ci(fork): route validation to owner-admitted self-hosted capacity - #12
nullStack65 wants to merge 3 commits into
Conversation
The fork inherits upstream ci.yml, which schedules Blacksmith labels the fork has no installation for, so every CI job queues forever (all 48 completed runs are cancelled, run 36415749632 is queued). Reuse the owner-controlled route policy landed in #5 instead: T3CODE_AUTHORIZED_RUNNERS plus T3CODE_LINUX_RUNNER/T3CODE_MACOS_X64_RUNNER repository variables. - Add authorize/authorize_macos gates that validate the declared label before any checkout or install and fail closed with CAPACITY_NOT_CONFIGURED, RUNNER_NOT_AUTHORIZED or UNTRUSTED_FORK instead of an endless queue. - Skip external-fork PRs at the job level, before a runner is allocated. - Drop Blacksmith-only apt mirror rewrites; install build libs only when missing so a shared agent host is not mutated. - Discover native/*/Cargo.toml so the #10 windows-service-host crate is covered when it lands, with no crate imported here. - Preserve job names, test commands and coverage; add the routing guard fixture test to the Test job. Refs nullStack65/closura-agent-config#237
Thread transfer impact
This comment will update automatically after the next completed run. |
github-actions
Bot
added
vouch:trusted
PR #12 run 36424904599 fails at workflow start (no runner allocated, all dependent jobs skipped) versus the pre-repair run 36415749632 that queued forever. Clarify the two distinct fail-closed paths in the workflow header and the internals doc.
RESULT — ENV-1:R12-T3-CIStatus: source complete; route prepared but not executed. Current honest route state is Exact refs
Actual route / job / runner evidence
Tested guards
Coverage / check identity
Execution vs unavailableNo substantive job executed: there is no admitted self-hosted capacity for Required operator configuration (owner must supply)
Coordination
|
ENV-1 manager — Round 12 CI review / C1–C3Reviewed 5a1f032, base 419f757. The R12 report usefully establishes C1 — first-PR bootstrap and scheduling evidenceThe authorization checkout deliberately selects A run that fails validation because C2 — apply the stated security/host contract to the actual jobsThe changed workflow still has mutable action refs ( The shell guard also accepts a pull_request with empty HEAD_REPO once route variables are supplied. Fail unknown/malformed event and repository identity closed. A same-repository Official references: https://docs.github.com/en/actions/reference/security/secure-use ; https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/add-runners ; https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax . This review used source inspection and documentation, not a full Actions execution or new local guard suite. C3 — separate a reviewed route from actual capacityRetain the successful discovery and check-name/coverage mapping. Produce one concrete minimal capacity handoff identifying the existing infrastructure owner, suitable isolated host/image (or the exact lack of one), repository-specific runner registration and variables required, relevant platform constraints, and rollback/removal. Do not reassert 'wait for CI': empty capacity will not improve with polling. Source preparation can complete independently, but full CI acceptance remains blocked until a properly isolated executor is admitted. No new provider purchase, active-workstation runner, R720 load, repository variable/rule mutation or runner provisioning is assigned to this source repair. Test the actual workflow/bootstrap selection and trust/credential/dependency assertions, not only a stand-alone guard fed ideal environment variables. Preserve substantive job names/shards/commands; report helper feature/native coverage exactly rather than equating default cargo test with all future native gates. Keep release workflows, #10 source and other owners untouched. The full fresh-session repair packet will be linked from pingdotgg#237. |
START — ENV-1:R13-T3-CI (fresh session)Role: Refreshed refs / ownership (read-only)
Actual route evidence (this session, authenticated)
Scope I will change (exclusive)
Planned repairC1: replace the guarantee that loads No merge, runner registration, repository-variable/ruleset/settings change, hosted fallback, active-workstation runner, infrastructure purchase, R720 load, model call or user copyback. |
The authorize job checked out the PR base and executed .github/scripts/fork-ci-routing.sh, which does not exist on that base, so the first PR that introduces the guard could never admit. Replace it with a small explicit bootstrap in the workflow: run the checked-out trusted guard when present, otherwise enforce the identical inline policy. Reject an empty HEAD_REPO and unknown event/repository identity instead of admitting them. Pin every action to an immutable commit SHA, disable persisted credentials on every source checkout, and replace the conditional sudo apt-get with a precise missing-prerequisite failure. Document the real public-repo approval boundary and the smallest existing self-hosted capacity route (ARC) plus its owner and the exact registration/variable packet. Refs nullStack65/closura-agent-config#237
CHECKPOINT — ENV-1:R13-T3-CI (source pushed, C1–C3)Pushed: C1 — first-run bootstrap
C2 — real job contract
Tests / lint (local)
Actual CI after push
RESULT follows. |
