2026-10-16T13:45:25.629Z Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@c36fd664f9bc 2026-10-16T13:45:25.658Z Runner: image diffinery-runner:2a3052eff7a82a483a7fde51, in cdg15, WEUR, container 7eceafb098fb7f892f104033a91a609e95f1244bbdd3658d369fc652ba43cb88 2026-10-16T13:45:25.658Z Workspace: /workspace/diffinery 2026-10-16T13:45:25.713Z ##[group]Run actions/checkout@v4 2026-10-16T13:45:25.713Z ##[endgroup] 2026-10-16T13:45:25.715Z Syncing repository: codician/diffinery 2026-10-16T13:45:25.841Z Fetching the repository (depth 1) 2026-10-16T13:45:26.493Z remote: Enumerating objects: 605, done. 2026-10-16T13:45:26.663Z Receiving objects: 0% (1/605) Receiving objects: 1% (7/605) Receiving objects: 2% (13/605) Receiving objects: 3% (19/605) Receiving objects: 4% (25/605) Receiving objects: 5% (31/605) Receiving objects: 6% (37/605) Receiving objects: 7% (43/605) Receiving objects: 8% (49/605) Receiving objects: 9% (55/605) Receiving objects: 10% (61/605) Receiving objects: 11% (67/605) Receiving objects: 12% (73/605) Receiving objects: 13% (79/605) Receiving objects: 14% (85/605) Receiving objects: 15% (91/605) Receiving objects: 16% (97/605) Receiving objects: 17% (103/605) Receiving objects: 18% (109/605) Receiving objects: 19% (115/605) Receiving objects: 20% (121/605) Receiving objects: 21% (128/605) Receiving objects: 22% (134/605) Receiving objects: 23% (140/605) Receiving objects: 24% (146/605) Receiving objects: 25% (152/605) Receiving objects: 26% (158/605) Receiving objects: 27% (164/605) Receiving objects: 28% (170/605) Receiving objects: 29% (176/605) Receiving objects: 30% (182/605) Receiving objects: 31% (188/605) Receiving objects: 32% (194/605) Receiving objects: 33% (200/605) Receiving objects: 34% (206/605) Receiving objects: 35% (212/605) Receiving objects: 36% (218/605) Receiving objects: 37% (224/605) Receiving objects: 38% (230/605) Receiving objects: 39% (236/605) Receiving objects: 40% (242/605) Receiving objects: 41% (249/605) Receiving objects: 42% (255/605) Receiving objects: 43% (261/605) Receiving objects: 44% (267/605) Receiving objects: 45% (273/605) Receiving objects: 46% (279/605) Receiving objects: 47% (285/605) Receiving objects: 48% (291/605) Receiving objects: 49% (297/605) Receiving objects: 50% (303/605) Receiving objects: 51% (309/605) Receiving objects: 52% (315/605) Receiving objects: 53% (321/605) Receiving objects: 54% (327/605) Receiving objects: 55% (333/605) Receiving objects: 56% (339/605) Receiving objects: 57% (345/605) Receiving objects: 58% (351/605) Receiving objects: 59% (357/605) Receiving objects: 60% (363/605) Receiving objects: 61% (370/605) Receiving objects: 62% (376/605) Receiving objects: 63% (382/605) Receiving objects: 64% (388/605) Receiving objects: 65% (394/605) Receiving objects: 66% (400/605) Receiving objects: 67% (406/605) Receiving objects: 68% (412/605) Receiving objects: 69% (418/605) Receiving objects: 70% (424/605) Receiving objects: 71% (430/605) Receiving objects: 72% (436/605) Receiving objects: 73% (442/605) Receiving objects: 74% (448/605) Receiving objects: 75% (454/605) Receiving objects: 76% (460/605) Receiving objects: 77% (466/605) Receiving objects: 78% (472/605) Receiving objects: 79% (478/605) Receiving objects: 80% (484/605) Receiving objects: 81% (491/605) Receiving objects: 82% (497/605) Receiving objects: 83% (503/605) Receiving objects: 84% (509/605) Receiving objects: 85% (515/605) Receiving objects: 86% (521/605) Receiving objects: 87% (527/605) Receiving objects: 88% (533/605) Receiving objects: 89% (539/605) Receiving objects: 90% (545/605) Receiving objects: 91% (551/605) Receiving objects: 92% (557/605) Receiving objects: 93% (563/605) Receiving objects: 94% (569/605) Receiving objects: 95% (575/605) Receiving objects: 96% (581/605) remote: Total 605 (delta 0), reused 605 (delta 0) 2026-10-16T13:45:26.664Z Receiving objects: 97% (587/605) Receiving objects: 98% (593/605) Receiving objects: 99% (599/605) Receiving objects: 100% (605/605) Receiving objects: 100% (605/605), 2.45 MiB | 15.48 MiB/s, done. 2026-10-16T13:45:26.690Z From https://diffinery.com/codician/diffinery 2026-10-16T13:45:26.690Z * [new ref] c36fd664f9bca9bdb483ca18de1056c612405f26 -> origin/diffinery-checkout 2026-10-16T13:45:26.807Z Note: switching to 'c36fd664f9bca9bdb483ca18de1056c612405f26'. 