[david-ruiz-cko]

This release improves the security and reliability of dependency installation in CI workflows, refactors requirements files to separate CI and development dependencies, and strengthens the handling of TLS certificate verification when obtaining OAuth tokens. It also adds comprehensive tests to ensure that server certificate verification is always enforced.

CI/CD and Dependency Management Improvements:

• Updated all GitHub Actions workflows (build-main.yml, build-pull-request.yml, build-release.yml) to install dependencies using --only-binary :all: and to use a new requirements-ci.txt file, ensuring only pre-built wheels are installed and preventing execution of untrusted setup.py scripts in CI jobs that may contain secrets. [1] [2] [3]
• Refactored requirements files: moved common CI dependencies into requirements-ci.txt and updated requirements-dev.txt to include requirements-ci.txt and pre-commit, reducing duplication and isolating pre-commit-related dependencies from CI. [1] [2]

Testing Improvements:

• Added new tests in tests/oauth_credentials_test.py to verify that server certificate verification is always enabled when requesting OAuth tokens and that the HTTP client's custom CA bundle configuration is respected.

Files:

• The uploaded file is now closed after the request; previously its handle stayed open until garbage collection.

Security and Code Quality Enhancements:

• Removed explicit disabling of TLS certificate verification (verify=False) in OAuthSdkCredentials.get_access_token, ensuring the SDK relies on the HTTP client's default certificate verification behavior.
• Removed unused import of urllib3 from checkout_sdk/oauth_credentials.py as it is no longer needed.

Security: ⚠️

• OAuth: the token request now verifies the server's TLS certificate. Previously verification was turned off for that request and the warning was silenced, which exposed the client id and secret to interception.
  Behaviour change: If your network sits behind a proxy that inspects TLS, the OAuth token request can now fail with CheckoutAuthorizationException until your system trusts the proxy's CA. Add the proxy's CA to your trust store, or set it on the HTTP client you pass to the SDK (for example session.verify = "/path/to/ca-bundle.pem"), or set the REQUESTS_CA_BUNDLE environment variable. The SDK now honours all of these. Turning verification off is not supported.

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• no_low_class_matched
• prod_source_modified

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

This diff only shows a version bump from 4.8.0 to 4.8.1, but the PR description claims substantial security fixes (TLS verification removal), new tests, CI workflow changes, and requirements file refactoring — none of which are visible here.

For you to decide

• The diff is almost certainly partial: the described security fix (removing verify=False from OAuthSdkCredentials.get_access_token) is not present in the shown diff, so the reviewer must confirm all other claimed changes are included in the actual PR.
• The version bump itself (4.8.0 → 4.8.1) is consistent with a patch release for security/bugfix changes, but correctness of this version number depends on whether the full set of changes is actually included and merited a patch rather than minor bump.
• A human reviewer must verify the complete diff includes the TLS fix, the new tests, and the CI changes described — the version bump alone cannot be approved in isolation if those are the actual security substance of this release.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud