[ci] Separate testing from privileged publication - #3513
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3513 +/- ##
=======================================
Coverage 91.85% 91.85%
=======================================
Files 20 20
Lines 6093 6093
=======================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 305a98b058
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if not events.intersection(_UNTRUSTED_EVENTS): | ||
| return [] |
There was a problem hiding this comment.
When a pull_request or merge_group workflow omits permissions entirely, this path returns only the collected explicit permission issues, so the checker accepts it. GitHub then applies the organization or repository's default GITHUB_TOKEN permissions; where that default is read/write, a same-repository PR can execute proposed code with write authority, defeating the guard's stated purpose. Require an explicit workflow-level permissions: {} or read-only mapping for every untrusted workflow instead of treating absence as safe.
Useful? React with 👍 / 👎.
| retention-days: 1 | ||
| archive: false | ||
| overwrite: true |
There was a problem hiding this comment.
When the release environment requires manual approval and approval arrives more than a day after the matrix finishes, these toolchain archives—and the metadata artifacts configured the same way below—have already expired because their retention is only one day. The gated publish-release-assets job then cannot download its required inputs, so an otherwise successful multi-platform release must be rebuilt and reapproved; retain these artifacts for at least the maximum expected approval delay.
Useful? React with 👍 / 👎.
| uses: ./.github/actions/upload-file-artifact | ||
| with: | ||
| name: CI Durations | ||
| tool: 'customSmallerIsBetter' | ||
| output-file-path: output.json | ||
| gh-pages-branch: benchmark-data | ||
| auto-push: true | ||
| save-data-file: true | ||
| benchmark-data-dir-path: dashboard | ||
| fail-on-alert: false | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| name: ${{ env.ANNEAL_BENCHMARK_ARTIFACT }} | ||
| path: ${{ env.ANNEAL_BENCHMARK_ARTIFACT }} |
There was a problem hiding this comment.
When one CI workflow succeeds but the other is repaired by a rerun more than 24 hours later, docs.yml deliberately selects the original successful Anneal run, but this composite uploader hard-codes retention-days: 1; the benchmark download therefore fails and blocks the repaired documentation deployment. Use a longer-lived artifact for this cross-workflow contract or make the benchmark publisher tolerate an expired benchmark input.
Useful? React with 👍 / 👎.
e166a02 to
43998f3
Compare
0be71f6 to
a49d29d
Compare
43998f3 to
df82b8b
Compare
Same-repository PRs previously gave the core image builder package-write authority, and Anneal tests received repository-write authority only to store timing data. Make both producers read-only. Publish the Docker cache from a successful default-branch workflow and validated benchmarks from the trusted docs coordinator. Add a semantic workflow check which rejects any write-capable GITHUB_TOKEN in pull-request or merge-group workflows. This makes the trust boundary a repository invariant instead of a job convention. Split manual Anneal toolchain releases into immutable source resolution, unprivileged patch and archive production, trusted artifact review, release publication, and PR submission. Validate the archive set, metadata, hashes, URLs, sizes, release target, and final patch at each boundary. No job which executes selected-branch code receives a write credential. Make asset publication resumable: reuse a correctly targeted draft, accept matching assets, repair missing draft assets, and reject any mismatch before publishing the prerelease and opening its release PR. gherrit-pr-id: Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq
df82b8b to
a06310f
Compare
2 participants
Same-repository PRs previously gave the core image builder
package-write authority, and Anneal tests received repository-write
authority only to store timing data. Make both producers read-only.
Publish the Docker cache from a successful default-branch workflow and
validated benchmarks from the trusted docs coordinator.
Add a semantic workflow check which rejects any write-capable
GITHUB_TOKEN in pull-request or merge-group workflows. This makes the
trust boundary a repository invariant instead of a job convention.
Split manual Anneal toolchain releases into immutable source
resolution, unprivileged patch and archive production, trusted artifact
review, release publication, and PR submission. Validate the archive
set, metadata, hashes, URLs, sizes, release target, and final patch at
each boundary. No job which executes selected-branch code receives a
write credential.
Make asset publication resumable: reuse a correctly targeted draft,
accept matching assets, repair missing draft assets, and reject any
mismatch before publishing the prerelease and opening its release PR.
Latest Update: v7 — Compare vs v6
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq && git checkout -b pr-Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq FETCH_HEADCheckout
git fetch origin refs/heads/Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/Grlosy5kwxiwxexwdtdxzx7i2ezmymtrq && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.