This repository was archived by the owner on Sep 8, 2026. It is now read-only.
Repository navigation
Harden benchmark stack and CI supply chain - #19
Merged
Merged
Conversation
The bench compose stack published every database port on 0.0.0.0, exposing unauthenticated stores to the local network. Bind all host port mappings to 127.0.0.1, which the benchmark clients already target. Fixes #11 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TCz23P2PXpQ7QAiVtCM5so
The VictoriaMetrics adapter interpolated the crc read from summary.txt directly into label values and MetricsQL selectors. Require the crc to be exactly eight lowercase hex digits and fail with a clear error otherwise. Fixes #12 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TCz23P2PXpQ7QAiVtCM5so
Mutable tags allow a compromised action repository to inject code into CI. Pin actions/checkout to the v4.4.0 commit and dtolnay/rust-toolchain to the 1.97.1 commit, keeping the version in a trailing comment. Fixes #13 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TCz23P2PXpQ7QAiVtCM5so
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f63954232
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The previous pin (46511b1) was the generated 1.97.1 version-branch commit. dtolnay/rust-toolchain documents that full-SHA pins must reference a commit in the master branch history: version branches are regenerated and can be pruned, after which the pinned commit is garbage-collected and the action fails to resolve. Pin the current master head instead and pass the toolchain version explicitly via the toolchain input. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TCz23P2PXpQ7QAiVtCM5so
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
127.0.0.1dtolnay/rust-toolchainto commit2c7215fin its main historyRoadmap
This supports M4 comparative benchmark and edge hardening. It keeps the local benchmark stack private and makes its CI inputs stable.
Checks
docker compose -f bench/compose.yml configCloses #11
Closes #12
Closes #13