fix(security): isolate production governance gh environment

[seonghobae]

Test-first hardening of the production-environment governance GitHub CLI boundary, non-destructively refreshed onto live protected base f1b5a5626b4779b7a554aee76ba600e19ad53cc7. No predecessor checks, reviews, scanner/model output, production-setting evidence, deployment evidence, or acquisition evidence transfer after refresh.

RCA -> RED -> GREEN

Protected scripts/production-environment-governance-audit.mjs invoked shell-free gh without an explicit child environment, so the CLI inherited unrelated parent credentials/configuration. After narrowing the child environment, a second independent RED proved a failing child could echo the explicitly delegated GH_TOKEN into retained diagnostics.

The selected narrow implementation constructs one child environment containing only pinned GH_HOST=github.com, deterministic NO_COLOR=1, optional non-empty PATH, and explicit optional GH_TOKEN; it passes that environment to spawnSync and redacts the exact delegated token from startup and non-zero diagnostics before bounding or persistence. Existing pagination, environment-governance semantics, report/output behavior, and workflow authority remain unchanged.

Historical exact head e878b7c3345f40a2180134d3ab9913828b9ac0e4 obtained terminal-success application ci 31445011456, reviewer-ci 31445011471, and eligible central Security Scan 31445011477. The three source-analysis findings emitted while the deliberate RED exports were absent are resolved on the GREEN lineage. Those results are predecessor evidence only after refresh.

Current exact source

Current head 3a9a0034a90ccbf3949212665cb2d11e9cfd7d27 is a non-forced two-parent refresh preserving latest protected main plus the exact reviewed final blobs:

• scripts/production-environment-governance-audit.mjs bb61a1c9a3583b0ef287872f4e6fa62a9233bcce;
• test/production-environment-governance.test.ts 60f608e849564a5b06d675dd55fef965a1bfbe69.

Fresh compare is 0 behind current main and contains only those two paths. The visible formal review remains COMMENTED on a predecessor; all three inline threads are resolved.

Current exact-head state

For exact head 3a9a0034a90ccbf3949212665cb2d11e9cfd7d27:

• application ci 31594389690: queued/non-passing;
• reviewer-ci 31594389696: queued/non-passing;
• protected-base eligible central Security Scan 31594389650: queued/non-passing;
• current unresolved inline review threads: 0;
• GitHub reports mergeable, but current exact-head checks prohibit merge until terminal-success.

Keep Draft until the unchanged exact head has terminal-success application/reviewer/security evidence and current findings remain clean. No clean-head churn, blind rerun, synthetic status, or gate weakening is used.

Authority boundary

This repair narrows one subprocess and diagnostic-retention boundary. It does not configure or prove the live production environment, create deployment approval, publish a release, deploy Noema, choose an outbound license, establish KPI/revenue/legal/IP-transfer evidence, or create acquisition readiness.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6fe3153c-eda5-405c-9a19-873c78b21ac2

📥 Commits

Reviewing files that changed from the base of the PR and between 9c978a4 and c55a6c3.

📒 Files selected for processing (2)

• scripts/production-environment-governance-audit.mjs
• test/production-environment-governance.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}