Repository navigation
CRW-964: local full verification and its verification record - #884
Merged
Merged
Conversation
crw-dev ci local runs every job and step of .github/workflows/ci.yml locally, in the same order and at the same pinned versions, in a clean worktree of the commit being verified with an isolated home and TZ=UTC, and writes a verification-record/1. --reuse answers a record instead of running only when the tree, the ci.yml digest, the tool versions, the dependency digests and the OS and architecture all match. A pre-push hook refuses a push whose range carries a secret or a blob over 2 MiB. - internal/dev/ci/local_plan.go: the step table and the ci.yml reader that holds it to the workflow, so a step ci.yml grows cannot go unverified. - internal/dev/ci/local.go: the command, the clean worktree, the step environment, the heavy gate and the engine. - internal/dev/ci/local_record.go: verification-record/1, its canonical digest and reuse. - internal/dev/ci/local_tools.go: the pinned and observed tool versions and pin_mismatch. - internal/dev/ci/local_hook.go: the pre-push hook. - Makefile: the ci-local target. docs/CI.md: the local-step-to-GitHub-job mapping.
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
localHookMarker, localBlobLimit and localGitleaksEnv are named in the hook script's own text, not in Go, and localDigestOfFile was left behind by an earlier shape of the record. The hosted lint leg (staticcheck U1000) caught all four.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bcbd3ecef4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… as argv The first full local run (against a dev commit) caught this: concatenating the gate with the command into one shell string broke a run text that carries its own quotes (the validate step became an unquoted word, exit 127) and mangled a block scalar. The gate's words are now argv before bash -c, and the command stays one element. Also judge dev-gate's aggregate step from the jobs already recorded rather than passing it unconditionally.
Fixes the findings on the first head, all inside this issue's scope: - the YAML single quotes around a run scalar are removed by the workflow's parser, so the table carries the shell text and the reader unquotes it before comparing (P1). - the screen commands run in web/, as ci.yml's working-directory says (P1). - the base commit joins the reuse keys: the blob and secret steps judge base..head, so a different base is a different verification (P1). - the plan is held to the workflow of the verified commit, not the caller's working tree (P1). - a default base equal to the head is never chosen, so the range checks cannot judge nothing (P1). - the hook requires the pinned Gitleaks release (P1). - GOFLAGS and GOENV join the reuse keys, and the record names the repository (P1, P2). - the hook recognises a SHA-256 all-zero object id and an older hook this tool wrote (P2). - the two tools a step fetches (Gitleaks, staticcheck) are named from their pin when the host has no copy, so a normal checkout no longer reports a permanent pin mismatch (P2). - the sealed digest is printed (P2).
…ment The measured local run caught this: the heavy-check gate sits between the engine and bash, and systemd-run expands the arguments it is handed, so a command that uses a shell variable (the staged skill-script test run, whose file-count expression became a bare token) was mangled. The step's command is now written to a script under the run's own temporary root and run as bash <script>, so nothing between the two processes can touch its characters.
… fetched tools by pin
… in the run's home
… publish records atomically
… the steps' isolation, record the full base
… the Go version in the commit's module
…reuse against the plan, and keep the work root out of TMPDIR
…, peel the commit, and sealed version probes
…ocs' inherited variables
…acement refs, drop an unused variable, and let engine tests run their own work root
…ut instead of losing the run
…orktree that differs from the commit
…omputed reuse pins and recorded decisions
… the repository in reuse
…es in probes, never replace a symlinked hook
… own directory and environment, and scrub caller git variables
…not read, and resolve a relative heavy gate once
…e-less names distinct, document heavy-gate arguments
thisisjun786
added
the
crw-lane
thisisjun786
added
crw-lane
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.