Skip to content
PR Automation

fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope #30082

Sign in to view logs

fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope

fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope #30082

Triggered via pull request October 1, 2026 18:32
@objectstack-fleetobjectstack-fleet[bot]
labeled #21217
claude/issue-21079-zero-set-deny-baseline
Status Success
Total duration 1m 15s
Artifacts –

pr-automation.yml

on: pull_request
Check PR Size
Check PR Size
Check Changeset
1m 11s
Check Changeset
Auto Label
Auto Label
Fit to window
Zoom out
Zoom in

Annotations

2 notices
Check Changeset: .changeset/21079-zero-set-deny-baseline.md#L0
ADR-0087 exemption (no-migration-prescription): No authorable key, export, published type, stored shape or wire shape is removed or renamed, so objectstack migrate meta has nothing to rewrite. What moves is which callers object admission and the row scope accept: a caller that carries a principal and resolves no permission set is now refused, and the remedy is a grant decision (a permission set the deployment declares and assigns), not a rewrite of anything an author already wrote.
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"