Repository navigation
feat(trigger-api)!: the inbound hook door refuses the body-only signature form, so only the timestamped form verifies (ruling B on #22805, step 3) #32625
pr-automation.yml
on: pull_request
Check PR Size
19s
Check Changeset
1m 12s
Auto Label
9s
Annotations
5 notices
|
Check PR Size
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
|
|
Auto Label
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
|
|
Check Changeset:
.changeset/22826-refuse-body-only-signature.md#L0
major introduced by this diff in .changeset/22826-refuse-body-only-signature.md: @objectstack/trigger-api
|
|
Check Changeset:
.changeset/22826-refuse-body-only-signature.md#L0
ADR-0087 exemption (no-migration-prescription): Nothing an ObjectStack author writes moves: no spec key, metadata shape, authorable spelling, stored row, type or export signature is added, removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is a runtime HTTP door's accept set: a signature value a third-party sender computes, outside any project's metadata or code. The sending side's guidance already teaches the one accepted form, and this changeset points to it rather than prescribing a rewrite. The other categories are closed on facts: both bumped packages publish (not unpublished); no ADR-0087 id covers this door and this diff adds none (not registered / already-registered); and no TypeScript declaration moves, since `verifySignature` keeps its signature and only its answer for one input narrows (not runtime-interface-only / type-surface-only).
|
|
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
|