[workflow-audit] 6 unexplained change(s) on 2026-08-29

[github-actions]

6 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-08-28T19:24:02Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

0715ae5 — test(selfhost): make the installer contract executable

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-08-28 12:27:49 -0700
• Refs: main,remotes/origin/fix/audit-report-body-limit remotes/origin/fix/issue-473,remotes/origin/fix/issue-474 remotes/origin/fix/issue-475,remotes/origin/main remotes/origin/spec-tighten
• Files:
  • .github/workflows/ci.yml
• View diff

0d8a24d — fix(vscode): make build:frontend build the deps it imports

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-08-28 15:29:00 -0700
• Refs: main,remotes/origin/fix/audit-report-body-limit remotes/origin/fix/issue-473,remotes/origin/fix/issue-474 remotes/origin/fix/issue-475,remotes/origin/main
• Files:
  • .github/workflows/ci.yml
• View diff

90b0472 — fix(security-audit): clamp the issue body so a FAIL is never reported nowhere

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-08-29 12:50:33 +0000
• Refs: remotes/origin/fix/audit-report-body-limit
• Files:
  • .github/workflows/security-audit.yaml
  • .github/workflows/workflow-audit.yaml
• View diff

912bdeb — test(vscode): boot the built webview under its own CSP

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-08-28 15:21:21 -0700
• Refs: main,remotes/origin/fix/audit-report-body-limit remotes/origin/fix/issue-473,remotes/origin/fix/issue-474 remotes/origin/fix/issue-475,remotes/origin/main
• Files:
  • .github/workflows/ci.yml
• View diff

afe3cfb — fix(security-audit): make the clamp non-fatal and close tilde fences

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• Date: 2026-08-29 13:01:21 +0000
• Refs: remotes/origin/fix/audit-report-body-limit
• Files:
  • .github/workflows/security-audit.yaml
  • .github/workflows/workflow-audit.yaml
• View diff

c19d579 — Merge origin/main into test/webview-boot-smoketest

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-08-28 15:22:28 -0700
• Refs: main,remotes/origin/fix/audit-report-body-limit remotes/origin/fix/issue-473,remotes/origin/fix/issue-474 remotes/origin/fix/issue-475,remotes/origin/main
• Files:
  • .github/workflows/ci.yml
• View diff