (342/899) Receiving objects: 39% (351/899) Receiving objects: 40% (360/899) Receiving objects: 41% (369/899) Receiving objects: 42% (378/899) Receiving objects: 43% (387/899) Receiving objects: 44% (396/899) Receiving objects: 45% (405/899) Receiving objects: 46% (414/899) Receiving objects: 47% (423/899) Receiving objects: 48% (432/899) Receiving objects: 49% (441/899) Receiving objects: 50% (450/899) Receiving objects: 51% (459/899) Receiving objects: 52% (468/899) Receiving objects: 53% (477/899) Receiving objects: 54% (486/899) Receiving objects: 55% (495/899) Receiving objects: 56% (504/899) Receiving objects: 57% (513/899) Receiving objects: 58% (522/899) Receiving objects: 59% (531/899) Receiving objects: 60% (540/899) Receiving objects: 61% (549/899) Receiving objects: 62% (558/899) Receiving objects: 63% (567/899) Receiving objects: 64% (576/899) Receiving objects: 65% (585/899) Receiving objects: 66% (594/899) Receiving objects: 67% (603/899) Receiving objects: 68% (612/899) Receiving objects: 69% (621/899) Receiving objects: 70% (630/899) Receiving objects: 71% (639/899) Receiving objects: 72% (648/899) Receiving objects: 73% (657/899) Receiving objects: 74% (666/899) Receiving objects: 75% (675/899) Receiving objects: 76% (684/899) Receiving objects: 77% (693/899) Receiving objects: 78% (702/899) Receiving objects: 79% (711/899) Receiving objects: 80% (720/899) Receiving objects: 81% (729/899) Receiving objects: 82% (738/899) Receiving objects: 83% (747/899) Receiving objects: 84% (756/899) Receiving objects: 85% (765/899) Receiving objects: 86% (774/899) Receiving objects: 87% (783/899) Receiving objects: 88% (792/899) Receiving objects: 89% (801/899) Receiving objects: 90% (810/899) Receiving objects: 91% (819/899) Receiving objects: 92% (828/899) Receiving objects: 93% (837/899) Receiving objects: 94% (846/899) Receiving objects: 95% (855/899) Receiving objects: 96% (864/899) remote: Total 899 (delta 0), reused 899 (delta 0) 2026-10-25T21:01:51.096Z Receiving objects: 97% (873/899) Receiving objects: 98% (882/899) Receiving objects: 99% (891/899) Receiving objects: 100% (899/899) Receiving objects: 100% (899/899), 4.26 MiB | 20.95 MiB/s, done. 2026-10-25T21:01:51.113Z From https://diffinery.com/codician/diffinery 2026-10-25T21:01:51.113Z * [new ref] 2fd4b6853eaea36eec1004a8a1a7d4bd5243e307 -> origin/diffinery-checkout 2026-10-25T21:01:51.285Z Note: switching to '2fd4b6853eaea36eec1004a8a1a7d4bd5243e307'. 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z You are in 'detached HEAD' state. You can look around, make experimental 2026-10-25T21:01:51.285Z changes and commit them, and you can discard any commits you make in this 2026-10-25T21:01:51.285Z state without impacting any branches by switching back to a branch. 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z If you want to create a new branch to retain commits you create, you may 2026-10-25T21:01:51.285Z do so (now or later) by using -c with the switch command. Example: 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z git switch -c 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z Or undo this operation with: 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z git switch - 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z Turn off this advice by setting config variable advice.detachedHead to false 2026-10-25T21:01:51.285Z 2026-10-25T21:01:51.285Z HEAD is now at 2fd4b68 Merge bb864a3e54ba083c4968d7fac202e7164d627c2a into 417ed9120a52a45f14a0218a2adc5dfbaa737313 2026-10-25T21:01:51.292Z HEAD is now at 2fd4b6853eaea36eec1004a8a1a7d4bd5243e307 2026-10-25T21:01:51.435Z Download action repository 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1' 2026-10-25T21:01:51.975Z ##[group]Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 2026-10-25T21:01:51.975Z with: 2026-10-25T21:01:51.975Z dest: ~/setup-pnpm 2026-10-25T21:01:51.975Z run_install: null 2026-10-25T21:01:51.975Z cache: false 2026-10-25T21:01:51.975Z cache_dependency_path: pnpm-lock.yaml 2026-10-25T21:01:51.975Z package_json_file: package.json 2026-10-25T21:01:51.975Z standalone: false 2026-10-25T21:01:51.975Z ##[endgroup] 2026-10-25T21:01:52.268Z ##[group]Running self-installer... 2026-10-25T21:01:53.389Z Progress: resolved 1, reused 0, downloaded 0, added 0 2026-10-25T21:01:53.417Z Packages: +1 2026-10-25T21:01:53.417Z + 2026-10-25T21:01:54.388Z Progress: resolved 1, reused 0, downloaded 1, added 1, done 2026-10-25T21:01:54.442Z 2026-10-25T21:01:54.442Z dependencies: 2026-10-25T21:01:54.442Z + pnpm 10.28.0 (12.15.0 is available) 2026-10-25T21:01:54.442Z 2026-10-25T21:01:54.451Z Done in 1.8s 2026-10-25T21:01:54.490Z ##[endgroup] 2026-10-25T21:01:54.490Z Installation Completed! 