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.807Z You are in 'detached HEAD' state. You can look around, make experimental 2026-10-16T13:45:26.807Z changes and commit them, and you can discard any commits you make in this 2026-10-16T13:45:26.807Z state without impacting any branches by switching back to a branch. 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.807Z If you want to create a new branch to retain commits you create, you may 2026-10-16T13:45:26.807Z do so (now or later) by using -c with the switch command. Example: 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.807Z git switch -c 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.807Z Or undo this operation with: 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.807Z git switch - 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.807Z Turn off this advice by setting config variable advice.detachedHead to false 2026-10-16T13:45:26.807Z 2026-10-16T13:45:26.808Z HEAD is now at c36fd66 Merge ea4d704d1bf17fbf23805ce18882c4f06754c400 into 12fae42e55e68d8094e8db51c7ace084fd225d2a 2026-10-16T13:45:26.814Z HEAD is now at c36fd664f9bca9bdb483ca18de1056c612405f26 2026-10-16T13:45:26.989Z Download action repository 'pnpm/action-setup@v4' 2026-10-16T13:45:27.447Z ##[group]Run pnpm/action-setup@v4 2026-10-16T13:45:27.447Z with: 2026-10-16T13:45:27.447Z dest: ~/setup-pnpm 2026-10-16T13:45:27.447Z run_install: null 2026-10-16T13:45:27.447Z cache: false 2026-10-16T13:45:27.447Z cache_dependency_path: pnpm-lock.yaml 2026-10-16T13:45:27.447Z package_json_file: package.json 2026-10-16T13:45:27.447Z standalone: false 2026-10-16T13:45:27.447Z ##[endgroup] 2026-10-16T13:45:27.657Z ##[group]Running self-installer... 2026-10-16T13:45:28.439Z Progress: resolved 1, reused 0, downloaded 0, added 0 2026-10-16T13:45:28.450Z Packages: +1 2026-10-16T13:45:28.450Z + 2026-10-16T13:45:29.100Z Progress: resolved 1, reused 0, downloaded 1, added 1, done 2026-10-16T13:45:29.148Z 2026-10-16T13:45:29.148Z dependencies: 2026-10-16T13:45:29.148Z + pnpm 10.28.0 (12.14.0 is available) 2026-10-16T13:45:29.148Z 2026-10-16T13:45:29.152Z Done in 1.2s 2026-10-16T13:45:29.184Z ##[endgroup] 2026-10-16T13:45:29.184Z Installation Completed! 2026-10-16T13:45:29.307Z ##[group]Run actions/setup-node@v4 2026-10-16T13:45:29.307Z with: 2026-10-16T13:45:29.307Z node-version: 22 2026-10-16T13:45:29.307Z cache: pnpm 2026-10-16T13:45:29.307Z ##[endgroup] 2026-10-16T13:45:29.317Z Found in cache @ 22.22.0 (pre-installed node satisfies '22') 2026-10-16T13:45:33.107Z Cache Size: ~215 MB (225870423 B) 2026-10-16T13:45:36.980Z Cache restored from key: node-cache-Linux-x64-pnpm-4b94436b86798d88b931ea24b5b847697aebf45520d6ef384cb382ce6c1f1e08 2026-10-16T13:45:37.104Z ##[group]Run pnpm install --frozen-lockfile 2026-10-16T13:45:37.104Z ##[endgroup] 2026-10-16T13:45:37.486Z Scope: all 7 workspace projects 2026-10-16T13:45:37.537Z Lockfile is up to date, resolution step is skipped 2026-10-16T13:45:37.595Z Progress: resolved 1, reused 0, downloaded 0, added 0 2026-10-16T13:45:37.632Z Packages: +248 2026-10-16T13:45:37.632Z ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2026-10-16T13:45:38.597Z Progress: resolved 248, reused 242, downloaded 0, added 247 2026-10-16T13:45:38.710Z Progress: resolved 248, reused 242, downloaded 0, added 248, done 2026-10-16T13:45:50.570Z 2026-10-16T13:45:50.570Z devDependencies: 2026-10-16T13:45:50.570Z + turbo 2.11.7 2026-10-16T13:45:50.570Z + typescript 5.9.3 2026-10-16T13:45:50.570Z 2026-10-16T13:45:50.970Z Done in 13.8s using pnpm v10.28.0 2026-10-16T13:45:51.174Z ##[group]Run pnpm -r --if-present build 2026-10-16T13:45:51.174Z ##[endgroup] 2026-10-16T13:45:51.674Z Scope: 6 of 7 workspace projects 2026-10-16T13:45:51.678Z