fix: harden bundle and workflow step integrity - #4470

Open

marcelsafin wants to merge 14 commits into

github:mainfrom

marcelsafin:fix/bundle-step-version-pin

Commits on Sep 8, 2026

fix: enforce bundle step version pins

marcelsafin
and
Copilot
committed
ed167a7

Commits on Sep 10, 2026

chore: sync upstream before bundle consolidation

marcelsafin
and
Copilot
committed
0ab707c
fix: scope custom steps to current project

marcelsafin
and
Copilot
committed
ebd3798
fix: purge stale custom step bytecode

marcelsafin
and
Copilot
committed
eadef1d
fix: reject duplicate bundle components

marcelsafin
and
Copilot
committed
30f8115
test: allow duplicate IDs across component kinds

marcelsafin
and
Copilot
committed
1fe0d78
fix: reject mismatched step catalog versions

marcelsafin
and
Copilot
committed
e3048f4
fix: validate explicitly declared step versions

marcelsafin
and
Copilot
committed
0f78c80
fix: preserve exact fallback version comparison

marcelsafin
and
Copilot
committed
eaa1fce
fix: roll back bundle installs when record save fails

marcelsafin
and
Copilot
committed
6a254b6
fix: close step version integrity gaps

marcelsafin
and
Copilot
committed
e0f957f
fix: require usable downloaded step versions

marcelsafin
and
Copilot
committed
42208be
fix: roll back failed bundle updates

marcelsafin
and
Copilot
committed
6ec8b9c
fix: snapshot installed state for bundle rollback

marcelsafin
and
Copilot
committed
130cb6e