Repository navigation
Preserve pinned source closure and resolve governance findings - #652
Conversation
Adopt published standards ea2f4d8 and supported gh-actions-lock scope. Only two setup paths; reader proposal excluded.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
hyperpolymath
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| auto-merge-prs: | ||
| name: Auto-merge qualifying PRs | ||
| permissions: | ||
| contents: write |
hyperpolymath
changed the title
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a070e1e7b7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| printf '%s %s\n' ab28a1bdb54db4d5d8ad5981cf1f959410370b3d28250dbd35f6a44248620e39 "$archive" | sha256sum -c - | ||
| tar -xzf "$archive" -C "$RUNNER_TEMP" | ||
| "$RUNNER_TEMP/cargo-audit-x86_64-unknown-linux-gnu-v0.22.2/cargo-audit" audit --file tools/workflow-lock-audit/Cargo.lock --deny warnings | ||
| - name: Test workflow lock-map and regeneration audit |
There was a problem hiding this comment.
Replacing the PyYAML installation with this step removes a prerequisite that is still used later: tests/e2e.sh:170 executes import yaml for every workflow, and .github/workflows/labels.yml:12 explicitly documents that PyYAML is not preinstalled on GitHub runners. On a clean ubuntu-latest image without that module, every parse attempt is therefore counted as a failure and the E2E job fails; retain the installation or migrate that validation before removing it.
Useful? React with 👍 / 👎.
| (.uses|type=="array") and all(.uses[]; (.kind=="step" or .kind=="job") and (.ref|type=="string" and length>0))) and | ||
| ([.sources[]|[(.repository|ascii_downcase),.commit,.path]]|length)==([.sources[]|[(.repository|ascii_downcase),.commit,.path]]|unique|length) and | ||
| all(.dependencies|to_entries[]; | ||
| (.key|test("^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*@[^[:space:]@]+$")) and |
There was a problem hiding this comment.
The tracked sources all declare content_sha256, and this script even requires sha256sum, but the schema only validates the Git blob SHA-1 and the extracted bytes are never compared with content_sha256. Consequently the field can be omitted or replaced with arbitrary text while the verifier still reports the source as authenticated, so the SHA-256 evidence claimed in docs/migrations/pinned-source-closure.adoc is not actually enforced; require a 64-hex digest here and compare it with the extracted blob before accepting the source.
Useful? React with 👍 / 👎.
| } | ||
| ], | ||
| "source_url": "https://github.com/metadatastician/standards/blob/ea2f4d8a886585ed442687ae63d4ad7493379ba4/.github/workflows/governance-reusable.yml", | ||
| "local_file": "C:\\Users\\sudoodle\\OneDrive\\Documents\\ChatGPT\\TYPE THEORY\\echo-reader-compat-20261106\\closure-cycle-20261107\\sources\\metadatastician\\standards\\ea2f4d8a886585ed442687ae63d4ad7493379ba4\\.github\\workflows\\governance-reusable.yml" |
There was a problem hiding this comment.
This field publishes a contributor's Windows username and private OneDrive directory structure in the repository, and the same absolute path metadata is repeated for every source. The verifier never consumes local_file, while docs/migrations/pinned-source-closure.adoc:167-171 explicitly says local absolute paths are not presented as downloadable artifacts; remove these collection-machine paths before publishing the manifest.
Useful? React with 👍 / 👎.
| if(match(line,/^[[:space:]]*(-[[:space:]]+)?["\047]?uses["\047]?[[:space:]]*:/)){ | ||
| head=substr(line,1,RLENGTH);kind=(head~/-/||(steps&&ind>si))?"step":"job";raw=uncomment(substr(line,RLENGTH+1));sub(/^[[:space:]]+/,"",raw);sub(/[[:space:]]+$/,"",raw) |
There was a problem hiding this comment.
This pattern treats every indented key named uses as an action or reusable-workflow reference without checking its YAML parent. A valid action step or reusable-workflow job can have an input named uses under its with: mapping; in that case this reader invents an extra dependency, and the source audit returns SOURCE-PIN, SOURCE-LOCAL, or an edge mismatch even though the workflow is valid. Track the job/step and with indentation so only jobs.<id>.uses and jobs.<id>.steps[*].uses are emitted.
Useful? React with 👍 / 👎.
This change preserves source-attested reusable-workflow closure and resolves the nine governance findings without policy waivers.
Released gh-actions-lock v0.4.1 does not lock external job-level reusable workflows. A separate gate binds five active caller/job pairs to immutable repository/commit/path/blob identities, authenticates raw Git objects in an isolated bare cache, and compares observed direct edges with reviewed receipt unions. Fetched code is never executed. Missing evidence is nonzero NOT-RUN; contradictory identities and dropped edges are fatal. Two explicitly historical source paths preserve the original standards75bd union and cannot substitute for active callers.
All 20 original ordinary lock records, 10 supplemental records, 13 original receipt rows and six newer governance receipt rows are preserved. Supplemental records are admitted only after complete source verification. The published governance caller stays pinned to standards ea2f4d8a886585ed442687ae63d4ad7493379ba4. At the source-verification checkpoint, Fleet #651 and standards #1419 were separate drafts. Both subsequently merged through the concurrent owner operation described below. The source job remains an explicit E2E prerequisite with failure/skipped/cancelled/missing results rejected; no branch ruleset or baseline is changed.