2026-10-25T21:01:54.624Z ##[group]Run actions/setup-node@v4 2026-10-25T21:01:54.624Z with: 2026-10-25T21:01:54.624Z node-version: 22 2026-10-25T21:01:54.624Z cache: pnpm 2026-10-25T21:01:54.624Z ##[endgroup] 2026-10-25T21:01:54.639Z Found in cache @ 22.22.0 (pre-installed node satisfies '22') 2026-10-25T21:01:55.927Z Cache Size: ~216 MB (226934503 B) 2026-10-25T21:02:04.246Z Cache restored from key: node-cache-Linux-x64-pnpm-42d02c0263a3b5f911ed6ae8e9210922b97166ca02e60b2c70c55dfa1f00371b 2026-10-25T21:02:04.536Z ##[group]Run pnpm install --frozen-lockfile 2026-10-25T21:02:04.536Z ##[endgroup] 2026-10-25T21:02:05.258Z Scope: all 8 workspace projects 2026-10-25T21:02:05.400Z Lockfile is up to date, resolution step is skipped 2026-10-25T21:02:05.522Z Progress: resolved 1, reused 0, downloaded 0, added 0 2026-10-25T21:02:05.597Z Packages: +251 2026-10-25T21:02:05.597Z ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2026-10-25T21:02:06.530Z Progress: resolved 251, reused 245, downloaded 0, added 104 2026-10-25T21:02:07.531Z Progress: resolved 251, reused 245, downloaded 0, added 194 2026-10-25T21:02:07.900Z Progress: resolved 251, reused 245, downloaded 0, added 251, done 2026-10-25T21:02:08.193Z .../esbuild@0.25.11/node_modules/esbuild postinstall$ node install.js 2026-10-25T21:02:08.196Z .../esbuild@0.28.1/node_modules/esbuild postinstall$ node install.js 2026-10-25T21:02:08.198Z .../node_modules/workerd postinstall$ node install.js 2026-10-25T21:02:08.215Z .../esbuild@0.25.12/node_modules/esbuild postinstall$ node install.js 2026-10-25T21:02:08.251Z .../node_modules/workerd postinstall$ node install.js 2026-10-25T21:02:08.375Z .../esbuild@0.25.11/node_modules/esbuild postinstall: Done 2026-10-25T21:02:08.378Z .../esbuild@0.28.1/node_modules/esbuild postinstall: Done 2026-10-25T21:02:08.395Z .../esbuild@0.28.2/node_modules/esbuild postinstall$ node install.js 2026-10-25T21:02:08.443Z .../esbuild@0.25.12/node_modules/esbuild postinstall: Done 2026-10-25T21:02:08.629Z .../node_modules/workerd postinstall: Done 2026-10-25T21:02:08.775Z .../node_modules/workerd postinstall: Done 2026-10-25T21:02:08.777Z .../esbuild@0.28.2/node_modules/esbuild postinstall: Done 2026-10-25T21:02:09.524Z 2026-10-25T21:02:09.524Z devDependencies: 2026-10-25T21:02:09.524Z + turbo 2.11.7 2026-10-25T21:02:09.524Z + typescript 5.9.3 2026-10-25T21:02:09.524Z 2026-10-25T21:02:10.247Z Done in 5.6s using pnpm v10.28.0 2026-10-25T21:02:10.422Z ##[group]Run pnpm -r --if-present build 2026-10-25T21:02:10.422Z ##[endgroup] 2026-10-25T21:02:11.072Z Scope: 7 of 8 workspace projects 2026-10-25T21:02:11.080Z apps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env node 2026-10-25T21:02:11.080Z import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);" 2026-10-25T21:02:11.081Z apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjs 2026-10-25T21:02:11.082Z containers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);" 2026-10-25T21:02:11.248Z apps/cli build: dist/diffinery.mjs 473.3kb 2026-10-25T21:02:11.250Z apps/cli build: ⚡ Done in 129ms 2026-10-25T21:02:11.258Z apps/cli build: Done 2026-10-25T21:02:11.285Z containers/runner build: dist/agent.mjs 684.1kb 2026-10-25T21:02:11.287Z containers/runner build: ⚡ Done in 152ms 2026-10-25T21:02:11.295Z containers/runner build: Done 2026-10-25T21:02:14.566Z apps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KB 2026-10-25T21:02:15.203Z apps/diffinery build: docs: 84 pages (+2 generated at runtime), 19 site pages, 11 images, CLI 0.1.0 (254 KiB), editor extension 0.1.2 (26 KiB), JetBrains plugin 0.1.1 (70 KiB), Claude Code plugins diffinery 0.1.4, diffinery-ci 0.2.4 2026-10-25T21:02:15.217Z apps/diffinery build: Done 2026-10-25T21:02:15.457Z ##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another. 2026-10-25T21:02:15.457Z core='/e2e\.test\.mjs$' 2026-10-25T21:02:15.457Z agents='/(agentic|review|tasks)\.test\.mjs$' 2026-10-25T21:02:15.457Z # security.test.mjs, security-*.test.mjs (security-txt's too) and status.test.mjs. 2026-10-25T21:02:15.457Z security='/(security(-[a-z-]+)?