apps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env node 2026-10-16T13:45:51.678Z import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);" 2026-10-16T13:45:51.679Z apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjs 2026-10-16T13:45:51.679Z containers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);" 2026-10-16T13:45:51.800Z apps/cli build: dist/diffinery.mjs 439.5kb 2026-10-16T13:45:51.807Z apps/cli build: ⚡ Done in 91ms 2026-10-16T13:45:51.817Z apps/cli build: Done 2026-10-16T13:45:51.848Z containers/runner build: dist/agent.mjs 657.3kb 2026-10-16T13:45:51.850Z containers/runner build: ⚡ Done in 117ms 2026-10-16T13:45:51.857Z containers/runner build: Done 2026-10-16T13:45:53.093Z apps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KB 2026-10-16T13:45:53.505Z apps/diffinery build: docs: 62 pages (+2 generated at runtime), CLI 0.1.0 (230 KiB) 2026-10-16T13:45:53.517Z apps/diffinery build: Done 2026-10-16T13:45:53.701Z ##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another. 2026-10-16T13:45:53.701Z core='/e2e\.test\.mjs$' 2026-10-16T13:45:53.701Z agents='/(agentic|review|tasks)\.test\.mjs$' 2026-10-16T13:45:53.701Z security='/(security|status)\.test\.mjs$' 2026-10-16T13:45:53.701Z # The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on 2026-10-16T13:45:53.701Z # Diffinery's runners): two shards of their own, so no part of the file runs into node's 2026-10-16T13:45:53.701Z # per-file timeout, which is the --test-timeout here. 2026-10-16T13:45:53.701Z histories='^real histories:' 2026-10-16T13:45:53.701Z large='^(large files|large pushes):' 2026-10-16T13:45:53.701Z opts=(--test-timeout=600000) 2026-10-16T13:45:53.701Z case "security" in 2026-10-16T13:45:53.701Z core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;; 2026-10-16T13:45:53.701Z histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;; 2026-10-16T13:45:53.701Z large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;; 2026-10-16T13:45:53.701Z agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;; 2026-10-16T13:45:53.701Z security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;; 2026-10-16T13:45:53.701Z *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;; 2026-10-16T13:45:53.701Z esac 2026-10-16T13:45:53.701Z echo "$files" 2026-10-16T13:45:53.701Z node --test --test-concurrency=1 "${opts[@]}" $files 2026-10-16T13:45:53.701Z ##[endgroup] 2026-10-16T13:45:55.196Z test/e2e/security.test.mjs 2026-10-16T13:45:55.196Z test/e2e/status.test.mjs 2026-10-16T13:45:55.250Z TAP version 13 2026-10-16T13:46:30.749Z # Subtest: security: search, required checks, environments, reviews, locks, archives, drafts and tree names 2026-10-16T13:46:30.751Z ok 1 - security: search, required checks, environments, reviews, locks, archives, drafts and tree names 2026-10-16T13:46:30.751Z --- 2026-10-16T13:46:30.751Z duration_ms: 35423.150493 2026-10-16T13:46:30.751Z type: 'test' 2026-10-16T13:46:30.751Z ... 2026-10-16T13:46:30.884Z # Subtest: security: organization admins can't hand out ownership 2026-10-16T13:46:30.884Z ok 2 - security: organization admins can't hand out ownership 2026-10-16T13:46:30.884Z --- 2026-10-16T13:46:30.884Z duration_ms: 134.243125 2026-10-16T13:46:30.884Z type: 'test' 2026-10-16T13:46:30.884Z ... 2026-10-16T13:46:32.477Z # Subtest: security: anonymous writes, token scopes, agent secrets, merge rules and drafts 2026-10-16T13:46:32.477Z ok 3 - security: anonymous writes, token scopes, agent secrets, merge rules and drafts 2026-10-16T13:46:32.477Z --- 2026-10-16T13:46:32.477Z duration_ms: 1588.800574 2026-10-16T13:46:32.477Z type: 'test' 2026-10-16T13:46:32.477Z ... 2026-10-16T13:46:33.407Z # Subtest: security: push protection covers commits made without git 2026-10-16T13:46:33.408Z ok 4 - security: push protection covers commits made without git 2026-10-16T13:46:33.408Z --- 2026-10-16T13:46:33.408Z duration_ms: 934.603517 2026-10-16T13:46:33.408Z type: 'test' 2026-10-16T13:46:33.408Z ... 