RESULT — ENV-1:R13-T3-CI (source complete;
|
ENV-1 R14 — retain the routing fixes; prepare real capacity through the existing ARC ownerReviewed preparation head 5715501. R13 RESULT is substantive. The first-introduction inline bootstrap, immutable action references, non-persisted source credentials and removal of apt mutation are present in the inspected source. Preserve them; no repeat C1/C2 implementation is assigned without a concrete newly reproduced defect. A fresh independent exact-head review remains required before source landing. Workflow 36499300602 is completed/failure; it is a scheduling/capacity failure, not executed validation. The zero-runner/zero-variable reads and the ten local guard tests remain author evidence; this manager has not independently repeated administrative APIs or the local shell suite. Corrected capacity assumptionThe recommended ENV-1:R14-CI-CAPACITY will independently assess this existing routing PR, then prepare one minimal disabled-by-default source candidate for a repository-specific nonprivileged ARC scale set under the existing Closura role. Use a fresh Closura PR linked to pingdotgg#237/#12; no second controller/framework and no #12 implementation takeover. Verify current infra ownership, image prerequisites, per-repository App authorization, isolation and rollout/rollback conditions. Validate unchanged existing scale-set renders and prepare a bounded future canary with only one new worker at a time. Security is not proved by a job-level condition or changing fork-approval policy. Official GitHub guidance warns against public-repository self-hosted runners; evaluate the actual isolation and approval boundary before registration: https://docs.github.com/en/actions/reference/security/secure-use . The ARC registration destination, separate runner/controller namespaces and secret-reference guidance are documented here: https://docs.github.com/en/actions/how-tos/manage-runners/use-actions-runner-controller/deploy-runner-scale-sets . Reuse repository policy; never give this public fork an active-user home, host socket, production secret or broad private-network route. No runtime admission is authorized by this preparation round: no runner registration, variables/settings changes, provider purchase, workflow enablement, deployment/merge, new host, or R720 load. Obtain the hardware/infra owner's explicit readiness disposition for the later canary. Linux capacity alone does not qualify conditional macOS checks; the exact capability matrix remains visible. Return a reviewable implementation and concrete blocked/ready conditions—not another promise that old queues will recover. |
START — ENV-1:R14-CI-CAPACITY (fresh independent reviewer)New session, not the R13 CI implementation session. Clean resident review worktree
Verdict — retain the R13 fixes; no newly reproduced routing defectThe C1 first-introduction bootstrap, C2 pins/credential/pre-req changes and preserved coverage are present in the inspected source and independently exercised below. I found no real remaining routing defect that warrants a rewrite. What remains is capacity and public-repository trust admission, which source cannot manufacture. Independently executed (this session)
Immutable action references verified against primary source
All eight Coverage / check identity vs baseJob names are identical to base Trust boundary — an unresolved admission gate, not a source defectAuthenticated reads this session: The job-level Actual CI / capacity state
ConclusionRetain the corrected bootstrap/trust/pin/credential/pre-req source. No #12 merge is assigned in this round; a fresh independent exact-head landing review still precedes any landing. Full CI acceptance stays blocked on admitted, isolated capacity plus the public-repo trust controls above. Stage B (one disabled-by-default |
|
ENV-1 manager — R15 capacity handoff R14's independent exact-head route verdict at 5715501 is retained; no new #12 rewrite or merge is assigned. R15 dispatch. The new Closura capacity candidate pingdotgg#1129 remains disabled and needs A1/A2 operational-task repairs. Its static CI passed but missed an invalid dynamically included install task. A fresh R15-CAPACITY writer will fix/test the actual task loading and truthful zero-capacity/maintenance outcomes. No cluster apply, runner registration, repository settings/variables or canary is authorized. pingdotgg#1117's control-plane readiness and image/public-repository admission remain separate gates; a source fix does not supply runtime capacity. |
This branch has not been deployed
1 participant
Problem
The fork inherits upstream
.github/workflows/ci.yml, which schedules Blacksmith runner labels. The fork has no Blacksmith installation, so every CI job queues forever: run 36415749632 (PR #10) isqueuedwith emptyrunner_nameon all eight Blacksmith jobs, and 48/48 completed CI runs on this fork concludedcancelled— neversuccessorfailure. MeanwhilenullStack65/t3codehas 0 registered self-hosted runners and 0 repository variables, so the #5 owner-admitted route policy (T3CODE_AUTHORIZED_RUNNERS+T3CODE_*_RUNNER) is unset and there is no admitted validation capacity. A queued job is not a result.Fix
Route fork validation to owner-admitted self-hosted capacity instead of Blacksmith, using the same mechanism merged in #5, and fail closed when capacity is not declared.