|status)\.test\.mjs$' 2026-10-25T21:02:15.457Z # The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on 2026-10-25T21:02:15.457Z # Diffinery's runners): two shards of their own, so no part of the file runs into node's 2026-10-25T21:02:15.457Z # per-file timeout, which is the --test-timeout here. 2026-10-25T21:02:15.457Z histories='^real histories:' 2026-10-25T21:02:15.457Z large='^(large files|large pushes):' 2026-10-25T21:02:15.457Z opts=(--test-timeout=600000) 2026-10-25T21:02:15.457Z case "security" in 2026-10-25T21:02:15.457Z core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;; 2026-10-25T21:02:15.457Z histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;; 2026-10-25T21:02:15.458Z large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;; 2026-10-25T21:02:15.458Z agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;; 2026-10-25T21:02:15.458Z security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;; 2026-10-25T21:02:15.458Z *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;; 2026-10-25T21:02:15.458Z esac 2026-10-25T21:02:15.458Z echo "$files" 2026-10-25T21:02:15.458Z # Two files at a time: each starts its own local server on its own port, database and 2026-10-25T21:02:15.458Z # directory, so they don't share state, and a file's server mostly keeps one core busy. 2026-10-25T21:02:15.458Z node --test --test-concurrency=2 "${opts[@]}" $files 2026-10-25T21:02:15.458Z ##[endgroup] 2026-10-25T21:02:15.508Z test/e2e/security-limits.test.mjs 2026-10-25T21:02:15.508Z test/e2e/security-txt.test.mjs 2026-10-25T21:02:15.508Z test/e2e/security.test.mjs 2026-10-25T21:02:15.508Z test/e2e/status.test.mjs 2026-10-25T21:02:15.602Z TAP version 13 2026-10-25T21:03:18.236Z # Subtest: security: environment reviewers hold a deploy job until a listed person approves, and nobody else can 2026-10-25T21:03:18.240Z ok 1 - security: environment reviewers hold a deploy job until a listed person approves, and nobody else can 2026-10-25T21:03:18.240Z --- 2026-10-25T21:03:18.240Z duration_ms: 62423.17106 2026-10-25T21:03:18.240Z type: 'test' 2026-10-25T21:03:18.240Z ... 2026-10-25T21:03:21.982Z # Subtest: security: adding someone by username sends an invitation, and they get access only once they accept 2026-10-25T21:03:21.983Z ok 2 - security: adding someone by username sends an invitation, and they get access only once they accept 2026-10-25T21:03:21.983Z --- 2026-10-25T21:03:21.983Z duration_ms: 3743.2085 2026-10-25T21:03:21.983Z type: 'test' 2026-10-25T21:03:21.983Z ... 2026-10-25T21:04:27.670Z # Subtest: security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories 2026-10-25T21:04:27.670Z ok 3 - security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories 2026-10-25T21:04:27.670Z --- 2026-10-25T21:04:27.670Z duration_ms: 65685.82621 2026-10-25T21:04:27.670Z type: 'test' 2026-10-25T21:04:27.670Z ... 2026-10-25T21:04:32.989Z # Subtest: security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working 2026-10-25T21:04:32.989Z ok 4 - security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working 2026-10-25T21:04:32.989Z --- 2026-10-25T21:04:32.989Z duration_ms: 5316.61642 2026-10-25T21:04:32.989Z type: 'test' 2026-10-25T21:04:32.989Z ... 2026-10-25T21:05:04.843Z # Subtest: security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance 2026-10-25T21:05:04.844Z ok 5 - security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance 2026-10-25T21:05:04.844Z --- 2026-10-25T21:05:04.844Z duration_ms: 31865.03651 2026-10-25T21:05:04.844Z type: 'test' 2026-10-25T21:05:04.844Z ... 2026-10-25T21:05:05.439Z # Subtest: security: Markdown images from other sites load through Diffinery's signed image proxy 2026-10-25T21:05:05.439Z ok 6 - security: Markdown images from other sites load through Diffinery's signed image proxy 2026-10-25T21:05:05.439Z --- 2026-10-25T21:05:05.439Z duration_ms: 540.24684 2026-10-25T21:05:05.439Z type: 'test' 2026-10-25T21:05:05.439Z ... 2026-10-25T21:05:05.701Z # Subtest: security.txt: every RFC 9116 field with SECURITY_CONTACT set 2026-10-25T21:05:05.702Z ok 7 - security.txt: every RFC 9116 field with SECURITY_CONTACT set 2026-10-25T21:05:05.702Z --- 2026-10-25T21:05:05.702Z duration_ms: 41513.24204 2026-10-25T21:05:05.702Z type: 'test' 2026-10-25T21:05:05.702Z ... 2026-10-25T21:05:05.702Z # Subtest: security reports: security.txt names the form, and an anonymous report needs a reply-to address 2026-10-25T21:05:05.703Z ok 8 - security reports: security.txt names the form, and an anonymous report needs a reply-to address 2026-10-25T21:05:05.703Z --- 2026-10-25T21:05:05.703Z duration_ms: 12616.11957 2026-10-25T21:05:05.703Z type: 'test' 2026-10-25T21:05:05.703Z ... 2026-10-25T21:05:05.704Z # Subtest: security reports: a signed-in report replies to the account's address 2026-10-25T21:05:05.704Z ok 9 - security reports: a signed-in report replies to the account's address 2026-10-25T21:05:05.704Z --- 2026-10-25T21:05:05.704Z duration_ms: 193.01848 2026-10-25T21:05:05.704Z type: 'test' 2026-10-25T21:05:05.704Z ... 