2026-10-16T12:50:31.082Z Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@37f7c3051ccc 2026-10-16T12:50:31.093Z Runner: image diffinery-runner:2a3052eff7a82a483a7fde51, in mad07, WEUR, container 4a7e59b21b7798b65a1c071cc404c0f1e5eb62c3d22e85610cfdf9cb51c6e81e 2026-10-16T12:50:31.093Z Workspace: /workspace/diffinery 2026-10-16T12:50:31.160Z ##[group]Run actions/checkout@v4 2026-10-16T12:50:31.160Z ##[endgroup] 2026-10-16T12:50:31.162Z Syncing repository: codician/diffinery 2026-10-16T12:50:31.214Z Fetching the repository (depth 1) 2026-10-16T12:50:31.944Z remote: Enumerating objects: 597, done. 2026-10-16T12:50:32.247Z Receiving objects: 0% (1/597) Receiving objects: 1% (6/597) Receiving objects: 2% (12/597) Receiving objects: 3% (18/597) Receiving objects: 4% (24/597) Receiving objects: 5% (30/597) Receiving objects: 6% (36/597) Receiving objects: 7% (42/597) Receiving objects: 8% (48/597) Receiving objects: 9% (54/597) Receiving objects: 10% (60/597) Receiving objects: 11% (66/597) Receiving objects: 12% (72/597) Receiving objects: 13% (78/597) Receiving objects: 14% (84/597) Receiving objects: 15% (90/597) Receiving objects: 16% (96/597) Receiving objects: 17% (102/597) Receiving objects: 18% (108/597) Receiving objects: 19% (114/597) Receiving objects: 20% (120/597) Receiving objects: 21% (126/597) Receiving objects: 22% (132/597) Receiving objects: 23% (138/597) Receiving objects: 24% (144/597) Receiving objects: 25% (150/597) Receiving objects: 26% (156/597) Receiving objects: 27% (162/597) Receiving objects: 28% (168/597) Receiving objects: 29% (174/597) Receiving objects: 30% (180/597) Receiving objects: 31% (186/597) Receiving objects: 32% (192/597) Receiving objects: 33% (198/597) Receiving objects: 34% (203/597) Receiving objects: 35% (209/597) Receiving objects: 36% (215/597) Receiving objects: 37% (221/597) Receiving objects: 38% (227/597) Receiving objects: 39% (233/597) Receiving objects: 40% (239/597) Receiving objects: 41% (245/597) Receiving objects: 42% (251/597) Receiving objects: 43% (257/597) Receiving objects: 44% (263/597) Receiving objects: 45% (269/597) Receiving objects: 46% (275/597) Receiving objects: 47% (281/597) Receiving objects: 48% (287/597) Receiving objects: 49% (293/597) Receiving objects: 50% (299/597) Receiving objects: 51% (305/597) Receiving objects: 52% (311/597) Receiving objects: 53% (317/597) Receiving objects: 54% (323/597) Receiving objects: 55% (329/597) Receiving objects: 56% (335/597) Receiving objects: 57% (341/597) Receiving objects: 58% (347/597) Receiving objects: 59% (353/597) Receiving objects: 60% (359/597) Receiving objects: 61% (365/597) Receiving objects: 62% (371/597) Receiving objects: 63% (377/597) Receiving objects: 64% (383/597) Receiving objects: 65% (389/597) Receiving objects: 66% (395/597) Receiving objects: 67% (400/597) Receiving objects: 68% (406/597) Receiving objects: 69% (412/597) Receiving objects: 70% (418/597) Receiving objects: 71% (424/597) Receiving objects: 72% (430/597) Receiving objects: 73% (436/597) Receiving objects: 74% (442/597) Receiving objects: 75% (448/597) Receiving objects: 76% (454/597) Receiving objects: 77% (460/597) Receiving objects: 78% (466/597) Receiving objects: 79% (472/597) Receiving objects: 80% (478/597) Receiving objects: 81% (484/597) Receiving objects: 82% (490/597) Receiving objects: 83% (496/597) Receiving objects: 84% (502/597) Receiving objects: 85% (508/597) Receiving objects: 86% (514/597) Receiving objects: 87% (520/597) Receiving objects: 88% (526/597) Receiving objects: 89% (532/597) Receiving objects: 90% (538/597) Receiving objects: 91% (544/597) Receiving objects: 92% (550/597) Receiving objects: 93% (556/597) Receiving objects: 94% (562/597) Receiving objects: 95% (568/597) Receiving objects: 96% (574/597) Receiving objects: 97% (580/597) Receiving objects: 98% (586/597) Receiving objects: 99% (592/597) Receiving objects: 100% (597/597) Receiving objects: 100% (597/597), 2.43 MiB | 8.38 MiB/s, done. 2026-10-16T12:50:32.248Z remote: Total 597 (delta 0), reused 597 (delta 0) 2026-10-16T12:50:32.258Z From https://diffinery.com/codician/diffinery 2026-10-16T12:50:32.258Z * [new ref] 37f7c3051ccc9a4fcfae682ee854be11d93ecbf3 -> origin/diffinery-checkout 2026-10-16T12:50:32.336Z Note: switching to '37f7c3051ccc9a4fcfae682ee854be11d93ecbf3'. 