[ci] Audit typed plan publication - #3593
Conversation
348b0f9 to
d0ff708
Compare
10284fa to
a565eff
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0ff708110
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
a565eff to
7de4caa
Compare
d0ff708 to
665458f
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc #3593 +/- ##
==================================================================
Coverage 91.85% 91.85%
==================================================================
Files 20 20
Lines 6093 6093
==================================================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
7de4caa to
c86ea11
Compare
665458f to
0949141
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 094914172a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0949141 to
e96e0b4
Compare
c86ea11 to
cc272d2
Compare
e96e0b4 to
9d34d33
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head. Treat earlier reviews of older commits as stale. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
cc272d2 to
a8c747b
Compare
9d34d33 to
e28ac83
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Load CI inputs only after plan_ci has the exact top-level job shape, display name, hosted runner, read-only permissions, planner environment, output map, and no needs or strategy. Require exactly the reviewed checkout, planner, and upload steps in that order, with their complete action pins, options, fields, and run block. Require the workflow's complete ordered root declaration grammar before auditing its environment. This rejects duplicate or alternate YAML key spellings and new root defaults which could change audited behavior. Share command, option, and output spellings through a private workflow-protocol leaf. Count CLI command tokens on every non-comment workflow line so quoted, spaced, or trailing-whitespace run keys cannot hide duplicates. Keep step names scoped to the owning steps mapping. Preserve comments inside run block scalars because Actions expands expressions before the shell sees comments. Ignore only source-level YAML comments. Extend the bootstrap LF attributes to semantic YAML, TOML, and TSV inputs, and test the effective attributes for every coordinated path. Normalize well-formed CRLF at the repository-read boundary for existing Windows worktrees, while pure parsers and bare carriage returns remain fail-closed. Reject indented continuations beneath scalar job fields so YAML folding cannot change an audited value without changing the scanner's view. Keep the canonical-source scanner private and exercise publication and source-shape mutations against a small literal YAML fixture and the live workflow. Tests: offline zc tests Tests: zc clippy with warnings denied Tests: ci/check_actions.sh Tests: ci/check_fmt.sh Tests: git diff --check *Authored by an agent, posting via joshlf's account* gherrit-pr-id: G347jsgltowjlm4i3umxjtudzc57bjmde
e28ac83 to
e09f241
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e09f24125f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| && indentation(line) == steps.marker_indent | ||
| && line[steps.marker_indent..].starts_with("- ")) | ||
| .then_some(index) |
There was a problem hiding this comment.
A valid YAML step can put the sequence indicator on its own line, such as - followed by an indented run: or uses: mapping, but this scanner recognizes only lines starting with - . If such a step is inserted before checkout, actual_steps still reports exactly the three canonical steps and none of the exact snippets include it, so the audit passes while an unaudited preceding step can replace host-level tools used by the planner. Fresh evidence beyond the earlier exact-three-step fix is this accepted bare-dash sequence form; reject every unrecognized item at marker_indent or parse both canonical sequence spellings.
Useful? React with 👍 / 👎.
2 participants
Load CI inputs only after plan_ci has the exact top-level job shape,
display name, hosted runner, read-only permissions, planner environment,
output map, and no needs or strategy. Require exactly the reviewed
checkout, planner, and upload steps in that order, with their complete
action pins, options, fields, and run block.
Require the workflow's complete ordered root declaration grammar before
auditing its environment. This rejects duplicate or alternate YAML key
spellings and new root defaults which could change audited behavior.
Share command, option, and output spellings through a private
workflow-protocol leaf. Count CLI command tokens on every non-comment
workflow line so quoted, spaced, or trailing-whitespace run keys cannot
hide duplicates. Keep step names scoped to the owning steps mapping.
Preserve comments inside run block scalars because Actions expands
expressions before the shell sees comments. Ignore only source-level
YAML comments.
Extend the bootstrap LF attributes to semantic YAML, TOML, and TSV
inputs, and test the effective attributes for every coordinated path.
Normalize well-formed CRLF at the repository-read boundary for existing
Windows worktrees, while pure parsers and bare carriage returns remain
fail-closed. Reject indented continuations beneath scalar job fields so
YAML folding cannot change an audited value without changing the
scanner's view.
Keep the canonical-source scanner private and exercise publication and
source-shape mutations against a small literal YAML fixture and the live
workflow.
Tests: offline zc tests
Tests: zc clippy with warnings denied
Tests: ci/check_actions.sh
Tests: ci/check_fmt.sh
Tests: git diff --check
Authored by an agent, posting via joshlf's account
Latest Update: v12 — Compare vs v11
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/G347jsgltowjlm4i3umxjtudzc57bjmde && git checkout -b pr-G347jsgltowjlm4i3umxjtudzc57bjmde FETCH_HEADCheckout
git fetch origin refs/heads/G347jsgltowjlm4i3umxjtudzc57bjmde && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/G347jsgltowjlm4i3umxjtudzc57bjmde && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.