Sync upstream Silo-Server/silo-server (181 commits)

.githooks/pre-commit

@@ -3,4 +3,7 @@ set -euo pipefail
 
 # Resolve via git toplevel so the hook works from any cwd (e.g., when
 # git invokes hooks from within a non-root subdirectory).
-"$(git rev-parse --show-toplevel)/scripts/check-local-path-leaks.sh" --cached
+repo_root="$(git rev-parse --show-toplevel)"
+
+"$repo_root/scripts/check-local-path-leaks.sh" --cached
+"$repo_root/scripts/check-go-lint.sh" --cached

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+# These five trusted-tool checkouts use job.workflow_sha, which the runner
+# provides but actionlint 1.7.12 does not yet include in its job context model.
+paths:
+  .github/workflows/trusted-linux-ci.yml:
+    ignore:
+      - '^property "workflow_sha" is not defined in object type \{check_run_id: number; container: \{id: string; network: string\}; services: \{string => \{id: string; network: string; ports: \{string => string\}\}\}; status: string\}$'

.github/actions/ci-tools/go-checks.mk

@@ -3,7 +3,7 @@
 # tests, each job on its own runner.
 # LINT_BASE_REF, LINT_BASE_MODE, CONTRACT_BASE_REF, and TEST_GOFLAGS come from
 # the workflow.
-.PHONY: lint contracts tests
+.PHONY: lint contracts tests test-dependencies
 
 # Router recovery must hold over the whole tree, including inherited lines.
 lint:
@@ -17,14 +17,28 @@ contracts:
 	$(MAKE) -j1 -f Makefile verify-settings-bindings verify-playback-fixtures verify-route-inventory
 	$(MAKE) -j1 -f Makefile verify-migration-ledger verify-apiv2-openapi CONTRACT_GO_TESTS=0
 	git fetch --no-tags origin "+refs/heads/$${CONTRACT_BASE_REF}:refs/remotes/origin/$${CONTRACT_BASE_REF}"
+	$(MAKE) -j1 -f Makefile verify-v1-route-freeze BASE_REF="origin/$${CONTRACT_BASE_REF}"
 	$(MAKE) -j1 -f Makefile verify-apiv2-contract CONTRACT_GO_TESTS=0 BASE_REF="origin/$${CONTRACT_BASE_REF}"
 
 # Go's test cache cannot see files a test's child process reads, so these
 # packages always rerun; the grep fails when a new test starts go, git, or node
 # outside them or the packages whose subprocess inputs are immutable.
-UNCACHED := cmd/prairie internal/jellycompat internal/pluginhost internal/plugins
+UNCACHED := cmd/prairie internal/jellycompat internal/pluginhost internal/plugins scripts/ci/sizeratchet scripts/ci/migrationcheck
+# subprocess-manifest: scripts/ci/subprocess-tests.json
+# deferred: no recorded occurrence; retain UNCACHED and the subprocess guard.
 IMMUTABLE := internal/contractledger internal/contractspec internal/debugserver
-tests:
+test-dependencies:
+	@variants="$$(go list -deps -test -f '{{.ImportPath}}|{{.ForTest}}' ./internal/auth/ ./internal/api/handlers/)" || exit $$?; \
+	[ -n "$$variants" ] || { echo "::error::test dependency metadata is empty"; exit 1; }; \
+	printf '%s\n' "$$variants" | awk -F '|' '\
+	  $$2 != "" { split($$1, name, " "); \
+	    if ((name[1] == "github.com/prairie-server/prairie-server/internal/api/handlers" || \
+	         name[1] == "github.com/prairie-server/prairie-server/internal/apiv2") && name[1] != $$2) { \
+	      print "::error::lower-layer external test recompiles " $$0; bad=1 \
+	    } \
+	  } END { exit bad }'
+
+tests: test-dependencies
 	GOFLAGS="$${TEST_GOFLAGS}" $(MAKE) -f Makefile test-go
 	@want="$$(printf '%s\n' $(UNCACHED) $(IMMUTABLE) | sort -u)"; \
 	got="$$(git grep -l -E '(exec\.Command(Context)?\(([^,]+, )?"(go|git|node)"|LookPath\("(go|git|node)"\))' -- '*_test.go' | sed 's@/[^/]*$$@@' | sort -u)"; \