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z You are in 'detached HEAD' state. You can look around, make experimental 2026-10-16T12:50:32.336Z changes and commit them, and you can discard any commits you make in this 2026-10-16T12:50:32.336Z state without impacting any branches by switching back to a branch. 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z If you want to create a new branch to retain commits you create, you may 2026-10-16T12:50:32.336Z do so (now or later) by using -c with the switch command. Example: 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z git switch -c 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z Or undo this operation with: 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z git switch - 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z Turn off this advice by setting config variable advice.detachedHead to false 2026-10-16T12:50:32.336Z 2026-10-16T12:50:32.336Z HEAD is now at 37f7c30 Merge 2b8e7c9a325725169c8cd1e7da59577576bc0872 into 1998051a0f75ce604d7db05ab303354c68caef3f 2026-10-16T12:50:32.340Z HEAD is now at 37f7c3051ccc9a4fcfae682ee854be11d93ecbf3 2026-10-16T12:50:32.477Z Download action repository 'pnpm/action-setup@v4' 2026-10-16T12:50:33.037Z ##[group]Run pnpm/action-setup@v4 2026-10-16T12:50:33.037Z with: 2026-10-16T12:50:33.037Z dest: ~/setup-pnpm 2026-10-16T12:50:33.037Z run_install: null 2026-10-16T12:50:33.037Z cache: false 2026-10-16T12:50:33.037Z cache_dependency_path: pnpm-lock.yaml 2026-10-16T12:50:33.037Z package_json_file: package.json 2026-10-16T12:50:33.037Z standalone: false 2026-10-16T12:50:33.037Z ##[endgroup] 2026-10-16T12:50:33.266Z ##[group]Running self-installer... 2026-10-16T12:50:33.918Z Progress: resolved 1, reused 0, downloaded 0, added 0 2026-10-16T12:50:33.926Z Packages: +1 2026-10-16T12:50:33.926Z + 2026-10-16T12:50:34.479Z Progress: resolved 1, reused 0, downloaded 1, added 1, done 2026-10-16T12:50:34.506Z 2026-10-16T12:50:34.506Z dependencies: 2026-10-16T12:50:34.506Z + pnpm 10.28.0 (12.14.0 is available) 2026-10-16T12:50:34.506Z 2026-10-16T12:50:34.509Z Done in 1s 2026-10-16T12:50:34.533Z ##[endgroup] 2026-10-16T12:50:34.533Z Installation Completed! 2026-10-16T12:50:34.693Z ##[group]Run actions/setup-node@v4 2026-10-16T12:50:34.693Z with: 2026-10-16T12:50:34.693Z node-version: 22 2026-10-16T12:50:34.693Z cache: pnpm 2026-10-16T12:50:34.693Z ##[endgroup] 2026-10-16T12:50:34.700Z Found in cache @ 22.22.0 (pre-installed node satisfies '22') 2026-10-16T12:50:37.773Z Cache Size: ~215 MB (225870423 B) 2026-10-16T12:50:41.149Z Cache restored from key: node-cache-Linux-x64-pnpm-4b94436b86798d88b931ea24b5b847697aebf45520d6ef384cb382ce6c1f1e08 2026-10-16T12:50:41.297Z ##[group]Run pnpm install --frozen-lockfile 2026-10-16T12:50:41.297Z ##[endgroup] 2026-10-16T12:50:41.696Z Scope: all 7 workspace projects 2026-10-16T12:50:41.762Z Lockfile is up to date, resolution step is skipped 2026-10-16T12:50:41.807Z Progress: resolved 1, reused 0, downloaded 0, added 0 2026-10-16T12:50:41.847Z Packages: +248 2026-10-16T12:50:41.848Z ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2026-10-16T12:50:42.782Z Progress: resolved 248, reused 242, downloaded 0, added 248, done 2026-10-16T12:50:53.362Z 2026-10-16T12:50:53.362Z devDependencies: 2026-10-16T12:50:53.362Z + turbo 2.11.7 2026-10-16T12:50:53.362Z + typescript 5.9.3 2026-10-16T12:50:53.362Z 2026-10-16T12:50:53.668Z Done in 12.3s using pnpm v10.28.0 2026-10-16T12:50:54.117Z ##[group]Run pnpm -r --if-present build 2026-10-16T12:50:54.117Z ##[endgroup] 2026-10-16T12:50:54.528Z Scope: 6 of 7 workspace projects 2026-10-16T12:50:54.528Z apps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env