[ci] Make typed workflow bridges fail closed - #3592
Conversation
10284fa to
a565eff
Compare
f90984d to
4f0c3e7
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
a565eff to
7de4caa
Compare
4f0c3e7 to
2a757e8
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Gquoamyb32c2czjlzvvkel27kkqeg2tid #3592 +/- ##
====================================================================
Coverage ? 91.85%
====================================================================
Files ? 20
Lines ? 6093
Branches ? 0
====================================================================
Hits ? 5597
Misses ? 496
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2a757e8 to
b0f94a4
Compare
7de4caa to
c86ea11
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
c86ea11 to
cc272d2
Compare
af342b3 to
9db9a59
Compare
cc272d2 to
a8c747b
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
9db9a59 to
fdd6633
Compare
a8c747b to
0c3cbdc
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Derive Miri job eligibility from the projected matrix instead of repeating the event policy in workflow YAML. Publish the same gate to the required-check aggregate so policy changes cannot select work that the workflow silently skips. Run the planner with an absolute privileged Bash, neutralized startup controls, and a command-local fixed PATH. Invoke an explicit child Bash so the cargo wrapper cannot select an ambient interpreter. Run typed cells with absolute Docker, a fixed /bin/bash entrypoint, privileged no-startup arguments, and an option terminator. Use absolute jq in the final gate. These bridges now fail if PATH, image startup state, or Bash startup state attempts to replace their commands. This changes transport and eligibility wiring, not selected coverage: pull requests still run 60 build and zero Miri cells. Full events still run 182 build cells and 64 Miri cells. Tests: offline zc tests Tests: ci/check_actions.sh Tests: cargo fmt --check Tests: git diff --check *Authored by an agent, posting via joshlf's account* gherrit-pr-id: Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc
fdd6633 to
7691bbf
Compare
0c3cbdc to
06f0401
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Derive Miri job eligibility from the projected matrix instead of
repeating the event policy in workflow YAML. Publish the same gate to
the required-check aggregate so policy changes cannot select work that
the workflow silently skips.
Run the planner with an absolute privileged Bash, neutralized
startup controls, and a command-local fixed PATH. Invoke an explicit
child Bash so the cargo wrapper cannot select an ambient interpreter.
Run typed cells with absolute Docker, a fixed /bin/bash entrypoint,
privileged no-startup arguments, and an option terminator. Use absolute
jq in the final gate. These bridges now fail if PATH, image startup
state, or Bash startup state attempts to replace their commands.
This changes transport and eligibility wiring, not selected
coverage: pull requests still run 60 build and zero Miri cells. Full
events still run 182 build cells and 64 Miri cells.
Tests: offline zc tests
Tests: ci/check_actions.sh
Tests: cargo fmt --check
Tests: git diff --check
Authored by an agent, posting via joshlf's account
Latest Update: v13 — Compare vs v12
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc && git checkout -b pr-Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc FETCH_HEADCheckout
git fetch origin refs/heads/Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.