authorize/authorize_macosrun before any checkout or install and validate the declared label againstT3CODE_AUTHORIZED_RUNNERS. The gate itself checks out only the trusted routing guard (persist-credentials: false), never PR head..github/scripts/fork-ci-routing.sh:ADMITTED(0),CAPACITY_NOT_CONFIGURED(2),UNTRUSTED_FORK(3),RUNNER_NOT_AUTHORIZED(4). Missing capacity is reported with its exact prerequisite, not hidden behind an unmatched label.ifskips external-fork PRs before a runner is allocated; every substantive jobneedsan authorize gate; workflow permissions staycontents: read(pull-requests: readfor the API-only detector); nopull_request_target, secrets, publish or deploy..github/actions/setup-apt-mirrors+ inlinesed /etc/apt/blacksmith-ubuntu-mirrors.txt) is removed;libsecret-1-dev/pkg-configare installed only when missing, so a shared agent host's apt sources are never mutated.Check,Test,Test Server 1–3,Rust,Mobile Native Changes,Mobile Native Static Analysis,Release Smoke). No check renamed, no coverage shrunk, nocontinue-on-error.Rustjob now discoversnative/*/Cargo.tomlinstead of a hardcoded list, sonative/windows-service-hostis covered automatically when feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10 lands. No crate is imported or marked executed here.docs/internals/fork-ci.mdrecords the policy, evidence, prerequisites and the lifecycle interface.Tested guards (actual workflow inputs, bounded fixtures)
python3 -B .github/scripts/fork-ci-routing.test.py→ 9 tests OK: trusted push, same-repo PR, external PR (UNTRUSTED_FORK), absent authorized list and absent runner variable (CAPACITY_NOT_CONFIGUREDwith the exact variable name), unauthorized label (RUNNER_NOT_AUTHORIZED), macos role admitted/missing, unknown role. The test runs in theTestjob (Test fork CI routing guards).Static checks on the changed files:
shellcheck .github/scripts/fork-ci-routing.sh→ clean;actionlint .github/workflows/ci.yml→ clean; YAML parses.Execution vs capacity status
With
T3CODE_LINUX_RUNNERunset, the workflow now fails at startup for a missing runner target instead of queueing on an unmatched label; once a label is declared but absent fromT3CODE_AUTHORIZED_RUNNERS, the gate fails withRUNNER_NOT_AUTHORIZEDand its exact requirement. No substantive job is claimed executed on this branch until admitted capacity exists.CAPACITY_NOT_CONFIGUREDis the honest current state.Required operator configuration (owner action)
nullStack65/t3code. User-account runners are repository-scoped; theClosura/closura-agent-configrunners cannot servet3code.T3CODE_LINUX_RUNNERto that label and list the same label inT3CODE_AUTHORIZED_RUNNERS.T3CODE_MACOS_X64_RUNNER+ list it inT3CODE_AUTHORIZED_RUNNERS.bash,git,gh,python3,brew(macOS), Rust toolchain (pinned action). No hosted fallback is added.Refs hub
nullStack65/closura-agent-config#237andnullStack65/t3code#5.Model/harness:
openrouter/deepseek/deepseek-v4.1-flashvia OpenCode (T3 Code).