2026-10-16T13:46:51.090Z # Subtest: security: limited tokens, invisible repositories, readers' labels and the audit trail 2026-10-16T13:46:51.090Z ok 5 - security: limited tokens, invisible repositories, readers' labels and the audit trail 2026-10-16T13:46:51.090Z --- 2026-10-16T13:46:51.090Z duration_ms: 17683.601342 2026-10-16T13:46:51.090Z type: 'test' 2026-10-16T13:46:51.090Z ... 2026-10-16T13:46:51.191Z # Subtest: security: organization pictures are the owners' to change, and invitations aren't sent twice 2026-10-16T13:46:51.192Z ok 6 - security: organization pictures are the owners' to change, and invitations aren't sent twice 2026-10-16T13:46:51.192Z --- 2026-10-16T13:46:51.192Z duration_ms: 97.736803 2026-10-16T13:46:51.192Z type: 'test' 2026-10-16T13:46:51.192Z ... 2026-10-16T13:46:51.611Z # Subtest: security: organization members get the base permission, which only owners change 2026-10-16T13:46:51.611Z ok 7 - security: organization members get the base permission, which only owners change 2026-10-16T13:46:51.611Z --- 2026-10-16T13:46:51.611Z duration_ms: 421.99605 2026-10-16T13:46:51.611Z type: 'test' 2026-10-16T13:46:51.611Z ... 2026-10-16T13:46:52.170Z # Subtest: security: leaving an organization takes its repository access along 2026-10-16T13:46:52.171Z ok 8 - security: leaving an organization takes its repository access along 2026-10-16T13:46:52.171Z --- 2026-10-16T13:46:52.171Z duration_ms: 558.551376 2026-10-16T13:46:52.171Z type: 'test' 2026-10-16T13:46:52.171Z ... 2026-10-16T13:46:56.807Z # Subtest: security: organization settings are checked before anything is saved, and agents see the base permission 2026-10-16T13:46:56.808Z ok 9 - security: organization settings are checked before anything is saved, and agents see the base permission 2026-10-16T13:46:56.808Z --- 2026-10-16T13:46:56.808Z duration_ms: 4632.271258 2026-10-16T13:46:56.808Z type: 'test' 2026-10-16T13:46:56.808Z ... 2026-10-16T13:47:04.645Z # Subtest: security: a transferred repository keeps its data, and its old name redirects only for readers 2026-10-16T13:47:04.645Z ok 10 - security: a transferred repository keeps its data, and its old name redirects only for readers 2026-10-16T13:47:04.645Z --- 2026-10-16T13:47:04.645Z duration_ms: 7841.838794 2026-10-16T13:47:04.645Z type: 'test' 2026-10-16T13:47:04.645Z ... 2026-10-16T13:47:21.415Z # Subtest: security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI 2026-10-16T13:47:21.415Z ok 11 - security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI 2026-10-16T13:47:21.415Z --- 2026-10-16T13:47:21.415Z duration_ms: 16766.21573 2026-10-16T13:47:21.415Z type: 'test' 2026-10-16T13:47:21.415Z ... 2026-10-16T13:47:33.119Z # Subtest: security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more 2026-10-16T13:47:33.119Z ok 12 - security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more 2026-10-16T13:47:33.119Z --- 2026-10-16T13:47:33.119Z duration_ms: 11708.513969 2026-10-16T13:47:33.119Z type: 'test' 2026-10-16T13:47:33.119Z ... 2026-10-16T13:47:33.986Z # Subtest: security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue 2026-10-16T13:47:33.986Z ok 13 - security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue 2026-10-16T13:47:33.986Z --- 2026-10-16T13:47:33.986Z duration_ms: 867.21315 2026-10-16T13:47:33.986Z type: 'test' 2026-10-16T13:47:33.986Z ... 2026-10-16T13:47:35.572Z # Subtest: security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one 2026-10-16T13:47:35.572Z ok 14 - security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one 2026-10-16T13:47:35.572Z --- 2026-10-16T13:47:35.572Z duration_ms: 1584.455131 2026-10-16T13:47:35.572Z type: 'test' 2026-10-16T13:47:35.572Z ... 2026-10-16T13:47:36.523Z # Subtest: security: agents see what auto-merge needs next to the refusal to merge directly 2026-10-16T13:47:36.523Z ok 15 - security: agents see what auto-merge needs next to the refusal to merge directly 2026-10-16T13:47:36.523Z --- 2026-10-16T13:47:36.523Z duration_ms: 952.474212 2026-10-16T13:47:36.523Z type: 'test' 2026-10-16T13:47:36.523Z ... 