Issues 28 open · 331 closed

● #248 Assistants: no answer when a proposal sends the model too much bug

opened 19 days ago by andymccall · 1 comment

● #247 Flaky: browse's create_push_and_browse clone fails 'unknown token' under the full suite bug

opened 19 days ago by andymccall

● #246 The hub holds 8.5 GB on Earth for 2.5 GB of repositories performance

opened 19 days ago by andymccall · 1 comment

● #245 A new hub hands administrator to whoever registers first security

opened 19 days ago by andymccall

● #244 Flow scheduling: priorities (site, org, team, repo, pipeline), expedited runs, and fair share between repositories feature

opened 19 days ago by andymccall · 3 comments

● #243 Runners: Connectivity and Status columns, and a filterable queue feature

opened 19 days ago by andymccall

● #242 Release the hub server (Linux x86_64, PostgreSQL) for the GCP image feature

opened 19 days ago by andymccall

● #241 Short-lived delegated keys for runners and agents from their OIDC identity ('keyless') security

opened 19 days ago by andymccall · 8 comments

● #240 Trusted timestamps for signatures (from the transparency log, or RFC 3161) security

opened 19 days ago by andymccall · 4 comments

● #239 Standard exports: cosign-verifiable releases, in-toto/SLSA provenance in DSSE feature

opened 19 days ago by andymccall · 3 comments

● #236 Follow a key rotation chain when checking who signed (approvals, seals) feature

opened 19 days ago by andymccall

● #235 Sealed approvals: cryptographic proof of who approved a gated job security

opened 19 days ago by andymccall

● #234 A local cache for repositories kept in GCS (or S3): pages on them take seconds performance

opened 19 days ago by andymccall · 1 comment

● #233 A deploy restart cuts off requests in flight: drain them bug

opened 19 days ago by andymccall · 2 comments

● #232 Checks panel overflows with a long check summary bug

opened 19 days ago by andymccall

● #231 HSTS, staged: 5 minutes, then a week, then a year security

opened 19 days ago by andymccall

● #230 A security contact page at /security-contact security

opened 19 days ago by andymccall

● #229 Approvals made with an agent token should say so (and may need to be refused) security

opened 20 days ago by andymccall · 2 comments

● #228 negotiate on a large repository takes ~7 s per request; one client polling it keeps the hub busy performance

opened 20 days ago by andymccall · 3 comments

● #227 Move inline scripts and handlers into hub.js so the CSP can be enforced security

opened 20 days ago by andymccall · 3 comments

● #226 A change that closes several issues closes only the first buggap

opened 20 days ago by andymccall

● #225 Users with their own runners can switch Flow on for their repositories featuregap

opened 20 days ago by andymccall

● #224 Security (info): publish security.txt featuresecurity

opened 20 days ago by andymccall

● #223 Security (low): sessions are long-lived and cannot be revoked one by one featuresecurity

opened 20 days ago by andymccall

● #222 Security (medium): baseline browser security headers featuresecurity

opened 20 days ago by andymccall