2026-10-25T21:05:05.705Z # Subtest: security reports: only site administrators can see them (404 for anyone else) 2026-10-25T21:05:05.705Z ok 10 - security reports: only site administrators can see them (404 for anyone else) 2026-10-25T21:05:05.705Z --- 2026-10-25T21:05:05.705Z duration_ms: 356.11829 2026-10-25T21:05:05.705Z type: 'test' 2026-10-25T21:05:05.705Z ... 2026-10-25T21:05:05.706Z # Subtest: security reports: each new report emails the site administrators, and only them 2026-10-25T21:05:05.706Z ok 11 - security reports: each new report emails the site administrators, and only them 2026-10-25T21:05:05.706Z --- 2026-10-25T21:05:05.706Z duration_ms: 573.56735 2026-10-25T21:05:05.706Z type: 'test' 2026-10-25T21:05:05.706Z ... 2026-10-25T21:05:05.706Z # Subtest: security reports: triage and resolve, on the web and through the API, audited 2026-10-25T21:05:05.707Z ok 12 - security reports: triage and resolve, on the web and through the API, audited 2026-10-25T21:05:05.707Z --- 2026-10-25T21:05:05.707Z duration_ms: 291.38405 2026-10-25T21:05:05.707Z type: 'test' 2026-10-25T21:05:05.707Z ... 2026-10-25T21:05:19.439Z # Subtest: security: search, required checks, environments, reviews, locks, archives, drafts and tree names 2026-10-25T21:05:19.439Z ok 13 - security: search, required checks, environments, reviews, locks, archives, drafts and tree names 2026-10-25T21:05:19.439Z --- 2026-10-25T21:05:19.439Z duration_ms: 28555.32069 2026-10-25T21:05:19.439Z type: 'test' 2026-10-25T21:05:19.439Z ... 2026-10-25T21:05:19.439Z # Subtest: security: organization admins can't hand out ownership 2026-10-25T21:05:19.440Z ok 14 - security: organization admins can't hand out ownership 2026-10-25T21:05:19.440Z --- 2026-10-25T21:05:19.440Z duration_ms: 190.87687 2026-10-25T21:05:19.440Z type: 'test' 2026-10-25T21:05:19.440Z ... 2026-10-25T21:05:19.440Z # Subtest: security: anonymous writes, token scopes, agent secrets, merge rules and drafts 2026-10-25T21:05:19.442Z ok 15 - security: anonymous writes, token scopes, agent secrets, merge rules and drafts 2026-10-25T21:05:19.442Z --- 2026-10-25T21:05:19.442Z duration_ms: 3429.68708 2026-10-25T21:05:19.442Z type: 'test' 2026-10-25T21:05:19.442Z ... 2026-10-25T21:05:19.442Z # Subtest: security: push protection covers commits made without git 2026-10-25T21:05:19.442Z ok 16 - security: push protection covers commits made without git 2026-10-25T21:05:19.442Z --- 2026-10-25T21:05:19.442Z duration_ms: 1217.29128 2026-10-25T21:05:19.442Z type: 'test' 2026-10-25T21:05:19.442Z ... 2026-10-25T21:05:19.443Z # Subtest: security: limited tokens, invisible repositories, readers' labels and the audit trail 2026-10-25T21:05:19.443Z ok 17 - security: limited tokens, invisible repositories, readers' labels and the audit trail 2026-10-25T21:05:19.443Z --- 2026-10-25T21:05:19.443Z duration_ms: 29818.10241 2026-10-25T21:05:19.443Z type: 'test' 2026-10-25T21:05:19.443Z ... 2026-10-25T21:05:19.443Z # Subtest: security: organization pictures are the owners' to change, and invitations aren't sent twice 2026-10-25T21:05:19.443Z ok 18 - security: organization pictures are the owners' to change, and invitations aren't sent twice 2026-10-25T21:05:19.443Z --- 2026-10-25T21:05:19.444Z duration_ms: 212.82281 2026-10-25T21:05:19.444Z type: 'test' 2026-10-25T21:05:19.444Z ... 2026-10-25T21:05:19.444Z # Subtest: security: organization members get the base permission, which only owners change 2026-10-25T21:05:19.444Z ok 19 - security: organization members get the base permission, which only owners change 2026-10-25T21:05:19.444Z --- 2026-10-25T21:05:19.444Z duration_ms: 915.88638 2026-10-25T21:05:19.444Z type: 'test' 2026-10-25T21:05:19.444Z ... 2026-10-25T21:05:19.444Z # Subtest: security: leaving an organization takes its repository access along 2026-10-25T21:05:19.445Z ok 20 - security: leaving an organization takes its repository access along 2026-10-25T21:05:19.445Z --- 2026-10-25T21:05:19.445Z duration_ms: 952.70451 2026-10-25T21:05:19.445Z type: 'test' 2026-10-25T21:05:19.445Z ... 2026-10-25T21:05:19.445Z # Subtest: security: organization settings are checked before anything is saved, and agents see the base permission 2026-10-25T21:05:19.445Z ok 21 - security: organization settings are checked before anything is saved, and agents see the base permission 2026-10-25T21:05:19.445Z --- 2026-10-25T21:05:19.445Z duration_ms: 6980.55089 2026-10-25T21:05:19.445Z type: 'test' 2026-10-25T21:05:19.445Z ... 2026-10-25T21:05:19.445Z # Subtest: security: a transferred repository keeps its data, and its old name redirects only for readers 2026-10-25T21:05:19.445Z ok 22 - security: a transferred repository keeps its data, and its old name redirects only for readers 2026-10-25T21:05:19.446Z --- 2026-10-25T21:05:19.446Z duration_ms: 13250.5157 2026-10-25T21:05:19.446Z type: 'test' 2026-10-25T21:05:19.446Z ... 