.github/actions/ci-tools/select-jobs.py

@@ -14,6 +14,12 @@
 # Run on every event regardless of what the diff touched.
 ALWAYS_JOBS = ("repo-checks",)
 SHA = re.compile(r"[0-9a-fA-F]{40}\Z")
+# These are embedded by contracts/api/v2 and consumed by the Go ledger,
+# scenario and compatibility gates. Web generation consumes openapi/fixtures.
+GO_ONLY_CONTRACTS = frozenset("contracts/api/v2/" + name for name in (
+    "migration.json", "migration.schema.json", "offline-routes.txt",
+    "breaking-approvals.json", "breaking-approvals.schema.json",
+))
 
 
 def all_jobs(reason):
@@ -29,6 +35,16 @@ def classify(paths):
         if (not parts or path.startswith("/") or ".." in parts
                 or any(ord(char) < 32 for char in path)):
             return all_jobs("unrecognized path")
+        if (path == ".github/evidence.yml"
+                or (path.startswith(".github/ISSUE_TEMPLATE/") and path.endswith((".yml", ".yaml", ".md")))
+                or (path.endswith(".md") and path.startswith((".github/", "scripts/", "cmd/")))):
+            continue
+        if (path in GO_ONLY_CONTRACTS
+                or path in {"scripts/ci/db-pins.txt", "scripts/ci/db-contracts.txt"}
+                or (path.startswith("internal/apiv2/") and path.endswith(".go"))
+                or (path.startswith("cmd/") and not path.startswith("cmd/settingsgen/"))):
+            go = True
+            continue
         # These feed both generated Go artifacts and their Web bindings, or
         # change how validation runs. Keep the entire gate for them.
         # Schemas under docs include executable fixtures whose tests glob all
@@ -90,7 +106,9 @@ def plan(event_name, event):
         # count a rename once, so a larger local count is still complete.
         if len(paths) < count:
             return all_jobs("incomplete changed-file count")
-        return classify(paths)
+        result = classify(paths)
+        result["paths"] = paths
+        return result
     except (KeyError, TypeError, ValueError, UnicodeError, OSError, subprocess.CalledProcessError):
         return all_jobs("PR comparison unavailable")
 
@@ -120,10 +138,20 @@ def main():
     if len(sys.argv) != 2 or sys.argv[1] not in {"plan", "check"}:
         raise SystemExit("expected plan or check")
     if sys.argv[1] == "check":
-        errors = check_results(json.loads(os.environ["CI_JOB_RESULTS"]))
+        needs = json.loads(os.environ["CI_JOB_RESULTS"])
+        errors = check_results(needs)
         if errors:
+            cancelled_jobs = sorted(job for job, outcome in needs.items()
+                                    if outcome.get("result") == "cancelled")
+            if cancelled_jobs:
+                print("Cancelled CI jobs: " + ", ".join(cancelled_jobs))
             for error in errors:
                 print("::error::" + error)
+            # A distinct nonzero status preserves cancellation evidence without
+            # turning an unexpectedly cancelled required child into success.
+            if cancelled_jobs and all(error.endswith(" ended with cancelled")
+                                      for error in errors):
+                return 2
             return 1
         print("Every selected CI job passed.")
         return 0

.github/actions/ci-tools/test_select_jobs.py

@@ -8,6 +8,7 @@
 import json
 import os
 from pathlib import Path
+import shutil
 import subprocess
 import sys
 import tempfile
@@ -119,6 +120,18 @@ def test_understood_inputs_choose_only_required_groups(self):
             ("pkg/client/client.go", True, False),
             ("example.go", True, False),
             ("docs/example.go", True, False),
+            ("internal/apiv2/registry.go", True, False),
+            ("internal/apiv2/registry_test.go", True, False),
+            ("cmd/prairie/main.go", True, False),
+            ("scripts/ci/db-pins.txt", True, False),
+            ("scripts/ci/db-contracts.txt", True, False),
+            ("contracts/api/v2/migration.json", True, False),
+            ("contracts/api/v2/migration.schema.json", True, False),
+            ("contracts/api/v2/offline-routes.txt", True, False),
+            ("contracts/api/v2/breaking-approvals.json", True, False),
+            (".github/actions/README.md", False, False),
+            (".github/evidence.yml", False, False),
+            (".github/ISSUE_TEMPLATE/bug-report.yml", False, False),
         ]
         for number, (path, go, web) in enumerate(cases):
             with self.subTest(path=path):
@@ -133,13 +146,11 @@ def test_understood_inputs_choose_only_required_groups(self):
     def test_shared_generation_and_validation_inputs_require_both_groups(self):
         cases = [
             ".github/workflows/ci.yml",
-            ".github/actions/README.md",
             "scripts/check-local-path-leaks.sh",
             "contracts/api/v2/openapi.json",
             "contracts/api/v2/README.md",
             "contracts/settings/v1/conformance.json",
             "tools/generate.py",
-            "internal/apiv2/registry.go",
             "internal/apiv2/docsui/LICENSE",
             "internal/settingscontract/contract.go",
             "cmd/settingsgen/main.go",
@@ -164,6 +175,11 @@ def test_shared_generation_and_validation_inputs_require_both_groups(self):
                 self.repo.commit()
                 self.assert_groups(self.repo.plan(), True, True)
 