node 2026-10-16T12:50:54.528Z import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);" 2026-10-16T12:50:54.528Z apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjs 2026-10-16T12:50:54.528Z containers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);" 2026-10-16T12:50:54.605Z apps/cli build: dist/diffinery.mjs 439.5kb 2026-10-16T12:50:54.608Z apps/cli build: ⚡ Done in 60ms 2026-10-16T12:50:54.613Z apps/cli build: Done 2026-10-16T12:50:54.621Z containers/runner build: dist/agent.mjs 657.3kb 2026-10-16T12:50:54.622Z containers/runner build: ⚡ Done in 75ms 2026-10-16T12:50:54.626Z containers/runner build: Done 2026-10-16T12:50:55.444Z apps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KB 2026-10-16T12:50:55.873Z apps/diffinery build: docs: 62 pages (+2 generated at runtime), CLI 0.1.0 (230 KiB) 2026-10-16T12:50:55.885Z apps/diffinery build: Done 2026-10-16T12:50:56.142Z ##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another. 2026-10-16T12:50:56.142Z core='/e2e\.test\.mjs$' 2026-10-16T12:50:56.142Z agents='/(agentic|review|tasks)\.test\.mjs$' 2026-10-16T12:50:56.142Z security='/(security|status)\.test\.mjs$' 2026-10-16T12:50:56.142Z # The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on 2026-10-16T12:50:56.142Z # Diffinery's runners): two shards of their own, so no part of the file runs into node's 2026-10-16T12:50:56.142Z # per-file timeout, which is the --test-timeout here. 2026-10-16T12:50:56.142Z histories='^real histories:' 2026-10-16T12:50:56.142Z large='^(large files|large pushes):' 2026-10-16T12:50:56.142Z opts=(--test-timeout=600000) 2026-10-16T12:50:56.142Z case "security" in 2026-10-16T12:50:56.142Z core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;; 2026-10-16T12:50:56.142Z histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;; 2026-10-16T12:50:56.142Z large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;; 2026-10-16T12:50:56.142Z agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;; 2026-10-16T12:50:56.142Z security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;; 2026-10-16T12:50:56.142Z *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;; 2026-10-16T12:50:56.142Z esac 2026-10-16T12:50:56.142Z echo "$files" 2026-10-16T12:50:56.142Z node --test --test-concurrency=1 "${opts[@]}" $files 2026-10-16T12:50:56.142Z ##[endgroup] 2026-10-16T12:50:56.510Z test/e2e/security.test.mjs 2026-10-16T12:50:56.510Z test/e2e/status.test.mjs 2026-10-16T12:50:56.557Z TAP version 13 2026-10-16T12:51:22.273Z # Subtest: security: search, required checks, environments, reviews, locks, archives, drafts and tree names 2026-10-16T12:51:22.274Z ok 1 - security: search, required checks, environments, reviews, locks, archives, drafts and tree names 2026-10-16T12:51:22.274Z --- 2026-10-16T12:51:22.274Z duration_ms: 25656.353419 2026-10-16T12:51:22.274Z type: 'test' 2026-10-16T12:51:22.274Z ... 2026-10-16T12:51:22.359Z # Subtest: security: organization admins can't hand out ownership 2026-10-16T12:51:22.359Z ok 2 - security: organization admins can't hand out ownership 2026-10-16T12:51:22.359Z --- 2026-10-16T12:51:22.359Z duration_ms: 86.020703 2026-10-16T12:51:22.359Z type: 'test' 2026-10-16T12:51:22.359Z ... 2026-10-16T12:51:23.589Z # Subtest: security: anonymous writes, token scopes, agent secrets, merge rules and drafts 2026-10-16T12:51:23.589Z ok 3 - security: anonymous writes, token scopes, agent secrets, merge rules and drafts 2026-10-16T12:51:23.589Z --- 2026-10-16T12:51:23.589Z duration_ms: 1229.977707 2026-10-16T12:51:23.589Z type: 'test' 2026-10-16T12:51:23.589Z ... 2026-10-16T12:51:23.952Z # Subtest: security: push protection covers commits made without git 2026-10-16T12:51:23.953Z ok 4 - security: push protection covers commits made without git 2026-10-16T12:51:23.953Z --- 2026-10-16T12:51:23.953Z duration_ms: 361.907941 2026-10-16T12:51:23.953Z type: 'test' 2026-10-16T12:51:23.953Z ... 