The governance follow-up removes the four prohibited Python auditor/test files and replaces them with an isolated Rust CLI plus Bash entrypoints. It preserves map and regeneration exit semantics, strict input validation, transitive closure comparison, source-scope limitations and all original regression controls. The parser is saphyr 0.3.3; the abandoned unsafe-libyaml dependency is absent. CI audits the exact crate lock with cargo-audit 0.22.2, verifies the release archive SHA256, and denies warnings without advisory exclusions.
The four credential-bearing workflow jobs now run harden-runner at 46b06cea07f9e64621fdf066ba77ac6915163d43. Dispatch and SMTP jobs use explicit egress block rules; scheduled fleet scans use audit mode pending endpoint observations. Inbox write permissions are scoped to the existing auto-merge job, and its already-produced outputs are declared for downstream consumers. Existing triggers, guards, needs, steps and concurrency are preserved. No mail or dispatch was manually sent to test these rules.
Official lock regeneration rewrites bare SHA uses to known tags. The final lock therefore preserves the reviewed records verbatim and imports only the officially generated hardener metadata under its authoritative SHA key, plus four workflow edges. Both official read-only --verify-local and authenticated --verify pass. The tag v2.22.3 resolves to that SHA, although the upstream commit message says v2.23.0; the SHA is authoritative.
Local validation at signed head e911e68 (tree 8019b4d07da0c96f9072a677e67b9d093ea146a5):
The final signed follow-up is a070e1e (reviewed tree 8eaf15863039c90b6a5d3fae91a8efdc405f3133). It passes 42 native Rust tests on Rust/Cargo 1.85.1, addresses Sonar’s control-flow, HTTPS-redirect and read-permission findings, and closes two independently reproduced parser fail-open batches. All 11 bare numeric/malformed-radix forms reject, and all 11 quoted counterparts remain accepted; the immutable regeneration controls pass again. Conservative additional rejections of ambiguous plain strings are documented rather than presented as exact acceptance parity. No dependency lock, source identity or receipt data changed in this follow-up. On this final head, all nine distinct required contexts pass. Hosted source closure records 55/47/9 passed controls with zero failures, and the integrated audit retains fatal=0, review=0, not-run=0, accepted=3 and source-attested-records=11. E2E, SonarCloud, governance baseline/language policy, action-lock verification, K9 and DEED pass. The report-back production job also completed successfully on that reviewed head; the Scorecard app alert below remains recorded. No all-CI-green claim is made.
Scorecard’s app check flags contents:write on the existing opt-in auto-merge job. That permission is scoped to the guarded job and required by its existing merge API and merge-result git push; GitHub’s merge endpoint documentation confirms the contents-write requirement. The default-off guard and merge criteria remain unchanged. The alert remains open for owner review; no suppression, broader PAT or feature deletion was substituted. The distinct Actions Scorecard PR job passes on the final head. CodeRabbit skipped automatic review during the coordinated draft phase; that skip is not counted as a completed review. The scanner migration preflight still requires canary evidence and exits 2 without it. The native en_GB.UTF-8 report-back ordering fixture issue was reproduced on unchanged base and prior candidate and remains separate. Static egress review does not establish successful SMTP or dispatch runtime behavior.
Scope and reproducible commands are documented in docs/migrations/pinned-source-closure.adoc and tools/workflow-lock-audit/README.adoc. This proves the stated direct-edge/receipt boundary, not arbitrary recursive runtime/container/downloaded-script provenance. No exemptions, credentials, rulesets, mirror activation or ordinal work are included. The coordinated work kept this PR draft through verification of a070e1e. A separate operation under the owner account marked it ready at 11:46:49 UTC, merged main into the branch as 9ad13bc, then merged this PR as c1d8754 at 11:47:21 UTC. The owner subsequently confirmed that merge was intentional and requested verification. The incoming main changes affect only four finishingbot analyzer files; the reviewed audit, workflow, lock and receipt files are unchanged. The combined tree is bd62426860a4696353850c8d7620719350b359d4, so earlier whole-tree results remain attributed to a070e1e.
Post-merge verification: E2E/source closure, Governance, Hypatia, CodeQL, Lock Sync and Dogfood pass. Rhodibot’s canon-drift guard correctly rejects the upstream capability table: standards fe57d352f0b1a50e5cb07b4aac2581caf355388e has table version 0.3.1/hash 5c510bba025be718deebb12d0333bfe7db2da43c66578b728b1a334df65290b1, but its canon.lock still pins 2f31f46d4753432e0aa8c9c28f339e18e062c98dc6e6ef4ecbb76993cf37638b. A Fleet-only repin would fail the next lock consistency check. The follow-up is a coordinated spine/canon release, then a reviewed Fleet repin; no drift gate was weakened. Five mirror jobs fail on destination/access or missing approved SSH fingerprints, without evidence of an audit-parser regression. No mirror activation, credential change, baseline waiver or rollback was performed.
The main-branch Sonar analysis also exposed an older shell:S6506 issue in the optional panic-rule upstream fetch. The one-line HTTPS/redirect correction merged separately in #653 as 46d26a4 after all nine required checks and CodeRabbit’s completed review passed. The main-branch Sonar gate now passes. The independent canon-release and mirror-configuration blockers remain.