2026-10-16T13:47:39.810Z # Subtest: security: the queue's bypass button does what it says, and a merge queue can't contradict linear history 2026-10-16T13:47:39.810Z ok 16 - security: the queue's bypass button does what it says, and a merge queue can't contradict linear history 2026-10-16T13:47:39.810Z --- 2026-10-16T13:47:39.810Z duration_ms: 3286.923782 2026-10-16T13:47:39.810Z type: 'test' 2026-10-16T13:47:39.810Z ... 2026-10-16T13:47:40.171Z # Subtest: security: no token can mint a token, an agent or a sandbox, through the API or the web forms 2026-10-16T13:47:40.171Z ok 17 - security: no token can mint a token, an agent or a sandbox, through the API or the web forms 2026-10-16T13:47:40.171Z --- 2026-10-16T13:47:40.171Z duration_ms: 361.229538 2026-10-16T13:47:40.171Z type: 'test' 2026-10-16T13:47:40.171Z ... 2026-10-16T13:47:46.942Z # Subtest: security: repository variable endpoints see only the repository's own, and organization variable deletes are checked 2026-10-16T13:47:46.942Z ok 18 - security: repository variable endpoints see only the repository's own, and organization variable deletes are checked 2026-10-16T13:47:46.942Z --- 2026-10-16T13:47:46.942Z duration_ms: 6769.66213 2026-10-16T13:47:46.942Z type: 'test' 2026-10-16T13:47:46.942Z ... 2026-10-16T13:47:47.266Z # Subtest: security: milestones are checked before an issue is saved, and lists filter by them 2026-10-16T13:47:47.266Z ok 19 - security: milestones are checked before an issue is saved, and lists filter by them 2026-10-16T13:47:47.266Z --- 2026-10-16T13:47:47.266Z duration_ms: 324.551336 2026-10-16T13:47:47.266Z type: 'test' 2026-10-16T13:47:47.266Z ... 2026-10-16T13:47:50.338Z # Subtest: security: push protection reads large files, and revoking a token through the API is on the record 2026-10-16T13:47:50.338Z ok 20 - security: push protection reads large files, and revoking a token through the API is on the record 2026-10-16T13:47:50.338Z --- 2026-10-16T13:47:50.338Z duration_ms: 3071.477097 2026-10-16T13:47:50.338Z type: 'test' 2026-10-16T13:47:50.338Z ... 2026-10-16T13:47:51.139Z # Subtest: security: git request bodies are bounded, compressed or not, before anything reads them 2026-10-16T13:47:51.139Z ok 21 - security: git request bodies are bounded, compressed or not, before anything reads them 2026-10-16T13:47:51.139Z --- 2026-10-16T13:47:51.139Z duration_ms: 799.428741 2026-10-16T13:47:51.139Z type: 'test' 2026-10-16T13:47:51.139Z ... 2026-10-16T13:47:51.677Z # Subtest: security: a file rewritten from scratch is diffed quickly, even for anonymous readers 2026-10-16T13:47:51.677Z ok 22 - security: a file rewritten from scratch is diffed quickly, even for anonymous readers 2026-10-16T13:47:51.677Z --- 2026-10-16T13:47:51.677Z duration_ms: 538.746749 2026-10-16T13:47:51.677Z type: 'test' 2026-10-16T13:47:51.677Z ... 2026-10-16T13:47:51.913Z # Subtest: security: signed out, a private repository and a missing one look the same everywhere 2026-10-16T13:47:51.913Z ok 23 - security: signed out, a private repository and a missing one look the same everywhere 2026-10-16T13:47:51.913Z --- 2026-10-16T13:47:51.913Z duration_ms: 236.656231 2026-10-16T13:47:51.913Z type: 'test' 2026-10-16T13:47:51.913Z ... 2026-10-16T13:47:52.571Z # Subtest: security: live updates say only that something changed, and never carry audit entries or payloads 2026-10-16T13:47:52.571Z ok 24 - security: live updates say only that something changed, and never carry audit entries or payloads 2026-10-16T13:47:52.571Z --- 2026-10-16T13:47:52.571Z duration_ms: 657.544221 2026-10-16T13:47:52.571Z type: 'test' 2026-10-16T13:47:52.571Z ... 2026-10-16T13:47:55.116Z # Subtest: security: push protection reads commit and tag messages, UTF-16 files and Diffinery's own tokens, and records opt-outs 2026-10-16T13:47:55.116Z ok 25 - security: push protection reads commit and tag messages, UTF-16 files and Diffinery's own tokens, and records opt-outs 2026-10-16T13:47:55.116Z --- 2026-10-16T13:47:55.116Z duration_ms: 2543.929168 2026-10-16T13:47:55.116Z type: 'test' 2026-10-16T13:47:55.116Z ... 