2026-10-16T12:51:37.823Z # Subtest: security: limited tokens, invisible repositories, readers' labels and the audit trail 2026-10-16T12:51:37.824Z ok 5 - security: limited tokens, invisible repositories, readers' labels and the audit trail 2026-10-16T12:51:37.831Z --- 2026-10-16T12:51:37.831Z duration_ms: 13872.924792 2026-10-16T12:51:37.831Z type: 'test' 2026-10-16T12:51:37.831Z ... 2026-10-16T12:51:37.907Z # Subtest: security: organization pictures are the owners' to change, and invitations aren't sent twice 2026-10-16T12:51:37.907Z ok 6 - security: organization pictures are the owners' to change, and invitations aren't sent twice 2026-10-16T12:51:37.907Z --- 2026-10-16T12:51:37.907Z duration_ms: 83.426158 2026-10-16T12:51:37.907Z type: 'test' 2026-10-16T12:51:37.907Z ... 2026-10-16T12:51:38.249Z # Subtest: security: organization members get the base permission, which only owners change 2026-10-16T12:51:38.251Z ok 7 - security: organization members get the base permission, which only owners change 2026-10-16T12:51:38.251Z --- 2026-10-16T12:51:38.251Z duration_ms: 341.553786 2026-10-16T12:51:38.251Z type: 'test' 2026-10-16T12:51:38.251Z ... 2026-10-16T12:51:38.588Z # Subtest: security: leaving an organization takes its repository access along 2026-10-16T12:51:38.588Z ok 8 - security: leaving an organization takes its repository access along 2026-10-16T12:51:38.588Z --- 2026-10-16T12:51:38.588Z duration_ms: 339.498831 2026-10-16T12:51:38.588Z type: 'test' 2026-10-16T12:51:38.588Z ... 2026-10-16T12:51:42.119Z # Subtest: security: organization settings are checked before anything is saved, and agents see the base permission 2026-10-16T12:51:42.119Z ok 9 - security: organization settings are checked before anything is saved, and agents see the base permission 2026-10-16T12:51:42.119Z --- 2026-10-16T12:51:42.119Z duration_ms: 3527.306466 2026-10-16T12:51:42.119Z type: 'test' 2026-10-16T12:51:42.119Z ... 2026-10-16T12:51:48.244Z # Subtest: security: a transferred repository keeps its data, and its old name redirects only for readers 2026-10-16T12:51:48.244Z ok 10 - security: a transferred repository keeps its data, and its old name redirects only for readers 2026-10-16T12:51:48.244Z --- 2026-10-16T12:51:48.244Z duration_ms: 6126.837788 2026-10-16T12:51:48.244Z type: 'test' 2026-10-16T12:51:48.244Z ... 2026-10-16T12:52:00.999Z # Subtest: security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI 2026-10-16T12:52:00.999Z ok 11 - security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI 2026-10-16T12:52:00.999Z --- 2026-10-16T12:52:00.999Z duration_ms: 12755.22865 2026-10-16T12:52:00.999Z type: 'test' 2026-10-16T12:52:00.999Z ... 2026-10-16T12:52:11.363Z # Subtest: security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more 2026-10-16T12:52:11.363Z ok 12 - security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more 2026-10-16T12:52:11.363Z --- 2026-10-16T12:52:11.363Z duration_ms: 10364.529685 2026-10-16T12:52:11.363Z type: 'test' 2026-10-16T12:52:11.363Z ... 2026-10-16T12:52:11.960Z # Subtest: security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue 2026-10-16T12:52:11.960Z ok 13 - security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue 2026-10-16T12:52:11.960Z --- 2026-10-16T12:52:11.960Z duration_ms: 597.631867 2026-10-16T12:52:11.960Z type: 'test' 2026-10-16T12:52:11.960Z ... 2026-10-16T12:52:13.069Z # Subtest: security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one 2026-10-16T12:52:13.069Z ok 14 - security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one 2026-10-16T12:52:13.069Z --- 2026-10-16T12:52:13.069Z duration_ms: 1107.64976 2026-10-16T12:52:13.069Z type: 'test' 2026-10-16T12:52:13.069Z ... 2026-10-16T12:52:13.640Z # Subtest: security: agents see what auto-merge needs next to the refusal to merge directly 2026-10-16T12:52:13.640Z ok 15 - security: agents see what auto-merge needs next to the refusal to merge directly 2026-10-16T12:52:13.640Z --- 2026-10-16T12:52:13.640Z duration_ms: 571.772969 2026-10-16T12:52:13.640Z type: 'test' 2026-10-16T12:52:13.640Z ... 