fix(security): record visibility on dependency-review fail-closed

[cursor]

Purpose

Continue #897 on current main and close the remaining #810 diagnostic gap: unavailable dependency-review evidence must record allowlisted repository visibility with the exact base/head comparison, and the pinned action must not be independently skippable after a successful probe.

What changed

• The support probe allowlists public, private, and internal visibility from github.event.repository.visibility and records unknown for any other value.
• Fail-closed diagnostics now include repository identity, allowlisted visibility, exact SHAs, HTTP status, and curl exit. Response bodies and raw visibility strings stay out of logs.
• Executable regressions cover HTTP 403/404, empty and malformed status, transport exit 18 with printed 200, missing visibility, and the successful supported=true path.
• After a successful probe the pinned dependency-review action runs unconditionally.
• Doctoring, architecture, changelog, and AGENTS.md record the operator next step: verify dependency-graph configuration from the recorded visibility, then rerun. Do not infer a root cause from 403/404.

Acceptance

Merge only after exact-current-head deterministic, security, dependency, and required workflows are terminal and clean, current automated review has no valid unresolved finding, and a qualifying counted non-author formal approval exists.

Do not close #810 until a protected-main public-repository consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate.

Prefer this branch over #897 for integration. #897 remains historical evidence for the original fail-closed transport/HTTP-200 repair.

  

[cursor]

Stale comment

Verdict

COMMENT on exact head 4ca7d9e9.

This successor closes the #810 diagnostic gaps that blocked #897: allowlisted repository visibility is recorded with the exact base/head comparison, 403/404/empty/malformed statuses have executable regressions, and the pinned dependency-review action is no longer independently skippable after a successful probe.

Operator next step

Wait only for exact-current-head required checks and a qualifying counted non-author formal approval. Prefer this branch over #897 for integration. Keep #821 draft until its remaining process-group work is rebased without duplicating this probe.

Do not close #810 until a protected-main public consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate. Automated review is not qualifying approval or merge authority.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict

COMMENT on exact head fbb84323.

The visibility-recording fail-closed probe is sound for HTTP 403/404, empty/malformed status, and transport exit 18 with a printed 200. Two gaps remain on this head:

1. curl's %{http_code} 000 sentinel is still logged as a three-digit status instead of unavailable. That is not a completed HTTP exchange (Stenberg, n.d.; Fielding et al., 2022).
2. Private/internal visibility and raw-visibility non-leakage were documented but not locked by executable regressions.

Operator next step

Prefer #1044 (37167995) for integration. Keep this draft and #1041 as historical duplicates of fbb84323. Do not merge #897 or #1042 over #1044.

Do not close #810 until a protected-main public consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate. Automated review is not qualifying approval or merge authority.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict

COMMENT on exact head fbb8432345ac6565724668afdbf9e3259475b94b.

This draft matches #1041 and still interpolates unvalidated revisions and repository names into the compare URL. Prefer #1045 for integration. Do not merge #1033. Keep #810 open until a protected-main public consumer run proves a non-200 cannot go green.

View PR

  

_{Sent by Cursor Automation: Fix Issues}