+    def test_plan_reports_triggering_paths(self):
+        self.repo.write("internal/apiv2/registry.go")
+        self.repo.commit()
+        self.assertEqual(self.repo.plan().get("paths"), ["internal/apiv2/registry.go"])
+
     def test_markdown_inside_schema_inputs_is_not_skipped_as_documentation(self):
         for path in (
             "docs/design/schemas/README.md",
@@ -517,6 +533,153 @@ def test_check_cli_returns_failure_and_identifies_the_failed_job(self):
                 if failed:
                     self.assertIn("::error::go-integration ended with failure", run.stdout)
 
+    def test_check_cli_distinguishes_cancelled_children_from_failures(self):
+        needs = self.results()
+        needs["go-test"]["result"] = "cancelled"
+        run = subprocess.run(
+            [sys.executable, str(SCRIPT), "check"], capture_output=True, text=True,
+            env=dict(os.environ, CI_JOB_RESULTS=json.dumps(needs)),
+        )
+        self.assertEqual(run.returncode, 2, run.stdout + run.stderr)
+        self.assertIn("Cancelled CI jobs: go-test", run.stdout)
+        self.assertNotIn("Every selected CI job passed", run.stdout)
+        needs["web"]["result"] = "failure"
+        run = subprocess.run(
+            [sys.executable, str(SCRIPT), "check"], capture_output=True, text=True,
+            env=dict(os.environ, CI_JOB_RESULTS=json.dumps(needs)),
+        )
+        self.assertEqual(run.returncode, 1, run.stdout + run.stderr)
+        self.assertIn("web ended with failure", run.stdout)
+
+
+class WorkflowGateTests(unittest.TestCase):
+    root = SCRIPT.parents[3]
+
+    def pin_script(self):
+        workflow = (self.root / ".github/workflows/trusted-linux-ci.yml").read_text()
+        marker = "      - name: Check action SHA pins\n"
+        self.assertIn(marker, workflow, "Repository checks must enforce immutable actions")
+        step = workflow.split(marker, 1)[1].split("      - ", 1)[0]
+        script = step.split("        run: |\n", 1)[1]
+        return "\n".join(line[10:] for line in script.splitlines() if line.strip())
+
+    def test_pin_gate_rejects_nested_mutable_and_malformed_references(self):
+        script = self.pin_script()
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            for reference in ("actions/cache@v4", "owner/repo/workflow.yml@main",
+                              "actions/checkout@" + "a" * 39,
+                              "actions/checkout@" + "z" * 40):
+                with self.subTest(reference=reference):
+                    repo.write(".github/actions/nested/action.yml", "steps:\n  - uses: " + reference + "\n")
+                    repo.commit()
+                    run = subprocess.run(["bash", "-c", script], cwd=repo.path,
+                                         capture_output=True, text=True)
+                    self.assertNotEqual(run.returncode, 0, run.stdout + run.stderr)
+                    self.assertIn(reference, run.stdout + run.stderr)
+
+    def check_pin_fixture(self, step, expected):
+        workflow = ("name: pins\non: push\npermissions: {}\njobs:\n  test:\n"
+                    "    runs-on: ubuntu-24.04\n    steps:\n"
+                    "      - uses: actions/checkout@" + "a" * 40 + "\n"
+                    "      " + step + "\n")
+        if shutil.which("actionlint"):
+            valid = subprocess.run(["actionlint", "-oneline", "-"], input=workflow,
+                                   cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(valid.returncode, 0, valid.stdout + valid.stderr)
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            repo.write(".github/workflows/test.yml", workflow)
+            repo.commit()
+            run = subprocess.run(["bash", "-c", self.pin_script()], cwd=repo.path,
+                                 capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected,
+                             f"{step}: gate returned {run.returncode}, want {expected}\n"
+                             + run.stdout + run.stderr)
+
+    def test_pin_gate_rejects_flow_mapping(self):
+        self.check_pin_fixture("- { uses: actions/checkout@v4 }", 1)
+
+    def test_pin_gate_rejects_quoted_key(self):
+        self.check_pin_fixture('- "uses": actions/checkout@v4', 1)
+
+    def test_pin_gate_accepts_flow_mapping_without_uses(self):
+        self.check_pin_fixture("- run: echo ok\n        env: { A: b }", 0)
+
+    def test_pin_gate_accepts_pinned_block_mapping(self):
+        self.check_pin_fixture("- uses: actions/checkout@" + "b" * 40, 0)
+
+    def check_workflow_pin_fixture(self, reference, expected):
+        workflow = ("name: pins\non: push\npermissions: {}\njobs:\n  test:\n"
+                    "    uses: " + reference + "\n")
+        if shutil.which("actionlint"):
+            valid = subprocess.run(["actionlint", "-oneline", "-"], input=workflow,
+                                   cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(valid.returncode, 0, valid.stdout + valid.stderr)
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            repo.write(".github/workflows/test.yml", workflow)