2026-10-16T12:52:16.307Z # Subtest: security: the queue's bypass button does what it says, and a merge queue can't contradict linear history 2026-10-16T12:52:16.307Z ok 16 - security: the queue's bypass button does what it says, and a merge queue can't contradict linear history 2026-10-16T12:52:16.307Z --- 2026-10-16T12:52:16.307Z duration_ms: 2666.002077 2026-10-16T12:52:16.307Z type: 'test' 2026-10-16T12:52:16.307Z ... 2026-10-16T12:52:16.623Z # Subtest: security: no token can mint a token, an agent or a sandbox, through the API or the web forms 2026-10-16T12:52:16.623Z ok 17 - security: no token can mint a token, an agent or a sandbox, through the API or the web forms 2026-10-16T12:52:16.623Z --- 2026-10-16T12:52:16.623Z duration_ms: 317.111283 2026-10-16T12:52:16.623Z type: 'test' 2026-10-16T12:52:16.623Z ... 2026-10-16T12:52:22.196Z # Subtest: security: repository variable endpoints see only the repository's own, and organization variable deletes are checked 2026-10-16T12:52:22.196Z ok 18 - security: repository variable endpoints see only the repository's own, and organization variable deletes are checked 2026-10-16T12:52:22.196Z --- 2026-10-16T12:52:22.196Z duration_ms: 5572.47816 2026-10-16T12:52:22.196Z type: 'test' 2026-10-16T12:52:22.196Z ... 2026-10-16T12:52:22.447Z # Subtest: security: milestones are checked before an issue is saved, and lists filter by them 2026-10-16T12:52:22.447Z ok 19 - security: milestones are checked before an issue is saved, and lists filter by them 2026-10-16T12:52:22.447Z --- 2026-10-16T12:52:22.447Z duration_ms: 251.310804 2026-10-16T12:52:22.447Z type: 'test' 2026-10-16T12:52:22.447Z ... 2026-10-16T12:52:24.623Z # Subtest: security: push protection reads large files, and revoking a token through the API is on the record 2026-10-16T12:52:24.623Z ok 20 - security: push protection reads large files, and revoking a token through the API is on the record 2026-10-16T12:52:24.623Z --- 2026-10-16T12:52:24.623Z duration_ms: 2175.123506 2026-10-16T12:52:24.623Z type: 'test' 2026-10-16T12:52:24.623Z ... 2026-10-16T12:52:25.164Z # Subtest: security: git request bodies are bounded, compressed or not, before anything reads them 2026-10-16T12:52:25.164Z ok 21 - security: git request bodies are bounded, compressed or not, before anything reads them 2026-10-16T12:52:25.164Z --- 2026-10-16T12:52:25.164Z duration_ms: 540.818259 2026-10-16T12:52:25.164Z type: 'test' 2026-10-16T12:52:25.164Z ... 2026-10-16T12:52:25.608Z # Subtest: security: a file rewritten from scratch is diffed quickly, even for anonymous readers 2026-10-16T12:52:25.608Z ok 22 - security: a file rewritten from scratch is diffed quickly, even for anonymous readers 2026-10-16T12:52:25.608Z --- 2026-10-16T12:52:25.608Z duration_ms: 444.484655 2026-10-16T12:52:25.608Z type: 'test' 2026-10-16T12:52:25.608Z ... 2026-10-16T12:52:25.788Z # Subtest: security: signed out, a private repository and a missing one look the same everywhere 2026-10-16T12:52:25.788Z ok 23 - security: signed out, a private repository and a missing one look the same everywhere 2026-10-16T12:52:25.788Z --- 2026-10-16T12:52:25.788Z duration_ms: 179.632762 2026-10-16T12:52:25.788Z type: 'test' 2026-10-16T12:52:25.788Z ... 2026-10-16T12:52:26.397Z # Subtest: security: live updates say only that something changed, and never carry audit entries or payloads 2026-10-16T12:52:26.397Z ok 24 - security: live updates say only that something changed, and never carry audit entries or payloads 2026-10-16T12:52:26.397Z --- 2026-10-16T12:52:26.397Z duration_ms: 608.337377 2026-10-16T12:52:26.397Z type: 'test' 2026-10-16T12:52:26.397Z ... 2026-10-16T12:52:28.531Z # Subtest: security: push protection reads commit and tag messages, UTF-16 files and Diffinery's own tokens, and records opt-outs 2026-10-16T12:52:28.531Z ok 25 - security: push protection reads commit and tag messages, UTF-16 files and Diffinery's own tokens, and records opt-outs 2026-10-16T12:52:28.531Z --- 2026-10-16T12:52:28.531Z duration_ms: 2134.759453 2026-10-16T12:52:28.531Z type: 'test' 2026-10-16T12:52:28.531Z ... 