chore(azdext): apply post-6856 cleanup#5
Closed
jongio wants to merge 14 commits intofeature/ext-pr5-6948from
Closed
chore(azdext): apply post-6856 cleanup#5jongio wants to merge 14 commits intofeature/ext-pr5-6948from
jongio wants to merge 14 commits intofeature/ext-pr5-6948from
Conversation
Implements Azure#6945 (P1-5/P1-6). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implements Azure#6946 (P2-1/P2-2). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implements Azure#6947 (P2-3/P2-4). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implements Azure#6948 (P3-1..P3-5). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implements Azure#6949 and related docs updates (Azure#6863/Azure#6855). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document shell, tool discovery, interactive, and atomic file helpers with behavior notes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reuse shared SSRF host/CIDR and IP checks between guard and MCP policy to keep behavior aligned. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use osutil rename retry semantics, support project-local tool lookup, and sync agent env detection keys. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- swap.go: validate slot names, add error context - shell: sanitize command arguments and validate paths - ssrf_guard: strengthen IP validation and blocklist enforcement - Propagate all core and helper security fixes across stack
- swap.go: validate prompt.GetValue() bounds before array access (3 sites) - NewPagerFromHTTPClient: fall back to http.DefaultClient when nil passed - keyvault_resolver_test.go: add //lint:ignore SA1012 for standalone staticcheck
This was referenced Mar 2, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Owner
Author
|
Consolidated into single PR: Azure#7025 |
jongio
added a commit
that referenced
this pull request
Mar 13, 2026
- Use merged_at instead of merged for reliable merge detection (thread #1) - Expand isDocOnlyPr to handle doc-adjacent assets (thread #2) - Replace N+1 API calls with git.getTree for doc inventory (thread #3) - Fix README trigger types to match actual workflow config (thread #5) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jongio
added a commit
that referenced
this pull request
Mar 13, 2026
- Pin actions to commit SHAs (actions/checkout, azure/login) - Cap all_open/list mode to MAX_PRS_PER_RUN=20 - Cap AI output: MAX_REASON_LENGTH=200, MAX_SUMMARY_LENGTH=500 - Add MAX_IMPACTS=15 to limit AI-generated impact count - Add MAX_CONTENT_SIZE_BYTES=50KB per doc file - Sanitize doc manifest content (titles, topics, headings) - Reject unknown repos from AI output (not just warn) - Validate repo format with regex (owner/repo) - Block path traversal in AI-returned paths - Sanitize PR title in log output (strip control chars) - Strip HTML from existing PR body in closeCompanionPrs - Remove error messages from tracking comment (prevent data leak) - Upper-bound PR number input to 999999 - Rename TRUSTED_DOC_INVENTORY to DOC_INVENTORY tag Red team findings addressed: #2, #5, Azure#6, Azure#8, Azure#9, Azure#10, Azure#11 Admin items remaining: #1 (env gating), #3 (token scope), #4 (OIDC vars) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Links
Stack position
Stack / Merge Plan (Uber Plan)
This PR is Step 6 of 6 in the full rollout.
Required merge order
How to land this safely