irvingpop · Nov 6, 2026 · Nov 6, 2026
@@ -18,9 +18,9 @@
 # - no ${{ }} inside run: scripts; values reach scripts through env:
 #
 # Harden-runner runs in audit mode (spec K-14): in V10, block mode hung 2 of
-# 24 jobs in "Complete job" (symptoms match open harden-runner issue 708;
-# v2.22.3 has a partial fix only, the safe-by-default fix is not released,
-# .github issue 24). Each job keeps the allowlist that V10 measured, plus
+# 24 jobs in "Complete job" (symptoms match harden-runner issue 708, which
+# v2.22.4 fixes upstream; audit mode stays until the .github issue 24 soak and
+# block-mode runs pass). Each job keeps the allowlist that V10 measured, plus
 # releases.astral.sh:443 where setup-uv runs (v10.3.3 fetches the uv
 # version manifest there first; not measured), so block mode needs only
 # egress-policy: block plus disable-telemetry: true (the action accepts that
@@ -52,9 +52,9 @@ jobs:
       merge-base-sha: ${{ steps.collect.outputs.merge-base-sha }}
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
-          # Audit until https://github.com/step-security/harden-runner/issues/708 is fixed (spec K-14).
+          # Audit until the issue 24 soak and block-mode runs pass; upstream issue 708 is fixed in v2.22.4 (spec K-14).
           egress-policy: audit
           allowed-endpoints: >
             api.github.com:443
@@ -119,9 +119,9 @@ jobs:
       supply-chain-digest: ${{ steps.analyze.outputs.supply-chain-digest }}
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
-          # Audit until https://github.com/step-security/harden-runner/issues/708 is fixed (spec K-14).
+          # Audit until the issue 24 soak and block-mode runs pass; upstream issue 708 is fixed in v2.22.4 (spec K-14).
           egress-policy: audit
           allowed-endpoints: >
             api.github.com:443
@@ -216,9 +216,9 @@ jobs:
       outcome: ${{ steps.dr.outcome }}
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
-          # Audit until https://github.com/step-security/harden-runner/issues/708 is fixed (spec K-14).
+          # Audit until the issue 24 soak and block-mode runs pass; upstream issue 708 is fixed in v2.22.4 (spec K-14).
           egress-policy: audit
           allowed-endpoints: >
             api.github.com:443
@@ -249,9 +249,9 @@ jobs:
       UV_PYTHON: python3.12
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
-          # Audit until https://github.com/step-security/harden-runner/issues/708 is fixed (spec K-14).
+          # Audit until the issue 24 soak and block-mode runs pass; upstream issue 708 is fixed in v2.22.4 (spec K-14).
           egress-policy: audit
           allowed-endpoints: >
             api.github.com:443

@@ -41,7 +41,7 @@ jobs:
       environment: ${{ steps.select.outputs.environment }}
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
           egress-policy: audit
           allowed-endpoints: >
@@ -70,7 +70,7 @@ jobs:
       EVAL_ENVIRONMENT: ${{ needs.select-environment.outputs.environment }}
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
           egress-policy: audit
           allowed-endpoints: >

@@ -31,7 +31,7 @@ jobs:
       UV_PYTHON: python3.12
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3, released 2026-10-27
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4, released 2026-11-06
         with:
           egress-policy: audit
           allowed-endpoints: >