2026-10-25T21:05:19.446Z # Subtest: security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI 2026-10-25T21:05:19.446Z ok 23 - security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI 2026-10-25T21:05:19.446Z --- 2026-10-25T21:05:19.446Z duration_ms: 25414.24608 2026-10-25T21:05:19.446Z type: 'test' 2026-10-25T21:05:19.446Z ... 2026-10-25T21:05:19.447Z # Subtest: security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more 2026-10-25T21:05:19.447Z ok 24 - security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more 2026-10-25T21:05:19.447Z --- 2026-10-25T21:05:19.447Z duration_ms: 16729.20678 2026-10-25T21:05:19.447Z type: 'test' 2026-10-25T21:05:19.447Z ... 2026-10-25T21:05:53.637Z # Subtest: security: a branch rule has Diffinery auto-merge chosen agents' pull requests by itself, under every rule their own auto-merge has 2026-10-25T21:05:53.638Z ok 25 - security: a branch rule has Diffinery auto-merge chosen agents' pull requests by itself, under every rule their own auto-merge has 2026-10-25T21:05:53.638Z --- 2026-10-25T21:05:53.638Z duration_ms: 34200.37037 2026-10-25T21:05:53.638Z type: 'test' 2026-10-25T21:05:53.638Z ... 2026-10-25T21:05:55.767Z # Subtest: security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue 2026-10-25T21:05:55.768Z ok 26 - security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue 2026-10-25T21:05:55.768Z --- 2026-10-25T21:05:55.768Z duration_ms: 2131.30617 2026-10-25T21:05:55.768Z type: 'test' 2026-10-25T21:05:55.768Z ... 2026-10-25T21:05:58.728Z # Subtest: security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one 2026-10-25T21:05:58.728Z ok 27 - security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one 2026-10-25T21:05:58.728Z --- 2026-10-25T21:05:58.728Z duration_ms: 2959.30413 2026-10-25T21:05:58.728Z type: 'test' 2026-10-25T21:05:58.728Z ... 2026-10-25T21:05:59.633Z # Subtest: security: agents see what auto-merge needs next to the refusal to merge directly 2026-10-25T21:05:59.633Z ok 28 - security: agents see what auto-merge needs next to the refusal to merge directly 2026-10-25T21:05:59.633Z --- 2026-10-25T21:05:59.633Z duration_ms: 905.32823 2026-10-25T21:05:59.633Z type: 'test' 2026-10-25T21:05:59.633Z ... 2026-10-25T21:06:05.385Z # Subtest: security: the queue's bypass button does what it says, and a merge queue can't contradict linear history 2026-10-25T21:06:05.385Z ok 29 - security: the queue's bypass button does what it says, and a merge queue can't contradict linear history 2026-10-25T21:06:05.385Z --- 2026-10-25T21:06:05.385Z duration_ms: 5751.39674 2026-10-25T21:06:05.385Z type: 'test' 2026-10-25T21:06:05.385Z ... 2026-10-25T21:06:06.140Z # Subtest: security: no token can mint a token, an agent or a sandbox, through the API or the web forms 2026-10-25T21:06:06.141Z ok 30 - security: no token can mint a token, an agent or a sandbox, through the API or the web forms 2026-10-25T21:06:06.141Z --- 2026-10-25T21:06:06.141Z duration_ms: 756.40374 2026-10-25T21:06:06.141Z type: 'test' 2026-10-25T21:06:06.141Z ... 2026-10-25T21:06:17.257Z # Subtest: security: repository variable endpoints see only the repository's own, and organization variable deletes are checked 2026-10-25T21:06:17.257Z ok 31 - security: repository variable endpoints see only the repository's own, and organization variable deletes are checked 2026-10-25T21:06:17.257Z --- 2026-10-25T21:06:17.257Z duration_ms: 11116.31258 2026-10-25T21:06:17.257Z type: 'test' 2026-10-25T21:06:17.257Z ... 2026-10-25T21:06:18.029Z # Subtest: security: milestones are checked before an issue is saved, and lists filter by them 2026-10-25T21:06:18.029Z ok 32 - security: milestones are checked before an issue is saved, and lists filter by them 2026-10-25T21:06:18.030Z --- 2026-10-25T21:06:18.030Z duration_ms: 771.91194 2026-10-25T21:06:18.030Z type: 'test' 2026-10-25T21:06:18.030Z ... 2026-10-25T21:06:23.158Z # Subtest: security: push protection reads large files, and revoking a token through the API is on the record 2026-10-25T21:06:23.159Z ok 33 - security: push protection reads large files, and revoking a token through the API is on the record 2026-10-25T21:06:23.159Z --- 2026-10-25T21:06:23.159Z duration_ms: 5126.11609 2026-10-25T21:06:23.159Z type: 'test' 2026-10-25T21:06:23.159Z ... 