stability: implement audit findings remediation plan - #38
Merged
Conversation
Implement the validated remediation plan end-to-end: extract uploader runtimes into standalone templates, enforce a Windows PowerShell-only path, strengthen sync/uploader safety checks, expand release workflow parity, and close the findings ledger with evidence. This reduces drift between platforms and release lanes while making audit coverage and tooling validation deterministic.
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
Fix post-review regressions by restoring uploader runtime template parity, exporting new test/tooling artifacts for Bazel visibility, and hardening bazelw version detection so enforcement works with non-standard version output formats. This brings full //... test execution and strict findings-ledger validation back to green.
Align uploader runtime fingerprint behavior with sync-side Starlark so API key parity checks stay deterministic across Bash and PowerShell. Remove Bash runtime Windows delegation and add regression tests that lock in PowerShell-only Windows behavior and cross-runtime fingerprint parity.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Format modified Starlark files to satisfy buildifier checks and remove the secret-like mock API key literal flagged during PR review. Replace regex-based Bash alphabet extraction in tests with deterministic parsing to avoid regex backtracking risk while preserving runtime parity validation.
Use separate stdout and stderr redirection files in the Windows integration harness so Start-Process works reliably on GitHub Windows runners. This resolves the bazel-tests windows job failure in PR #38.
Use PowerShell New-Item -Path for repository-rule directory creation so Windows fetches succeed on CI environments where -LiteralPath is not accepted for New-Item. Add a regression test that locks this command shape in the sync module.
Restore the Chainguard STS configuration to the tests repository identity and remove the audit source artifacts as requested. Add maintainer-focused documentation across changed runtime, sync, tooling, and test helpers so behavior and intent are easier to reason about during future maintenance.
Drop the audit findings ledger checker from CI/release workflows and remove the helper script now that docs/audit is no longer part of the repository. Update developer docs and exports to keep policy, tooling, and workflow behavior consistent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/audit/findings_validation_2026_02.md..sh/.ps1/.bat), render them viaexpand_template, and enforce Windows PowerShell-only execution paths (no Git Bash dependency) for uploader/runtime and integration harness entrypoints..bazelversionparity checks, stricter template substitution validation, and Chainguard policy repo correction.Test plan
python3 tools/dev/check_findings_ledger.py --require-done --require-evidencepython3 tools/dev/check_module_versions.pypython3 tools/dev/check_bazelversion_sync.pypython3 tools/dev/lint_uploader_templates.py --skip-shellcheckpython3 tools/tests/python/test_python_tools.py./bazelw test //tools/tests/core:tests //modules/go/tests:tests