@@ -106,7 +106,7 @@ Depends on: V3, V5, V9 (analyze); V6, V16, V24 (publish).
 - [ ] Guard every artifact download in the gate job with an explicit non-empty id check (D10). An empty `artifact-ids` makes `actions/download-artifact` fetch every artifact of the run. When analyze failed, its ids are empty, and `publish.py` must find a missing directory and fail with the `artifact` reason while it still posts the summary.
 - [ ] A unit test parses the workflow: no `continue-on-error`, the dependency-review job exports the step `outcome`, every `uses:` is a full SHA.
 - [ ] `.github/workflows/test.yml`: unit tests on PRs to this repo (`pull_request`, no path filter) and on pushes to `main`. The job is `unit-tests`, with `contents: read`, no `id-token`, no environment and no secrets, so it runs a PR's code with a read-only token (the no-execute rule covers the review workflow). From phase 3 the job has a second step, `pytest tests/unit -m release`, so the check name does not change.
-- [ ] Every workflow job starts with harden-runner and has `timeout-minutes`. Actions are pinned to the newest release at least 2 days old (spec P5-5; it was 7 days), except `setup-uv` v10.3.2 (spec K-15; since 2026-11-05 every workflow pins harden-runner v2.22.3 and setup-uv v10.3.3, both under the 2-day rule). Python is the runner image's 3.12, and `setup-uv` has an exact version and checksum, with its cache and the Astral mirror off. Artifact names carry the run attempt.
+- [ ] Every workflow job starts with harden-runner and has `timeout-minutes`. Actions are pinned to the newest release at least 2 days old (spec P5-5; it was 7 days), except `setup-uv` v10.3.2 (spec K-15; since 2026-11-06 every workflow pins harden-runner v2.22.4, a second age exception approved by the owner (spec K-16), and since 2026-11-05 setup-uv v10.3.3, under the 2-day rule). Python is the runner image's 3.12, and `setup-uv` has an exact version and checksum, with its cache and the Astral mirror off. Artifact names carry the run attempt.
 - [ ] `.github/workflows/eval.yml`: manual fixture evals. The job uses `environment: eval` (since spec P6-4: `eval` on `main`, `eval-test` on any other ref, chosen by an exact shell test in a select job with no permissions) and has `contents: read` and `id-token: write` only. A workflow unit test reads every workflow file and fails if a workflow other than `eval.yml` uses `environment: eval` (or `eval-test`), or if a job that uses `eval` sets no explicit job-level `permissions` or has any `write` permission other than `id-token: write`. Job-level `permissions` is required even if the workflow level sets it. `write-all` at either level fails the test, and so do `read-all` and a missing job-level block, because the job must state `contents: read` and `id-token: write` itself.
 - [ ] `review/src/oc_review/evals.py`: the runner that `eval.yml` calls (`python -m oc_review.evals --fixtures-dir ... --out-dir ...`), with placeholder eval federation IDs and one smoke fixture. The phase 2 fixtures and IDs come later. `analyze` takes an optional federation IDs parameter for it.
 - [ ] Prefilter run budget: the prefilter line diff has a budget of 40,000,000 steps per run next to its 2,000,000 per file (spec "Coverage limits").
@@ -222,11 +222,11 @@ Exit criteria:
 - [x] Supported repo inventory: [docs/supported-repos.md](supported-repos.md).
 - [ ] Owner: every repo to be added to the review ruleset first sends the immutable OIDC subject (spec "Immutable subject"). Check `GET repos/OperationCode/<repo>/actions/oidc/customization/sub`, check the other `id-token` users in the repo and their relying-party trust, set it per repo and read it back before the repo is a target. Right after the repo becomes a target, run a test PR in that repo (all four jobs `success` at the pin); the repo is accepted only when it passes.
 - [x] CODEOWNERS in each supported repo (pilot repos P4-3; `START_HERE` P5-4).
-- [x] Owner: "prevent self-review" is on for the `eval` environment (2026-11-01). Admin bypass stays on. Changed 2026-11-04 (spec P6-4): `eval` now has a main-only branch policy and no required reviewer or "prevent self-review" (read back 2026-11-05: only the `branch_policy` rule, policy `main`); branch evals move to `eval-test`, which has the owner as reviewer and "prevent self-review" on.
+- [x] Owner: "prevent self-review" is on for the `eval` environment (2026-11-01). Admin bypass stays on. Changed 2026-11-04 (spec P6-4): `eval` now has a main-only branch policy and no required reviewer or "prevent self-review" (read back 2026-11-05: only the `branch_policy` rule, policy `main`); branch evals move to `eval-test`, which has the owner as reviewer and "prevent self-review" off (2026-11-06: the sole reviewer is the run actor, so it would block every approval; read back: reviewer irvingpop, no branch policy, admin bypass on).
 - [x] Owner: Dependabot alerts with npm malware detection on active repos. On for the active repos (owner, by 2026-11-04; spec P5-11).
 - [x] Re-run the key acceptance tests on the current release: V6 a, V8 a, V22 b, V23 and the outage process (the invalid federation rule case), each case on its own terms (V6 a on a same-repo and a fork PR, with the timed-out and slow runs from a scratch-only build; V8 a from an account outside the org). A case not run leaves phase 5 open until the owner accepts the gap in the decision log. Done 2026-11-02 at `88e055f`: all 8 rows pass, and the merge box read mergeable on a run that was not `success` only in the stated residuals (spec P5-9). Finding: the baseline blocks a PR with unsigned commits, also from a fork; the summary now names them (spec P6-1).
 - [x] Scratch bypass matrix and switch rehearsal on claude-review-test: under the scratch test ruleset and the live baseline, check who can merge which PR kind with the empty, the pilot-shaped and the org-admin-only bypass lists, then return to the pilot-shaped list (the rollback of the phase 6 bypass switch). The baseline is never changed for this test. Pass 2026-11-04: 27 merge cells and 6 direct pushes as expected, the return test passed, every ruleset read back as before (spec P5-10).
-- [ ] Revisit harden-runner block mode (spec K-14): switch to block when harden-runner [issue 708](https://github.com/step-security/harden-runner/issues/708) is fixed in a harden-runner release. Pin that release, measure the `test.yml` and `eval.yml` lists in audit mode, and re-test block mode. If no job hangs, set `egress-policy: block` and `disable-telemetry: true` in every job, and update the unit tests and the spec.
+- [ ] Revisit harden-runner block mode (spec K-14): switch to block after the soak. Upstream [issue 708](https://github.com/step-security/harden-runner/issues/708) is fixed in v2.22.4, which is pinned since 2026-11-06 (spec K-16; .github issue 24 stays open). Measure the `test.yml` and `eval.yml` lists in audit mode, and re-test block mode. If no job hangs, set `egress-policy: block` and `disable-telemetry: true` in every job, and update the unit tests and the spec.
 
 Depends on: phase 4; V6, V8, V22, V23.