+            repo.commit()
+            run = subprocess.run(["bash", "-c", self.pin_script()], cwd=repo.path,
+                                 capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected,
+                             f"{reference}: gate returned {run.returncode}, want {expected}\n"
+                             + run.stdout + run.stderr)
+
+    def test_pin_gate_accepts_same_repository_workflows_at_main(self):
+        for filename in ("trusted-linux-ci.yml", "another-workflow.yaml"):
+            with self.subTest(filename=filename):
+                self.check_workflow_pin_fixture(
+                    "Prairie-Server/prairie-server/.github/workflows/" + filename + "@main", 0)
+
+    def test_pin_gate_rejects_other_repository_workflows_at_main(self):
+        for repository in ("another-owner/prairie-server", "Prairie-Server/another-repo"):
+            with self.subTest(repository=repository):
+                self.check_workflow_pin_fixture(
+                    repository + "/.github/workflows/trusted-linux-ci.yml@main", 1)
+
+    def test_pin_gate_rejects_same_repository_workflows_at_other_refs(self):
+        for ref in ("feature", "v1.0.0"):
+            with self.subTest(ref=ref):
+                self.check_workflow_pin_fixture(
+                    "Prairie-Server/prairie-server/.github/workflows/trusted-linux-ci.yml@" + ref, 1)
+
+    def test_pin_gate_accepts_immutable_and_local_references(self):
+        script = self.pin_script()
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            repo.write(".github/workflows/test.yml", "steps:\n  - uses: actions/checkout@" + "a" * 40 + " # reviewed release\n  - uses: ./.github/actions/setup-go\n")
+            repo.write(".github/actions/nested/action.yml", "steps:\n  - uses: ./.github/actions/local\n")
+            repo.commit()
+            run = subprocess.run(["bash", "-c", script], cwd=repo.path,
+                                 capture_output=True, text=True)
+            self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+            run = subprocess.run(["bash", "-c", script], cwd=directory,
+                                 capture_output=True, text=True)
+            self.assertNotEqual(run.returncode, 0, "A missing Git input must fail")
+
+    def test_full_tree_tool_targets_exist(self):
+        run = subprocess.run(["make", "-n", "verify-actionlint", "verify-shellcheck"],
+                             cwd=self.root, capture_output=True, text=True)
+        self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+        self.assertIn("1.7.12", run.stdout)
+        self.assertIn("0.11.0", run.stdout)
+
+    def test_workflow_and_shell_tools_reject_seeded_defects(self):
+        missing = [tool for tool in ("actionlint", "shellcheck") if not shutil.which(tool)]
+        if missing:
+            self.skipTest("required tools not on PATH: " + ", ".join(missing))
+        workflow = "name: test\non: push\njobs:\n  test:\n    runs-on: ubuntu-24.04\n    steps:\n      - run: echo ok\n"
+        for contents, expected in ((workflow, 0), (workflow.replace("echo ok", "echo ${{ unknown.value }}"), 1)):
+            run = subprocess.run(["actionlint", "-oneline", "-"], input=contents,
+                                 cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected, run.stdout + run.stderr)
+        for contents, expected in (("#!/bin/bash\nprintf '%s\\n' \"$1\"\n", 0),
+                                   ("#!/bin/bash\nprintf '%s\\n' $1\n", 1)):
+            run = subprocess.run(["shellcheck", "-s", "bash", "-"], input=contents,
+                                 cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected, run.stdout + run.stderr)
+
 
 if __name__ == "__main__":
     unittest.main()

.github/actions/save-go-cache/action.yml

@@ -23,16 +23,18 @@ inputs:
 runs:
   using: composite
   steps:
+    # if: !cancelled() && inputs.job-status != 'cancelled'
+    # Declined for compiled-cache saving: failed main runs keep the success-only policy.
     - name: Prune unused Go build cache entries
-      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request'
+      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request' && github.event_name != 'schedule'
       shell: bash
       run: |
         cache_dir="$(go env GOCACHE)"
         find "$cache_dir" -mindepth 2 -maxdepth 2 \( -name '*-a' -o -name '*-d' \) ! -newermt '@0' -exec rm -rf -- {} +
 
     - name: Save the Go build cache
-      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request'
-      uses: actions/cache/save@v4
+      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request' && github.event_name != 'schedule'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/go-build
         key: ${{ inputs.cache-key }}
@@ -46,7 +48,7 @@ runs:
 
     - name: Save the shared Go module cache
       if: ${{ !cancelled() && inputs.job-status != 'cancelled' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request' && inputs.module-cache-key != '' && inputs.module-cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/go/pkg/mod
         key: ${{ inputs.module-cache-key }}