taigrrSecurity: INT-A1 verify GitHub push permission before push mirroring; INT-A2/A33 MergeFix requires base write, trailers, no-CI needs human; INT-A3/A4 legacy webhooks via guarded outbound client with encrypted secrets; INT-A5/A25/A27 detach integrations on transfer/delete, prune orphans and logs; INT-A26 hide installer repo list; INT-A28/A29 streamed inbound cap, strip auth on cross-origin redirect; INT-A6/A7/A8/A20/A22/A32 editor container cap, preview hardening, symlink-safe sync, non-root image
f2e2275 ·
- ..
- badge.ts
- builtin-actions.ts
- cache-api.ts
- compile.ts
- config-admin.ts
- config-values.ts
- cron.ts
- deployments.ts
- dispatch.ts
- event-triggers.ts
- expressions.ts
- http.ts
- job-token.ts
- jobs.ts
- maintenance.ts
- markers.ts
- matrix.ts
- oidc.ts
- permissions.ts
- recompile.ts
- rerun.ts
- run-control.ts
- run-insert.ts
- run-workflow.ts
- runner-api.ts
- runner-claim.ts
- runner-do.ts
- runner-owner.ts
- runner-policy.ts
- runner-registration.ts
- runner-sizes.ts
- runner-variants.ts
- scheduler.ts
- script-runtime.ts
- script.ts
- segments.ts
- spec.ts
- triggers.ts
- usage-hooks.ts
- workflow-index.ts