Repository navigation
Conversation
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe incremental change since Assumptions: Files Reviewed (4 files)
Previous Review Summaries (8 snapshots, latest commit beb897a)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit beb897a)Status: 2 Issues Found | Recommendation: Address before merge Executive SummaryThe two blocking guard defects from the previous review are fixed at HEAD Assumptions: Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (17 files)
Verification Notes
Fix these issues in Kilo Cloud Previous review (commit d7db102)Status: 3 Issues Found | Recommendation: Address before merge Executive SummaryTwo job guards reference a Overview
Issue Details (click to expand)CRITICAL
SUGGESTION
Files Reviewed (17 files)
Verification Notes
Fix these issues in Kilo Cloud Previous review (commit 190f611)Status: 2 Issues Found | Recommendation: Address before merge Executive SummaryThe guard additions are correct, but Overview
Issue Details (click to expand)CRITICAL
SUGGESTION
Files Reviewed (17 files)
Verification Notes
Fix these issues in Kilo Cloud Previous review (commit 1d8ec82)Status: No Issues Found | Recommendation: Merge Executive SummaryThis PR adds Files Reviewed (17 files)
Previous review (commit 5657d7e)Status: No Issues Found | Recommendation: Merge Executive SummaryThis hardening PR adds Files Reviewed (17 files)
Note: the branch was rebased onto a newer Previous review (commit c8853be)Status: No Issues Found | Recommendation: Merge Executive SummaryThis hardening PR adds Files Reviewed (17 files)
Note: the branch was rebased (previous review SHA Previous review (commit c57675d)Status: No Issues Found | Recommendation: Merge Files Reviewed (17 files)
Previous review (commit 4e0a0c4)Status: No Issues Found | Recommendation: Merge Files Reviewed (17 files)
Reviewed by deepseek-flash-latest · Input: 74.1K · Output: 11.9K · Cached: 835.8K Review guidance: REVIEW.md from base branch |
4e0a0c4 to
c57675d
Compare
5657d7e to
1d8ec82
Compare
1a2499d to
87e93b3
Compare
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Add a job-level guard to fork-triggerable privileged workflows so forks with Actions enabled cannot trigger deploys, releases, migrations, or container pushes. Guarded workflows: bump-openclaw, check-md-table-padding, codeql, deploy-production, deploy-staging, deploy-workers, deploy-kiloclaw, extension-store-release, kilo-app-release, redeploy-web, auto-docs. Closes Kilo-Org#6248 Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Complete the issue Kilo-Org#6248 scope: add the canonical-repo guard to the remaining guarded workflows (push-dev-kiloclaw, sbom, setup-smoke, stale-prs, promote-vercel-deployment, stage-vercel-deployment) and add consistency comments to the bare guards in deploy-production, deploy-staging, deploy-workers, kilo-app-release, and redeploy-web. Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
190f611 to
d7db102
Compare
# Conflicts: # .github/workflows/deploy-production.yml # .github/workflows/deploy-staging.yml # .github/workflows/redeploy-web.yml
maphew
left a comment
maphew
left a comment
There was a problem hiding this comment.
Addressed the review: removed the check-changes output guard from deploy-workers.yml's detect-changes (the reusable workflow has no such job), made promote-ai-gateway guard on repository alone like promote-app (check-changes is not in its needs), and corrected the fork-reachability comment for the scheduled/dispatch triggers.
Guard check-changes, stage-ai-gateway, and kilo-mcp-release so the deploy-production comment holds for every job, and restore the base_sha requirement in deploy-workers now that the staging caller passes one. Agent-Signature: kilo-kilo-auto/efficient-unknown-reasoning on behalf of matt wilkie
Closes #6248
Summary
Add a job-level
if: github.repository == 'Kilo-Org/cloud'guard to every fork-triggerable privileged workflow listed in issue #6248, so forks with Actions enabled cannot trigger deploys, releases, migrations, container pushes, or shared-state automation.Guarded (all 17 files from the issue)
Notes
pull_request/pull_request_targetevents,github.repositoryis already the base repo, so the guard is a no-op there and only blocks the fork-triggerable paths (workflow_dispatch,schedule).promote-vercel-deployment.yml,stage-vercel-deployment.yml,deploy-workers.yml) are guarded on both the caller job and the called workflow's own job, so they cannot run outside the canonical repo even if a caller skips its guard.Kilo-Org/kilocode.github/workflows/auto-docs.yml.yaml.safe_load.ci.yml,extension-ci.yml,kilo-app-ci.yml,mobile-native-build.yml,chromatic.yml,trufflehog.yml.Out of scope (flagged for follow-up)
cloud-agent-e2e-deploy.ymlandcloud-agent-e2e-tests.ymlareworkflow_dispatch-triggered and use admin secrets (CLOUDFLARE_API_TOKEN,FAKE_LLM_ADMIN_TOKEN,E2E_INTERNAL_API_SECRET). They are not in the issue's guarded or unguarded lists, so they are left untouched here; please add them to the issue if they should be guarded.kilo-mcp-catalog.yml'scatalog-prjob doescontents: writeon same-repo PRs but ispull_request-only (guard would be a no-op). Not in either list; suggested for the issue's unguarded list.