2026-10-25T21:06:24.245Z # Subtest: security: git request bodies are bounded, compressed or not, before anything reads them 2026-10-25T21:06:24.245Z ok 34 - security: git request bodies are bounded, compressed or not, before anything reads them 2026-10-25T21:06:24.246Z --- 2026-10-25T21:06:24.246Z duration_ms: 1088.9435 2026-10-25T21:06:24.246Z type: 'test' 2026-10-25T21:06:24.246Z ... 2026-10-25T21:06:25.092Z # Subtest: security: a file rewritten from scratch is diffed quickly, even for anonymous readers 2026-10-25T21:06:25.092Z ok 35 - security: a file rewritten from scratch is diffed quickly, even for anonymous readers 2026-10-25T21:06:25.092Z --- 2026-10-25T21:06:25.092Z duration_ms: 846.79199 2026-10-25T21:06:25.092Z type: 'test' 2026-10-25T21:06:25.092Z ... 2026-10-25T21:06:25.707Z # Subtest: security: signed out, a private repository and a missing one look the same everywhere 2026-10-25T21:06:25.707Z ok 36 - security: signed out, a private repository and a missing one look the same everywhere 2026-10-25T21:06:25.707Z --- 2026-10-25T21:06:25.707Z duration_ms: 614.37204 2026-10-25T21:06:25.707Z type: 'test' 2026-10-25T21:06:25.707Z ... 2026-10-25T21:06:26.577Z # Subtest: security: live updates say only that something changed, and never carry audit entries or payloads 2026-10-25T21:06:26.578Z ok 37 - security: live updates say only that something changed, and never carry audit entries or payloads 2026-10-25T21:06:26.578Z --- 2026-10-25T21:06:26.578Z duration_ms: 871.15256 2026-10-25T21:06:26.578Z type: 'test' 2026-10-25T21:06:26.578Z ... 2026-10-25T21:06:30.917Z # Subtest: security: push protection reads commit and tag messages, UTF-16 files and Diffinery's own tokens, and records opt-outs 2026-10-25T21:06:30.917Z ok 38 - security: push protection reads commit and tag messages, UTF-16 files and Diffinery's own tokens, and records opt-outs 2026-10-25T21:06:30.917Z --- 2026-10-25T21:06:30.917Z duration_ms: 4337.78011 2026-10-25T21:06:30.917Z type: 'test' 2026-10-25T21:06:30.917Z ... 2026-10-25T21:06:32.081Z # Subtest: security: required checks gate direct pushes to a protected branch, as on GitHub 2026-10-25T21:06:32.081Z ok 39 - security: required checks gate direct pushes to a protected branch, as on GitHub 2026-10-25T21:06:32.081Z --- 2026-10-25T21:06:32.081Z duration_ms: 1164.39066 2026-10-25T21:06:32.081Z type: 'test' 2026-10-25T21:06:32.081Z ... 2026-10-25T21:06:32.658Z # Subtest: security: issue, pull request and comment text has GitHub's length limits 2026-10-25T21:06:32.658Z ok 40 - security: issue, pull request and comment text has GitHub's length limits 2026-10-25T21:06:32.658Z --- 2026-10-25T21:06:32.658Z duration_ms: 577.90376 2026-10-25T21:06:32.658Z type: 'test' 2026-10-25T21:06:32.658Z ... 2026-10-25T21:06:43.338Z # Subtest: security: deleting a repository deletes its stored objects too 2026-10-25T21:06:43.339Z ok 41 - security: deleting a repository deletes its stored objects too 2026-10-25T21:06:43.339Z --- 2026-10-25T21:06:43.339Z duration_ms: 10677.81585 2026-10-25T21:06:43.339Z type: 'test' 2026-10-25T21:06:43.339Z ... 2026-10-25T21:06:44.612Z # Subtest: security: pushes are checked like git's fsck: no '..' or '.git' entries, no unsafe .gitmodules 2026-10-25T21:06:44.612Z ok 42 - security: pushes are checked like git's fsck: no '..' or '.git' entries, no unsafe .gitmodules 2026-10-25T21:06:44.612Z --- 2026-10-25T21:06:44.612Z duration_ms: 1274.69815 2026-10-25T21:06:44.612Z type: 'test' 2026-10-25T21:06:44.612Z ... 2026-10-25T21:06:45.795Z # Subtest: security: a job's runner gets only the secrets the job names 2026-10-25T21:06:45.796Z ok 43 - security: a job's runner gets only the secrets the job names 2026-10-25T21:06:45.796Z --- 2026-10-25T21:06:45.796Z duration_ms: 1183.17998 2026-10-25T21:06:45.796Z type: 'test' 2026-10-25T21:06:45.796Z ... 2026-10-25T21:06:47.146Z # Subtest: security: runs of agent code get no repository secrets unless an admin allows it 2026-10-25T21:06:47.146Z ok 44 - security: runs of agent code get no repository secrets unless an admin allows it 2026-10-25T21:06:47.146Z --- 2026-10-25T21:06:47.146Z duration_ms: 1347.54249 2026-10-25T21:06:47.146Z type: 'test' 2026-10-25T21:06:47.146Z ... 2026-10-25T21:06:49.156Z # Subtest: security: an agent's commits stay agent code when a person pushes on top, until a person merges them 2026-10-25T21:06:49.156Z ok 45 - security: an agent's commits stay agent code when a person pushes on top, until a person merges them 2026-10-25T21:06:49.156Z --- 2026-10-25T21:06:49.156Z duration_ms: 2011.20252 2026-10-25T21:06:49.156Z type: 'test' 2026-10-25T21:06:49.156Z ... 2026-10-25T21:06:52.269Z # Subtest: security: a workflow on another branch can't cancel a protected branch's run by naming its concurrency group 2026-10-25T21:06:52.269Z ok 46 - security: a workflow on another branch can't cancel a protected branch's run by naming its concurrency group 2026-10-25T21:06:52.269Z --- 2026-10-25T21:06:52.269Z duration_ms: 3114.4904 2026-10-25T21:06:52.269Z type: 'test' 2026-10-25T21:06:52.269Z ... 2026-10-25T21:06:53.034Z # Subtest: security: adding someone by email always invites them, so the address doesn't reveal their username and they agree first 2026-10-25T21:06:53.034Z ok 47 - security: adding someone by email always invites them, so the address doesn't reveal their username and they agree first 2026-10-25T21:06:53.034Z --- 2026-10-25T21:06:53.034Z duration_ms: 765.56077 2026-10-25T21:06:53.034Z type: 'test' 2026-10-25T21:06:53.034Z ... 2026-10-25T21:06:55.729Z # Subtest: security: a job's log is capped, and oversized workflow files aren't parsed 2026-10-25T21:06:55.729Z ok 48 - security: a job's log is capped, and oversized workflow files aren't parsed 2026-10-25T21:06:55.729Z --- 2026-10-25T21:06:55.729Z duration_ms: 2693.21706 2026-10-25T21:06:55.729Z type: 'test' 2026-10-25T21:06:55.729Z ... 2026-10-25T21:06:57.138Z # Subtest: security: a workflow's token can't use another repository's private packages, and a repository's name is its own 2026-10-25T21:06:57.138Z ok 49 - security: a workflow's token can't use another repository's private packages, and a repository's name is its own 2026-10-25T21:06:57.138Z --- 2026-10-25T21:06:57.138Z duration_ms: 1410.35424 2026-10-25T21:06:57.138Z type: 'test' 2026-10-25T21:06:57.138Z ... 2026-10-25T21:06:58.396Z # Subtest: security: OIDC tokens name the environment a job deployed to, and carry ids that survive a reused name 2026-10-25T21:06:58.396Z ok 50 - security: OIDC tokens name the environment a job deployed to, and carry ids that survive a reused name 2026-10-25T21:06:58.396Z --- 2026-10-25T21:06:58.396Z duration_ms: 1251.61462 2026-10-25T21:06:58.396Z type: 'test' 2026-10-25T21:06:58.396Z ... 2026-10-25T21:06:59.210Z # Subtest: security: sensitive actions need a recent sign-in, sessions end 90 days after it, and one browser can be signed out 2026-10-25T21:06:59.210Z ok 51 - security: sensitive actions need a recent sign-in, sessions end 90 days after it, and one browser can be signed out 2026-10-25T21:06:59.210Z --- 2026-10-25T21:06:59.210Z duration_ms: 819.26583 2026-10-25T21:06:59.210Z type: 'test' 2026-10-25T21:06:59.210Z ... 2026-10-25T21:07:01.072Z # Subtest: security: self-hosted runners register with a one-hour token and claim jobs with their own 2026-10-25T21:07:01.072Z ok 52 - security: self-hosted runners register with a one-hour token and claim jobs with their own 2026-10-25T21:07:01.072Z --- 2026-10-25T21:07:01.072Z duration_ms: 1862.36607 2026-10-25T21:07:01.072Z type: 'test' 2026-10-25T21:07:01.072Z ... 2026-10-25T21:07:04.450Z # Subtest: security: an organization secret reaches only the repositories it's shared with 2026-10-25T21:07:04.451Z ok 53 - security: an organization secret reaches only the repositories it's shared with 2026-10-25T21:07:04.451Z --- 2026-10-25T21:07:04.451Z duration_ms: 3378.38211 2026-10-25T21:07:04.451Z type: 'test' 2026-10-25T21:07:04.451Z ... 2026-10-25T21:07:06.318Z # Subtest: security: an admin can purge objects a force-push left unreachable 2026-10-25T21:07:06.318Z ok 54 - security: an admin can purge objects a force-push left unreachable 2026-10-25T21:07:06.319Z --- 2026-10-25T21:07:06.319Z duration_ms: 1866.32679 2026-10-25T21:07:06.319Z type: 'test' 2026-10-25T21:07:06.319Z ... 2026-10-25T21:07:12.093Z # Subtest: security: an admin can start over by deleting closed pull requests and the commits only they keep 2026-10-25T21:07:12.093Z ok 55 - security: an admin can start over by deleting closed pull requests and the commits only they keep 2026-10-25T21:07:12.094Z --- 2026-10-25T21:07:12.094Z duration_ms: 5775.97715 2026-10-25T21:07:12.094Z type: 'test' 2026-10-25T21:07:12.094Z ... 2026-10-25T21:07:13.649Z # Subtest: security: webhooks reach only public hosts other than Diffinery, at most 20 per repository 2026-10-25T21:07:13.649Z ok 56 - security: webhooks reach only public hosts other than Diffinery, at most 20 per repository 2026-10-25T21:07:13.649Z --- 2026-10-25T21:07:13.649Z duration_ms: 1555.55406 2026-10-25T21:07:13.649Z type: 'test' 2026-10-25T21:07:13.649Z ... 2026-10-25T21:07:17.896Z # Subtest: security: invitations and test emails have limits, so an account can't be used to send mail in bulk 2026-10-25T21:07:17.896Z ok 57 - security: invitations and test emails have limits, so an account can't be used to send mail in bulk 2026-10-25T21:07:17.896Z --- 2026-10-25T21:07:17.896Z duration_ms: 4246.40165 2026-10-25T21:07:17.896Z type: 'test' 2026-10-25T21:07:17.896Z ... 