2026-10-16T12:52:28.812Z # Subtest: security: required checks gate direct pushes to a protected branch, as on GitHub 2026-10-16T12:52:28.812Z ok 26 - security: required checks gate direct pushes to a protected branch, as on GitHub 2026-10-16T12:52:28.812Z --- 2026-10-16T12:52:28.812Z duration_ms: 279.34579 2026-10-16T12:52:28.812Z type: 'test' 2026-10-16T12:52:28.812Z ... 2026-10-16T12:52:28.992Z # Subtest: security: issue, pull request and comment text has GitHub's length limits 2026-10-16T12:52:28.992Z ok 27 - security: issue, pull request and comment text has GitHub's length limits 2026-10-16T12:52:28.992Z --- 2026-10-16T12:52:28.992Z duration_ms: 181.638684 2026-10-16T12:52:28.992Z type: 'test' 2026-10-16T12:52:28.992Z ... 2026-10-16T12:52:34.356Z # Subtest: security: deleting a repository deletes its stored objects too 2026-10-16T12:52:34.356Z ok 28 - security: deleting a repository deletes its stored objects too 2026-10-16T12:52:34.356Z --- 2026-10-16T12:52:34.356Z duration_ms: 5363.454577 2026-10-16T12:52:34.356Z type: 'test' 2026-10-16T12:52:34.356Z ... 2026-10-16T12:52:34.853Z # Subtest: security: pushes are checked like git's fsck: no '..' or '.git' entries, no unsafe .gitmodules 2026-10-16T12:52:34.853Z ok 29 - security: pushes are checked like git's fsck: no '..' or '.git' entries, no unsafe .gitmodules 2026-10-16T12:52:34.853Z --- 2026-10-16T12:52:34.853Z duration_ms: 496.63373 2026-10-16T12:52:34.853Z type: 'test' 2026-10-16T12:52:34.853Z ... 2026-10-16T12:52:35.463Z # Subtest: security: a job's runner gets only the secrets the job names 2026-10-16T12:52:35.463Z ok 30 - security: a job's runner gets only the secrets the job names 2026-10-16T12:52:35.463Z --- 2026-10-16T12:52:35.463Z duration_ms: 610.027325 2026-10-16T12:52:35.463Z type: 'test' 2026-10-16T12:52:35.463Z ... 2026-10-16T12:52:35.916Z # Subtest: security: runs of agent code get no repository secrets unless an admin allows it 2026-10-16T12:52:35.917Z ok 31 - security: runs of agent code get no repository secrets unless an admin allows it 2026-10-16T12:52:35.917Z --- 2026-10-16T12:52:35.917Z duration_ms: 453.621721 2026-10-16T12:52:35.917Z type: 'test' 2026-10-16T12:52:35.917Z ... 2026-10-16T12:52:36.258Z # Subtest: security: adding someone by email always invites them, so the address doesn't reveal their username and they agree first 2026-10-16T12:52:36.258Z ok 32 - security: adding someone by email always invites them, so the address doesn't reveal their username and they agree first 2026-10-16T12:52:36.258Z --- 2026-10-16T12:52:36.258Z duration_ms: 340.521687 2026-10-16T12:52:36.258Z type: 'test' 2026-10-16T12:52:36.258Z ... 2026-10-16T12:52:37.753Z # Subtest: security: a job's log is capped, and oversized workflow files aren't parsed 2026-10-16T12:52:37.754Z ok 33 - security: a job's log is capped, and oversized workflow files aren't parsed 2026-10-16T12:52:37.754Z --- 2026-10-16T12:52:37.754Z duration_ms: 1496.441558 2026-10-16T12:52:37.754Z type: 'test' 2026-10-16T12:52:37.754Z ... 2026-10-16T12:52:38.251Z # Subtest: security: a workflow's token can't use another repository's private packages, and a repository's name is its own 2026-10-16T12:52:38.252Z ok 34 - security: a workflow's token can't use another repository's private packages, and a repository's name is its own 2026-10-16T12:52:38.252Z --- 2026-10-16T12:52:38.252Z duration_ms: 496.815032 2026-10-16T12:52:38.252Z type: 'test' 2026-10-16T12:52:38.252Z ... 2026-10-16T12:52:38.923Z # Subtest: security: OIDC tokens name the environment a job deployed to, and carry ids that survive a reused name 2026-10-16T12:52:38.923Z ok 35 - security: OIDC tokens name the environment a job deployed to, and carry ids that survive a reused name 2026-10-16T12:52:38.923Z --- 2026-10-16T12:52:38.923Z duration_ms: 672.508381 2026-10-16T12:52:38.923Z type: 'test' 2026-10-16T12:52:38.923Z ... 