2026-10-16T13:47:55.538Z # Subtest: security: required checks gate direct pushes to a protected branch, as on GitHub 2026-10-16T13:47:55.538Z ok 26 - security: required checks gate direct pushes to a protected branch, as on GitHub 2026-10-16T13:47:55.538Z --- 2026-10-16T13:47:55.538Z duration_ms: 423.41677 2026-10-16T13:47:55.538Z type: 'test' 2026-10-16T13:47:55.538Z ... 2026-10-16T13:47:55.788Z # Subtest: security: issue, pull request and comment text has GitHub's length limits 2026-10-16T13:47:55.788Z ok 27 - security: issue, pull request and comment text has GitHub's length limits 2026-10-16T13:47:55.788Z --- 2026-10-16T13:47:55.788Z duration_ms: 246.715991 2026-10-16T13:47:55.788Z type: 'test' 2026-10-16T13:47:55.788Z ... 2026-10-16T13:48:03.189Z # Subtest: security: deleting a repository deletes its stored objects too 2026-10-16T13:48:03.189Z ok 28 - security: deleting a repository deletes its stored objects too 2026-10-16T13:48:03.189Z --- 2026-10-16T13:48:03.189Z duration_ms: 7401.710169 2026-10-16T13:48:03.189Z type: 'test' 2026-10-16T13:48:03.189Z ... 2026-10-16T13:48:03.948Z # Subtest: security: pushes are checked like git's fsck: no '..' or '.git' entries, no unsafe .gitmodules 2026-10-16T13:48:03.948Z ok 29 - security: pushes are checked like git's fsck: no '..' or '.git' entries, no unsafe .gitmodules 2026-10-16T13:48:03.948Z --- 2026-10-16T13:48:03.948Z duration_ms: 760.189288 2026-10-16T13:48:03.948Z type: 'test' 2026-10-16T13:48:03.948Z ... 2026-10-16T13:48:04.655Z # Subtest: security: a job's runner gets only the secrets the job names 2026-10-16T13:48:04.655Z ok 30 - security: a job's runner gets only the secrets the job names 2026-10-16T13:48:04.655Z --- 2026-10-16T13:48:04.655Z duration_ms: 707.092402 2026-10-16T13:48:04.655Z type: 'test' 2026-10-16T13:48:04.655Z ... 2026-10-16T13:48:05.171Z # Subtest: security: runs of agent code get no repository secrets unless an admin allows it 2026-10-16T13:48:05.171Z ok 31 - security: runs of agent code get no repository secrets unless an admin allows it 2026-10-16T13:48:05.171Z --- 2026-10-16T13:48:05.171Z duration_ms: 515.7574 2026-10-16T13:48:05.171Z type: 'test' 2026-10-16T13:48:05.171Z ... 2026-10-16T13:48:05.592Z # Subtest: security: adding someone by email always invites them, so the address doesn't reveal their username and they agree first 2026-10-16T13:48:05.593Z ok 32 - security: adding someone by email always invites them, so the address doesn't reveal their username and they agree first 2026-10-16T13:48:05.593Z --- 2026-10-16T13:48:05.593Z duration_ms: 422.6795 2026-10-16T13:48:05.593Z type: 'test' 2026-10-16T13:48:05.593Z ... 2026-10-16T13:48:07.569Z # Subtest: security: a job's log is capped, and oversized workflow files aren't parsed 2026-10-16T13:48:07.569Z ok 33 - security: a job's log is capped, and oversized workflow files aren't parsed 2026-10-16T13:48:07.569Z --- 2026-10-16T13:48:07.569Z duration_ms: 1976.094695 2026-10-16T13:48:07.569Z type: 'test' 2026-10-16T13:48:07.569Z ... 2026-10-16T13:48:08.159Z # Subtest: security: a workflow's token can't use another repository's private packages, and a repository's name is its own 2026-10-16T13:48:08.159Z ok 34 - security: a workflow's token can't use another repository's private packages, and a repository's name is its own 2026-10-16T13:48:08.159Z --- 2026-10-16T13:48:08.159Z duration_ms: 590.517843 2026-10-16T13:48:08.159Z type: 'test' 2026-10-16T13:48:08.159Z ... 2026-10-16T13:48:09.057Z # Subtest: security: OIDC tokens name the environment a job deployed to, and carry ids that survive a reused name 2026-10-16T13:48:09.057Z ok 35 - security: OIDC tokens name the environment a job deployed to, and carry ids that survive a reused name 2026-10-16T13:48:09.057Z --- 2026-10-16T13:48:09.057Z duration_ms: 897.090785 2026-10-16T13:48:09.057Z type: 'test' 2026-10-16T13:48:09.057Z ... 