[Copilot]

ZIP bombs can exhaust resources during log extraction. Add a highly compressible archive fixture to verify oversized uncompressed content is rejected before extraction.

• Regression coverage: Create a 2 MiB highly compressible ZIP entry, set the total-size limit below its uncompressed size, and assert rejection leaves the destination empty.

• Fixes [uk-ai-resilience] Tier B: bound zip extraction in logs_download_zip.go (CWE-409) #75194

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · routed: gpt56 max · ~1 AIC · ⌖ ~2 AIC · ⊞ 7.7K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · routed: gpt56 max · ~2 AIC · ⌖ ~1 AIC · ⊞ 118 · ◷

Generated by Ponytail Reviewer for #75264

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ PR Specification Reviewer completed successfully!

PR Specification Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from PR Specification Reviewer · gpt56 · ~1 AIC · ⌖ ~1 AIC · ⊞ 1.6K · ◷

Generated by PR Specification Reviewer for #75264

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · routed: gpt56 max · ~1 AIC · ⌖ ~1 AIC · ⊞ 6.3K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[Copilot]

🟢 Approval recommended

No active review issues are reported, and the change is limited to regression coverage for ZIP extraction-size handling.

No open issues 🎉

What changed in this PR

Adds regression coverage for rejecting highly compressible ZIP archives whose uncompressed size exceeds the configured extraction limit.

Changes:

• Creates a highly compressible 2 MiB ZIP entry.
• Applies a total uncompressed-size limit below the entry size.
• Verifies extraction is rejected before creating destination files.
• Confirms the destination directory remains empty after rejection.

File	Description
pkg/​cli/​logs_extract_zip_test.go	Adds high-compression archive coverage for total-size validation and pre-extraction rejection.

_{Review effort: Lite (auto)}

[github-actions]

🎉 This pull request is included in a new release.

Release: v1.2.1