2026-10-16T12:52:39.245Z # Subtest: security: sensitive actions need a recent sign-in, sessions end 90 days after it, and one browser can be signed out 2026-10-16T12:52:39.245Z ok 36 - security: sensitive actions need a recent sign-in, sessions end 90 days after it, and one browser can be signed out 2026-10-16T12:52:39.245Z --- 2026-10-16T12:52:39.245Z duration_ms: 321.701414 2026-10-16T12:52:39.245Z type: 'test' 2026-10-16T12:52:39.245Z ... 2026-10-16T12:52:40.067Z # Subtest: security: self-hosted runners register with a one-hour token and claim jobs with their own 2026-10-16T12:52:40.067Z ok 37 - security: self-hosted runners register with a one-hour token and claim jobs with their own 2026-10-16T12:52:40.067Z --- 2026-10-16T12:52:40.067Z duration_ms: 822.786937 2026-10-16T12:52:40.067Z type: 'test' 2026-10-16T12:52:40.067Z ... 2026-10-16T12:52:41.068Z # Subtest: security: an organization secret reaches only the repositories it's shared with 2026-10-16T12:52:41.068Z ok 38 - security: an organization secret reaches only the repositories it's shared with 2026-10-16T12:52:41.068Z --- 2026-10-16T12:52:41.068Z duration_ms: 1000.216091 2026-10-16T12:52:41.068Z type: 'test' 2026-10-16T12:52:41.068Z ... 2026-10-16T12:52:41.651Z # Subtest: security: an admin can purge objects a force-push left unreachable 2026-10-16T12:52:41.651Z ok 39 - security: an admin can purge objects a force-push left unreachable 2026-10-16T12:52:41.651Z --- 2026-10-16T12:52:41.651Z duration_ms: 582.134742 2026-10-16T12:52:41.651Z type: 'test' 2026-10-16T12:52:41.651Z ... 2026-10-16T12:52:42.222Z # Subtest: security: webhooks reach only public hosts other than Diffinery, at most 20 per repository 2026-10-16T12:52:42.222Z ok 40 - security: webhooks reach only public hosts other than Diffinery, at most 20 per repository 2026-10-16T12:52:42.222Z --- 2026-10-16T12:52:42.222Z duration_ms: 571.444555 2026-10-16T12:52:42.222Z type: 'test' 2026-10-16T12:52:42.222Z ... 2026-10-16T12:52:43.573Z # Subtest: security: invitations and test emails have limits, so an account can't be used to send mail in bulk 2026-10-16T12:52:43.573Z ok 41 - security: invitations and test emails have limits, so an account can't be used to send mail in bulk 2026-10-16T12:52:43.573Z --- 2026-10-16T12:52:43.573Z duration_ms: 1350.823989 2026-10-16T12:52:43.573Z type: 'test' 2026-10-16T12:52:43.573Z ... 2026-10-16T12:52:43.793Z # Subtest: security: inputs that were taken on trust are checked (collaborators, check links, paging, MCP batches, reserved names) 2026-10-16T12:52:43.793Z ok 42 - security: inputs that were taken on trust are checked (collaborators, check links, paging, MCP batches, reserved names) 2026-10-16T12:52:43.793Z --- 2026-10-16T12:52:43.793Z duration_ms: 219.973731 2026-10-16T12:52:43.793Z type: 'test' 2026-10-16T12:52:43.793Z ... 2026-10-16T12:52:55.623Z # Subtest: security: environment reviewers hold a deploy job until a listed person approves, and nobody else can 2026-10-16T12:52:55.623Z ok 43 - security: environment reviewers hold a deploy job until a listed person approves, and nobody else can 2026-10-16T12:52:55.623Z --- 2026-10-16T12:52:55.623Z duration_ms: 11829.881702 2026-10-16T12:52:55.623Z type: 'test' 2026-10-16T12:52:55.623Z ... 2026-10-16T12:52:56.435Z # Subtest: security: adding someone by username sends an invitation, and they get access only once they accept 2026-10-16T12:52:56.435Z ok 44 - security: adding someone by username sends an invitation, and they get access only once they accept 2026-10-16T12:52:56.435Z --- 2026-10-16T12:52:56.435Z duration_ms: 810.892571 2026-10-16T12:52:56.435Z type: 'test' 2026-10-16T12:52:56.435Z ... 2026-10-16T12:53:59.393Z # Subtest: security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories 2026-10-16T12:53:59.393Z ok 45 - security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories 2026-10-16T12:53:59.393Z --- 2026-10-16T12:53:59.393Z duration_ms: 62954.837158 2026-10-16T12:53:59.393Z type: 'test' 2026-10-16T12:53:59.393Z ... 2026-10-16T12:54:02.813Z # Subtest: security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working 2026-10-16T12:54:02.813Z ok 46 - security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working 2026-10-16T12:54:02.813Z --- 2026-10-16T12:54:02.813Z duration_ms: 3415.440634 2026-10-16T12:54:02.813Z type: 'test' 2026-10-16T12:54:02.813Z ... 2026-10-16T12:54:21.846Z # Subtest: security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance 2026-10-16T12:54:21.846Z ok 47 - security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance 2026-10-16T12:54:21.846Z --- 2026-10-16T12:54:21.846Z duration_ms: 18984.840992 2026-10-16T12:54:21.846Z type: 'test' 2026-10-16T12:54:21.846Z ... 2026-10-16T12:54:40.676Z # Subtest: status page: anyone can read it, and everything is operational at first 2026-10-16T12:54:40.676Z ok 48 - status page: anyone can read it, and everything is operational at first 2026-10-16T12:54:40.676Z --- 2026-10-16T12:54:40.676Z duration_ms: 18625.712534 2026-10-16T12:54:40.676Z type: 'test' 2026-10-16T12:54:40.676Z ... 2026-10-16T12:54:40.768Z # Subtest: status page: only site administrators can manage incidents (404 for anyone else) 2026-10-16T12:54:40.768Z ok 49 - status page: only site administrators can manage incidents (404 for anyone else) 2026-10-16T12:54:40.768Z --- 2026-10-16T12:54:40.768Z duration_ms: 92.40727 2026-10-16T12:54:40.768Z type: 'test' 2026-10-16T12:54:40.768Z ... 2026-10-16T12:54:40.859Z # Subtest: status page: a site administrator opens an incident through the API, and the page shows it 2026-10-16T12:54:40.859Z ok 50 - status page: a site administrator opens an incident through the API, and the page shows it 2026-10-16T12:54:40.859Z --- 2026-10-16T12:54:40.859Z duration_ms: 91.437425 2026-10-16T12:54:40.859Z type: 'test' 2026-10-16T12:54:40.859Z ... 2026-10-16T12:54:41.073Z # Subtest: status page: the web form opens an incident with several components and posts updates 2026-10-16T12:54:41.073Z ok 51 - status page: the web form opens an incident with several components and posts updates 2026-10-16T12:54:41.073Z --- 2026-10-16T12:54:41.073Z duration_ms: 214.777932 2026-10-16T12:54:41.073Z type: 'test' 2026-10-16T12:54:41.073Z ... 2026-10-16T12:54:41.122Z # Subtest: status page: resolving through the API returns the component to operational and moves the incident to past incidents 2026-10-16T12:54:41.122Z ok 52 - status page: resolving through the API returns the component to operational and moves the incident to past incidents 2026-10-16T12:54:41.122Z --- 2026-10-16T12:54:41.122Z duration_ms: 49.853329 2026-10-16T12:54:41.122Z type: 'test' 2026-10-16T12:54:41.122Z ... 2026-10-16T12:54:41.140Z # Subtest: status page: changes are audited without the updates' text 2026-10-16T12:54:41.140Z ok 53 - status page: changes are audited without the updates' text 2026-10-16T12:54:41.140Z --- 2026-10-16T12:54:41.140Z duration_ms: 17.41249 2026-10-16T12:54:41.140Z type: 'test' 2026-10-16T12:54:41.140Z ... 2026-10-16T12:54:41.222Z # Subtest: status page: pausing hosted compute shows Actions and agent sandboxes under maintenance 2026-10-16T12:54:41.222Z ok 54 - status page: pausing hosted compute shows Actions and agent sandboxes under maintenance 2026-10-16T12:54:41.222Z --- 2026-10-16T12:54:41.222Z duration_ms: 67.119569 2026-10-16T12:54:41.222Z type: 'test' 2026-10-16T12:54:41.222Z ... 2026-10-16T12:54:41.277Z 1..54 2026-10-16T12:54:41.277Z # tests 54 2026-10-16T12:54:41.277Z # suites 0 2026-10-16T12:54:41.277Z # pass 54 2026-10-16T12:54:41.277Z # fail 0 2026-10-16T12:54:41.277Z # cancelled 0 2026-10-16T12:54:41.277Z # skipped 0 2026-10-16T12:54:41.277Z # todo 0 2026-10-16T12:54:41.277Z # duration_ms 224735.064575 2026-10-16T12:54:41.516Z Cache hit occurred on the primary key node-cache-Linux-x64-pnpm-4b94436b86798d88b931ea24b5b847697aebf45520d6ef384cb382ce6c1f1e08, not saving cache. 2026-10-16T12:54:41.808Z Pruning is unnecessary. 2026-10-16T12:54:41.935Z Removing persisted credentials 2026-10-16T12:54:42.000Z Job completed with conclusion: success