fix(ci): secure scanner and mirror provenance; reconcile impossible gates #764
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| #!/usr/bin/env bash | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # A CI policy must not require files that the structural-drift gate forbids. | ||
| set -euo pipefail | ||
| status=0 | ||
| while IFS= read -r -d '' file; do | ||
| [[ -f "$file" ]] || continue | ||
| # Restrict this check to executable file-existence tests. Historical prose | ||
| # and commented examples are not policy enforcement. | ||
| if awk ' | ||
| /^[[:space:]]*#/ { next } | ||
| { | ||
| source=$0 | ||
| # Mask quoted prose while retaining literal path arguments. Keep command | ||
| # substitutions visible: an echo can still execute a file test in $(). | ||
| code=""; quote=""; quoted="" | ||
| for (i=1; i<=length(source); i++) { | ||
| ch=substr(source,i,1) | ||
| if (quote != "") { | ||
| if (ch == quote) { | ||
| if (quoted ~ /^\.machine_readable\/(6a2\/)?(STATE|META|ECOSYSTEM|AGENTIC|NEUROSYM|PLAYBOOK|ANCHOR)\.a2ml$/ || | ||
| (quote == "\"" && quoted ~ /\$\(|`/)) code=code quoted | ||
| else code=code " " | ||
|
Comment on lines
+21
to
+23
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Detect retired paths split across shell quoting. The scanner misses 🤖 Prompt for AI Agents
Owner
Author
There was a problem hiding this comment. can you complete this as recommended rabbit? |
||
| quote=""; quoted="" | ||
| } else if (ch == "\\" && quote == "\"") { | ||
| quoted=quoted ch substr(source,++i,1) | ||
| } else quoted=quoted ch | ||
| } else if (ch == "\"" || ch == sprintf("%c",39)) quote=ch | ||
| else code=code ch | ||
| } | ||
| # A multiline shell quote cannot be classified from this physical line. | ||
| if (quote != "") code=code quoted | ||
| if (code ~ /(-f[[:space:]]|-e[[:space:]]|check_file[[:space:]])/ && | ||
| code ~ /\.machine_readable\/(6a2\/)?(STATE|META|ECOSYSTEM|AGENTIC|NEUROSYM|PLAYBOOK|ANCHOR)\.a2ml/) { | ||
| found=1; print FNR ":" source | ||
| } | ||
| } | ||
| END { exit !found } | ||
| ' "$file"; then | ||
| printf '::error file=%s::Policy requires a retired descriptile path; use .machine_readable/descriptiles/ and reconcile existing files\n' "$file" | ||
| status=1 | ||
| fi | ||
| done < <(git ls-files -z -- '.github/workflows/*.yml' '.github/workflows/*.yaml' 'scripts/*.sh' '.githooks/*.sh' Justfile justfile) | ||
| exit "$status" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| #!/usr/bin/env ruby | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # Produce a reviewable PUT body for the four retired constraints documented | ||
| # in config/README.adoc. This script never calls GitHub or changes a ruleset. | ||
| require 'json' | ||
|
|
||
| module RulesetConstraintRepair | ||
| RETIRED = %w[update required_deployments code_quality code_coverage].freeze | ||
| WRITABLE = %w[name target enforcement conditions bypass_actors rules].freeze | ||
|
|
||
| # Supply an app ID only after GitHub rejects it as no longer installed. Removing | ||
| # a stale bypass tightens access; never infer app availability from its name. | ||
| def self.plan(source, uninstalled_app_id: nil) | ||
| unless source.is_a?(Hash) && source['target'] == 'branch' && source['enforcement'] == 'active' && | ||
| source.dig('conditions', 'ref_name', 'include') == ['~DEFAULT_BRANCH'] && | ||
| source.dig('conditions', 'ref_name', 'exclude') == [] && source['rules'].is_a?(Array) | ||
| raise ArgumentError, 'Expected an active default-branch ruleset with no exclusions' | ||
| end | ||
| rules = source.fetch('rules') | ||
| unless rules.all? { |rule| rule.is_a?(Hash) && rule['type'].is_a?(String) } | ||
| raise ArgumentError, 'Malformed rule data; refusing a partial plan' | ||
| end | ||
| raise ArgumentError, 'Missing pull-request protection' unless rules.any? { |r| r['type'] == 'pull_request' } | ||
|
|
||
| result = source.select { |key, _value| WRITABLE.include?(key) } | ||
| result['rules'] = rules.reject { |rule| RETIRED.include?(rule['type']) } | ||
| if uninstalled_app_id | ||
| actors = source.fetch('bypass_actors') | ||
| unless uninstalled_app_id.is_a?(Integer) && uninstalled_app_id.positive? && | ||
| actors.is_a?(Array) && actors.any? { |actor| actor['actor_type'] == 'Integration' && actor['actor_id'] == uninstalled_app_id } | ||
| raise ArgumentError, 'Expected the exact ID of an existing integration bypass rejected by GitHub' | ||
| end | ||
| result['bypass_actors'] = actors.reject { |actor| actor['actor_type'] == 'Integration' && actor['actor_id'] == uninstalled_app_id } | ||
| end | ||
| result | ||
| end | ||
| end | ||
|
|
||
| if $PROGRAM_NAME == __FILE__ | ||
| unless ARGV.length == 1 || (ARGV.length == 3 && ARGV[1] == '--remove-uninstalled-app') | ||
| abort 'Usage: plan-ruleset-constraint-repair.rb <live-ruleset.json> [--remove-uninstalled-app <verified-id>]' | ||
| end | ||
| app_id = ARGV[2] && Integer(ARGV[2], 10) | ||
| puts JSON.pretty_generate(RulesetConstraintRepair.plan(JSON.parse(File.read(ARGV[0])), uninstalled_app_id: app_id)) | ||
| end |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.