fix: harden Trace against the September 2026 security audit findings - #2

Open

Patel230 wants to merge 30 commits into

mainfrom

fix/security-hardening

Commits on Sep 26, 2026

fix(git): allow anonymous clone and fetch of public repositories
Patel230
committed
ff7a0cc
fix(actions): confine artifact collection to the job workspace
Patel230
committed
dbaccc6
fix(actions): initialize schedule state on a fresh node
Patel230
committed
a380ab1
feat(actions)!: let the operator decide which workflows may run
Patel230
committed
5ac64f9
fix(actions): make the macOS sandbox profile start a shell
Patel230
committed
a138ec0
fix(actions): give jobs a minimal environment instead of the server's
Patel230
committed
6e098f6
fix(actions): forward job variables into Docker and stop whole steps
Patel230
committed
f40759a
perf(actions): keep job logs out of actions.json and prune old runs
Patel230
committed
9d0c14b
fix(hooks): stop protected-branch patterns from injecting shell code
Patel230
committed
0ab11fd
fix(hooks): keep configured branch protection across server restarts
Patel230
committed
30bdbc4
fix(ssh): reject pushes to archived repositories
Patel230
committed
8ae3139
fix(ssh): run Git services with an explicit minimal environment
Patel230
committed
8c3f76d
fix(oidc)!: bind OIDC sign-in to the provider's issuer and subject
Patel230
committed
00353f4
fix(oidc): verify nonce, issuer, key size, and bound provider requests
Patel230
committed
619af3a
fix(api): compare the CSRF header in constant time and require it for sessions
Patel230
committed
ff2924e
fix(raw,pages): check blob size before reading raw and Pages files
Patel230
committed
0953577
fix(raw,pages): never mark private repository content as publicly cacheable
Patel230
committed
33e2073
fix(web): sandbox raw and Pages content and drop unsafe-inline scripts
Patel230
committed
2415bad
fix(ratelimit): throttle per client in memory and support trusted proxies
Patel230
committed
7abb317
fix(scim): refuse passwords and support filters, paging, and member removal
Patel230
committed
4ce72d7
fix(webhooks): refuse internal destinations and redirects on delivery
Patel230
committed
3545d8f
fix(lfs): store and serve LFS objects per repository
Patel230
committed
a55aa42
fix(api): let maintainers run actions and manage secrets and Pages
Patel230
committed
474056d
fix(totp): reject reused codes and back off repeated failures per account
Patel230
committed
0db5e1a
fix(backup): refuse archive paths inside the data directory
Patel230
committed
4127b3f
fix(repo): rename transfer references structurally, atomically, and under locks
Patel230
committed
bf6c9fb
fix(deps): bump golang.org/x/crypto to v0.56.0
Patel230
committed
714c6f5
ci: add GitHub Actions workflow with pinned Go and job timeouts
Patel230
committed
46bf803
fix(lfs): keep serving when a repository cannot be scanned for migration
Patel230
committed
c71fe90
test: keep repository fixtures independent of a host Git LFS install
Patel230
committed
45d0efa