2026-10-25T21:07:18.932Z # Subtest: security: inputs that were taken on trust are checked (collaborators, check links, paging, MCP batches, reserved names) 2026-10-25T21:07:18.933Z ok 58 - security: inputs that were taken on trust are checked (collaborators, check links, paging, MCP batches, reserved names) 2026-10-25T21:07:18.933Z --- 2026-10-25T21:07:18.933Z duration_ms: 1035.59521 2026-10-25T21:07:18.933Z type: 'test' 2026-10-25T21:07:18.933Z ... 2026-10-25T21:07:35.065Z # Subtest: merge on green: one settings page, and people's and agents' own setting, turn on auto-merge as pull requests open, never past a rule 2026-10-25T21:07:35.065Z ok 59 - merge on green: one settings page, and people's and agents' own setting, turn on auto-merge as pull requests open, never past a rule 2026-10-25T21:07:35.066Z --- 2026-10-25T21:07:35.066Z duration_ms: 16039.14212 2026-10-25T21:07:35.066Z type: 'test' 2026-10-25T21:07:35.066Z ... 2026-10-25T21:07:35.193Z # Subtest: status page: anyone can read it, and everything is operational at first 2026-10-25T21:07:35.193Z ok 60 - status page: anyone can read it, and everything is operational at first 2026-10-25T21:07:35.193Z --- 2026-10-25T21:07:35.193Z duration_ms: 11088.07052 2026-10-25T21:07:35.193Z type: 'test' 2026-10-25T21:07:35.193Z ... 2026-10-25T21:07:35.193Z # Subtest: status page: only site administrators can manage incidents (404 for anyone else) 2026-10-25T21:07:35.193Z ok 61 - status page: only site administrators can manage incidents (404 for anyone else) 2026-10-25T21:07:35.193Z --- 2026-10-25T21:07:35.193Z duration_ms: 240.36049 2026-10-25T21:07:35.193Z type: 'test' 2026-10-25T21:07:35.193Z ... 2026-10-25T21:07:35.193Z # Subtest: status page: a site administrator opens an incident through the API, and the page shows it 2026-10-25T21:07:35.193Z ok 62 - status page: a site administrator opens an incident through the API, and the page shows it 2026-10-25T21:07:35.193Z --- 2026-10-25T21:07:35.193Z duration_ms: 189.62273 2026-10-25T21:07:35.193Z type: 'test' 2026-10-25T21:07:35.193Z ... 2026-10-25T21:07:35.194Z # Subtest: status page: the web form opens an incident with several components and posts updates 2026-10-25T21:07:35.194Z ok 63 - status page: the web form opens an incident with several components and posts updates 2026-10-25T21:07:35.194Z --- 2026-10-25T21:07:35.194Z duration_ms: 570.31251 2026-10-25T21:07:35.194Z type: 'test' 2026-10-25T21:07:35.194Z ... 2026-10-25T21:07:35.194Z # Subtest: status page: resolving through the API returns the component to operational and moves the incident to past incidents 2026-10-25T21:07:35.194Z ok 64 - status page: resolving through the API returns the component to operational and moves the incident to past incidents 2026-10-25T21:07:35.194Z --- 2026-10-25T21:07:35.194Z duration_ms: 211.78677 2026-10-25T21:07:35.194Z type: 'test' 2026-10-25T21:07:35.194Z ... 2026-10-25T21:07:35.194Z # Subtest: status page: changes are audited without the updates' text 2026-10-25T21:07:35.194Z ok 65 - status page: changes are audited without the updates' text 2026-10-25T21:07:35.194Z --- 2026-10-25T21:07:35.194Z duration_ms: 40.38521 2026-10-25T21:07:35.194Z type: 'test' 2026-10-25T21:07:35.194Z ... 2026-10-25T21:07:35.194Z # Subtest: status page: pausing hosted compute shows Actions and agent sandboxes under maintenance 2026-10-25T21:07:35.194Z ok 66 - status page: pausing hosted compute shows Actions and agent sandboxes under maintenance 2026-10-25T21:07:35.194Z --- 2026-10-25T21:07:35.194Z duration_ms: 179.89823 2026-10-25T21:07:35.194Z type: 'test' 2026-10-25T21:07:35.194Z ... 2026-10-25T21:07:35.195Z 1..66 2026-10-25T21:07:35.195Z # tests 66 2026-10-25T21:07:35.195Z # suites 0 2026-10-25T21:07:35.195Z # pass 66 2026-10-25T21:07:35.195Z # fail 0 2026-10-25T21:07:35.195Z # cancelled 0 2026-10-25T21:07:35.195Z # skipped 0 2026-10-25T21:07:35.195Z # todo 0 2026-10-25T21:07:35.195Z # duration_ms 319623.67423 2026-10-25T21:07:35.330Z Cache hit occurred on the primary key node-cache-Linux-x64-pnpm-42d02c0263a3b5f911ed6ae8e9210922b97166ca02e60b2c70c55dfa1f00371b, not saving cache. 2026-10-25T21:07:35.720Z Pruning is unnecessary. 2026-10-25T21:07:35.828Z Removing persisted credentials 2026-10-25T21:07:35.889Z Host: 1% of the vCPUs' time went to other work on the host (steal) 2026-10-25T21:07:35.889Z Job completed with conclusion: success 2026-10-25T21:07:35.892Z Resources: 1.8 of 4 vCPUs busy on average (3.2 at the 95th percentile), peak memory 5.0 GiB of 11.9 GiB, peak disk 2.2 GB of 19.2 GB