[ci] Audit typed plan publication - #3593
Conversation
348b0f9 to
d0ff708
Compare
10284fa to
a565eff
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0ff708110
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
a565eff to
7de4caa
Compare
d0ff708 to
665458f
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc #3593 +/- ##
==================================================================
Coverage 91.85% 91.85%
==================================================================
Files 20 20
Lines 6093 6093
==================================================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
6a79b53 to
ad5a7c2
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
f2da34c to
ea969d4
Compare
ad5a7c2 to
3cedc1d
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3cedc1d21e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3cedc1d to
0380172
Compare
ea969d4 to
6b3a770
Compare
0380172 to
d220621
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
d220621 to
fcda88a
Compare
2156849 to
c51f601
Compare
8eb1efb to
d7a4fd1
Compare
c51f601 to
c8bd554
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d7a4fd1459
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
d0ba440 to
a46aedf
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Treat `plan_ci` as the source-to-runtime trust boundary for the typed plan consumed by later jobs. Load CI inputs only after it has the exact top-level job shape, display name, hosted runner, read-only permissions, planner environment, output map, and no `needs` or strategy. Require exactly the reviewed checkout, planner, and upload steps in order, including their complete action pins, options, fields, and run block. Require the workflow's complete ordered root declaration grammar before auditing its environment. This rejects duplicate or alternate YAML key spellings and new root defaults which could change audited behavior. Put a parser-backed source precondition before any scanner trusts YAML indentation. Require exactly one document. Reject multiline plain or quoted scalars and multiline flow mappings or sequences, while retaining single-line flow nodes and indentation-bounded literal and folded block scalars. Reject explicit tags and unknown parser events or styles so new syntax fails closed. Remove the inherited setup anchors while this source audit covers only the planner, and reject every YAML anchor and alias. The matrix bridge can reintroduce shared step anchors only in the same change that binds their definitions and aliases to reviewed owners and sequences. Confine libyaml's unsafe interface to a heap-stable parser wrapper. Bind the input lifetime to the parser, delete every initialized event exactly once, and delete only a successfully initialized parser. Require the first significant line to establish the expected root block mapping. Keep `jobs` as the final root entry. Require every direct job to use an unquoted two-space `job_id:` declaration before any nested content. Scanner-visible indentation is therefore structural, not scalar text. Share command, option, and output spellings through a private workflow protocol module. Count CLI command tokens on every non-comment workflow line so quoted, spaced, or trailing-whitespace run keys cannot hide duplicates. Keep step names scoped to their owning `steps` mapping. Preserve comments inside run block scalars because Actions expands expressions before the shell sees comments. Ignore only source-level YAML comments. Treat every significant line at the step-item indentation as a boundary, including YAML's bare `-` mapping form. Extend bootstrap LF attributes to semantic YAML, TOML, and TSV inputs. Normalize well-formed CRLF at the repository-read boundary for existing Windows worktrees, while pure parsers and bare carriage returns fail closed. Apply the same normalization to path reads and retained handle reads so identity checks and parsed bytes cannot diverge. Retain the handle across path replacement, then release it before Windows cleanup. Add valid-YAML adversarial regressions for root, job, and field decoys inside multiline scalars and flow collections; alternate job indentation; later root overrides; explicit block-scalar decoys; multiple documents; tags and non-LF line breaks; and planner replay through anchors and aliases. The parser precondition adds one linear pass over the workflow and no CI job or matrix cell. Its expected latency cost is negligible. Tests: offline zc tests Tests: zc clippy with warnings denied Tests: ci/check_actions.sh Tests: ci/check_fmt.sh Tests: git diff --check *Authored by an agent, posting via joshlf's account* gherrit-pr-id: G347jsgltowjlm4i3umxjtudzc57bjmde
a46aedf to
e5f21e0
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Treat
plan_cias the source-to-runtime trust boundary for the typedplan consumed by later jobs. Load CI inputs only after it has the exact
top-level job shape, display name, hosted runner, read-only permissions,
planner environment, output map, and no
needsor strategy. Requireexactly the reviewed checkout, planner, and upload steps in order,
including their complete action pins, options, fields, and run block.
Require the workflow's complete ordered root declaration grammar before
auditing its environment. This rejects duplicate or alternate YAML key
spellings and new root defaults which could change audited behavior.
Put a parser-backed source precondition before any scanner trusts YAML
indentation. Require exactly one document. Reject multiline plain or
quoted scalars and multiline flow mappings or sequences, while retaining
single-line flow nodes and indentation-bounded literal and folded block
scalars. Reject explicit tags and unknown parser events or styles so new
syntax fails closed.
Remove the inherited setup anchors while this source audit covers only
the planner, and reject every YAML anchor and alias. The matrix bridge
can reintroduce shared step anchors only in the same change that binds
their definitions and aliases to reviewed owners and sequences.
Confine libyaml's unsafe interface to a heap-stable parser wrapper. Bind
the input lifetime to the parser, delete every initialized event exactly
once, and delete only a successfully initialized parser.
Require the first significant line to establish the expected root block
mapping. Keep
jobsas the final root entry. Require every direct jobto use an unquoted two-space
job_id:declaration before any nestedcontent.
Scanner-visible indentation is therefore structural, not scalar text.
Share command, option, and output spellings through a private workflow
protocol module. Count CLI command tokens on every non-comment workflow
line so quoted, spaced, or trailing-whitespace run keys cannot hide
duplicates. Keep step names scoped to their owning
stepsmapping.Preserve comments inside run block scalars because Actions expands
expressions before the shell sees comments. Ignore only source-level
YAML comments. Treat every significant line at the step-item indentation
as a boundary, including YAML's bare
-mapping form.Extend bootstrap LF attributes to semantic YAML, TOML, and TSV inputs.
Normalize well-formed CRLF at the repository-read boundary for existing
Windows worktrees, while pure parsers and bare carriage returns fail
closed. Apply the same normalization to path reads and retained handle
reads so identity checks and parsed bytes cannot diverge. Retain the
handle across path replacement, then release it before Windows cleanup.
Add valid-YAML adversarial regressions for root, job, and field decoys
inside multiline scalars and flow collections; alternate job
indentation; later root overrides; explicit block-scalar decoys;
multiple documents; tags and non-LF line breaks; and planner replay
through anchors and aliases.
The parser precondition adds one linear pass over the workflow and no CI
job or matrix cell. Its expected latency cost is negligible.
Tests: offline zc tests
Tests: zc clippy with warnings denied
Tests: ci/check_actions.sh
Tests: ci/check_fmt.sh
Tests: git diff --check
Authored by an agent, posting via joshlf's account
Latest Update: v29 — Compare vs v28
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/G347jsgltowjlm4i3umxjtudzc57bjmde && git checkout -b pr-G347jsgltowjlm4i3umxjtudzc57bjmde FETCH_HEADCheckout
git fetch origin refs/heads/G347jsgltowjlm4i3umxjtudzc57bjmde && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/G347jsgltowjlm4i3umxjtudzc57bjmde && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.