2026-10-16T13:48:09.551Z # Subtest: security: sensitive actions need a recent sign-in, sessions end 90 days after it, and one browser can be signed out 2026-10-16T13:48:09.551Z ok 36 - security: sensitive actions need a recent sign-in, sessions end 90 days after it, and one browser can be signed out 2026-10-16T13:48:09.551Z --- 2026-10-16T13:48:09.551Z duration_ms: 493.44838 2026-10-16T13:48:09.551Z type: 'test' 2026-10-16T13:48:09.551Z ... 2026-10-16T13:48:10.751Z # Subtest: security: self-hosted runners register with a one-hour token and claim jobs with their own 2026-10-16T13:48:10.751Z ok 37 - security: self-hosted runners register with a one-hour token and claim jobs with their own 2026-10-16T13:48:10.751Z --- 2026-10-16T13:48:10.751Z duration_ms: 1200.840513 2026-10-16T13:48:10.751Z type: 'test' 2026-10-16T13:48:10.751Z ... 2026-10-16T13:48:12.646Z # Subtest: security: an organization secret reaches only the repositories it's shared with 2026-10-16T13:48:12.647Z ok 38 - security: an organization secret reaches only the repositories it's shared with 2026-10-16T13:48:12.647Z --- 2026-10-16T13:48:12.647Z duration_ms: 1894.444875 2026-10-16T13:48:12.647Z type: 'test' 2026-10-16T13:48:12.647Z ... 2026-10-16T13:48:14.119Z # Subtest: security: an admin can purge objects a force-push left unreachable 2026-10-16T13:48:14.119Z ok 39 - security: an admin can purge objects a force-push left unreachable 2026-10-16T13:48:14.119Z --- 2026-10-16T13:48:14.119Z duration_ms: 1471.871045 2026-10-16T13:48:14.119Z type: 'test' 2026-10-16T13:48:14.119Z ... 2026-10-16T13:48:15.010Z # Subtest: security: webhooks reach only public hosts other than Diffinery, at most 20 per repository 2026-10-16T13:48:15.010Z ok 40 - security: webhooks reach only public hosts other than Diffinery, at most 20 per repository 2026-10-16T13:48:15.010Z --- 2026-10-16T13:48:15.010Z duration_ms: 891.097769 2026-10-16T13:48:15.010Z type: 'test' 2026-10-16T13:48:15.010Z ... 2026-10-16T13:48:17.264Z # Subtest: security: invitations and test emails have limits, so an account can't be used to send mail in bulk 2026-10-16T13:48:17.264Z ok 41 - security: invitations and test emails have limits, so an account can't be used to send mail in bulk 2026-10-16T13:48:17.264Z --- 2026-10-16T13:48:17.264Z duration_ms: 2254.538192 2026-10-16T13:48:17.264Z type: 'test' 2026-10-16T13:48:17.264Z ... 2026-10-16T13:48:17.787Z # Subtest: security: inputs that were taken on trust are checked (collaborators, check links, paging, MCP batches, reserved names) 2026-10-16T13:48:17.787Z ok 42 - security: inputs that were taken on trust are checked (collaborators, check links, paging, MCP batches, reserved names) 2026-10-16T13:48:17.787Z --- 2026-10-16T13:48:17.788Z duration_ms: 518.767382 2026-10-16T13:48:17.788Z type: 'test' 2026-10-16T13:48:17.788Z ... 2026-10-16T13:48:31.450Z # Subtest: security: environment reviewers hold a deploy job until a listed person approves, and nobody else can 2026-10-16T13:48:31.450Z ok 43 - security: environment reviewers hold a deploy job until a listed person approves, and nobody else can 2026-10-16T13:48:31.450Z --- 2026-10-16T13:48:31.450Z duration_ms: 13666.525799 2026-10-16T13:48:31.450Z type: 'test' 2026-10-16T13:48:31.450Z ... 2026-10-16T13:48:32.871Z # Subtest: security: adding someone by username sends an invitation, and they get access only once they accept 2026-10-16T13:48:32.871Z ok 44 - security: adding someone by username sends an invitation, and they get access only once they accept 2026-10-16T13:48:32.871Z --- 2026-10-16T13:48:32.871Z duration_ms: 1421.242342 2026-10-16T13:48:32.871Z type: 'test' 2026-10-16T13:48:32.871Z ... 2026-10-16T13:49:36.237Z # Subtest: security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories 2026-10-16T13:49:36.237Z ok 45 - security: per-account quotas on hosted minutes, hosted jobs at once, sandboxes and repositories 2026-10-16T13:49:36.237Z --- 2026-10-16T13:49:36.237Z duration_ms: 63362.816016 2026-10-16T13:49:36.237Z type: 'test' 2026-10-16T13:49:36.237Z ... 