ci: leak-scan SVGs and verify the docs-site navigation - #2142
Merged
Conversation
Two surfaces the release verifier never examined, both found by an adversarial
audit of the cutover and each proven against a planted defect:
- .svg was absent from the scanned text formats, so every shipped image passed
through unexamined. A token planted in an SVG is now caught.
- docs.json is the documentation navigation manifest and is JSON, so the
markdown link checker never read it. A navigation entry naming a page the
export drops would publish a broken documentation site - and since the
documentation now ships from this repository, the release IS the deploy.
Lands as its own policy-update change so the release that carries these bytes
can be judged by a verifier it does not itself modify.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A policy-update change: it modifies the release verifier, so it lands on its own and is judged by the verifier currently on
main, not by the one it installs.Two surfaces the verifier never examined. An adversarial audit of the cutover found both, and each is proven against a planted defect rather than asserted.
SVG files were never leak-scanned
.svgwas absent from the scanned text formats. SVGs are text and can carry arbitrary content, so every shipped image passed through unexamined. Now caught:The docs-site navigation was never checked
docs/external/docs.jsonis the navigation manifest and is JSON, so the markdown link checker never read it. An entry naming a page the export drops would publish a broken documentation site — and because the documentation now ships from this repository, the release is the deploy. Now caught:Group labels share the string space with page paths in that file, so only entries that look like paths are treated as pages; otherwise every heading would be reported missing.