2026-10-16T13:49:40.185Z # Subtest: security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working 2026-10-16T13:49:40.186Z ok 46 - security: a per-account storage quota refuses pushes, Git LFS and release asset uploads past it; reads and deletes keep working 2026-10-16T13:49:40.186Z --- 2026-10-16T13:49:40.186Z duration_ms: 3949.646816 2026-10-16T13:49:40.186Z type: 'test' 2026-10-16T13:49:40.186Z ... 2026-10-16T13:50:02.013Z # Subtest: security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance 2026-10-16T13:50:02.013Z ok 47 - security: kill switches suspend Actions for a repository or an account, and pause hosted compute on the instance 2026-10-16T13:50:02.013Z --- 2026-10-16T13:50:02.013Z duration_ms: 21739.81166 2026-10-16T13:50:02.013Z type: 'test' 2026-10-16T13:50:02.013Z ... 2026-10-16T13:50:26.051Z # Subtest: status page: anyone can read it, and everything is operational at first 2026-10-16T13:50:26.051Z ok 48 - status page: anyone can read it, and everything is operational at first 2026-10-16T13:50:26.051Z --- 2026-10-16T13:50:26.051Z duration_ms: 23848.249057 2026-10-16T13:50:26.051Z type: 'test' 2026-10-16T13:50:26.051Z ... 2026-10-16T13:50:26.212Z # Subtest: status page: only site administrators can manage incidents (404 for anyone else) 2026-10-16T13:50:26.212Z ok 49 - status page: only site administrators can manage incidents (404 for anyone else) 2026-10-16T13:50:26.212Z --- 2026-10-16T13:50:26.212Z duration_ms: 161.003107 2026-10-16T13:50:26.212Z type: 'test' 2026-10-16T13:50:26.212Z ... 2026-10-16T13:50:26.331Z # Subtest: status page: a site administrator opens an incident through the API, and the page shows it 2026-10-16T13:50:26.331Z ok 50 - status page: a site administrator opens an incident through the API, and the page shows it 2026-10-16T13:50:26.331Z --- 2026-10-16T13:50:26.331Z duration_ms: 117.07914 2026-10-16T13:50:26.331Z type: 'test' 2026-10-16T13:50:26.331Z ... 2026-10-16T13:50:26.762Z # Subtest: status page: the web form opens an incident with several components and posts updates 2026-10-16T13:50:26.763Z ok 51 - status page: the web form opens an incident with several components and posts updates 2026-10-16T13:50:26.763Z --- 2026-10-16T13:50:26.763Z duration_ms: 433.343939 2026-10-16T13:50:26.763Z type: 'test' 2026-10-16T13:50:26.763Z ... 2026-10-16T13:50:26.869Z # Subtest: status page: resolving through the API returns the component to operational and moves the incident to past incidents 2026-10-16T13:50:26.869Z ok 52 - status page: resolving through the API returns the component to operational and moves the incident to past incidents 2026-10-16T13:50:26.869Z --- 2026-10-16T13:50:26.869Z duration_ms: 106.62775 2026-10-16T13:50:26.869Z type: 'test' 2026-10-16T13:50:26.869Z ... 2026-10-16T13:50:26.891Z # Subtest: status page: changes are audited without the updates' text 2026-10-16T13:50:26.891Z ok 53 - status page: changes are audited without the updates' text 2026-10-16T13:50:26.891Z --- 2026-10-16T13:50:26.891Z duration_ms: 20.878017 2026-10-16T13:50:26.891Z type: 'test' 2026-10-16T13:50:26.891Z ... 2026-10-16T13:50:27.008Z # Subtest: status page: pausing hosted compute shows Actions and agent sandboxes under maintenance 2026-10-16T13:50:27.009Z ok 54 - status page: pausing hosted compute shows Actions and agent sandboxes under maintenance 2026-10-16T13:50:27.009Z --- 2026-10-16T13:50:27.009Z duration_ms: 112.173326 2026-10-16T13:50:27.009Z type: 'test' 2026-10-16T13:50:27.009Z ... 2026-10-16T13:50:27.094Z 1..54 2026-10-16T13:50:27.094Z # tests 54 2026-10-16T13:50:27.094Z # suites 0 2026-10-16T13:50:27.094Z # pass 54 2026-10-16T13:50:27.094Z # fail 0 2026-10-16T13:50:27.094Z # cancelled 0 2026-10-16T13:50:27.094Z # skipped 0 2026-10-16T13:50:27.094Z # todo 0 2026-10-16T13:50:27.094Z # duration_ms 271860.514909 2026-10-16T13:50:27.198Z Cache hit occurred on the primary key node-cache-Linux-x64-pnpm-4b94436b86798d88b931ea24b5b847697aebf45520d6ef384cb382ce6c1f1e08, not saving cache. 2026-10-16T13:50:27.471Z Pruning is unnecessary. 2026-10-16T13:50:27.585Z Removing persisted credentials 2026-10-16T13:50:27.648Z Job completed with conclusion: success