Require the hostile-environment axes as merge gates - #728
Conversation
…manifest + live cross-check exercised; owner-authorized hard-gate upgrade) Promote the four hostile-environment CI axes from an advisory lane to required merge gates now that PR #727 reduced the flakes that could trip them and all four axes have proven green together. - ci.yml: drop continue-on-error from the hostile-env job so a red axis fails the job; rewrite the job comment to say the four contexts are now required. - policy/github-hosted-controls.toml: add the four "Hostile environment (<axis>)" contexts to required_status_checks. - internal/metadatautil/workflows.go: CollectWorkflowJobNames now expands a matrix job's name: template against matrix.include (reusing the lane helpers) so each concrete leg name matches a required status-check context. Non-matrix jobs expand to their single unchanged name. - workflow_validation_test.go: prove a matrix job maps its four expanded leg contexts through CheckWorkflows. - workflow-lane-policy.json / workflow-lanes.json / github-workflows.md: correct the now-false "advisory / continue-on-error / not a required check" language to reflect the required gate. The live default-branch ruleset must add the same four contexts before the post-merge push-to-main hosted-controls run; that update is applied separately at merge time.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 94d7c09637
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| hostile-env: | ||
| name: Hostile environment (${{ matrix.axis }}) |
There was a problem hiding this comment.
The new matrix expansion path is tested only with four valid rows. Add a negative fixture that proves CheckWorkflows rejects a required context not produced by the matrix, such as an unresolved or absent matrix value; otherwise this security-sensitive validator can regress to accepting a context that GitHub never emits, leaving merges permanently blocked or the policy misleading. 【F:AGENTS.md†L155-Lussia156】
Useful? React with 👍 / 👎.
| "authority": "github-only", | ||
| "local_mode": "none", | ||
| "github_only_reason": "advisory rerun of repository validation under a container running as uid 0, where a chmod assertion and a write-only read assertion stop holding; it carries continue-on-error and is absent from required_status_checks while its first failures are triaged, so it never gates a PR or release and is not part of any local profile plan; docs/github-workflows.md carries the local reproduction sequence for WORKCELL_HOSTILE_ENV=root, which builds the validator image and selects the repo-core profile the hosted job uses" | ||
| "github_only_reason": "required rerun of repository validation under a container running as uid 0, where a chmod assertion and a write-only read assertion stop holding; it is a required merge gate in required_status_checks that runs only on GitHub, with no local mirror and no place in any local profile plan; docs/github-workflows.md carries the local reproduction sequence for WORKCELL_HOSTILE_ENV=root, which builds the validator image and selects the repo-core profile the hosted job uses" |
There was a problem hiding this comment.
When ci-plan or pre-merge uses the pr-parity profile, PlanWorkflowLanes checks Profiles before LocalMode, so omitting profiles: ["pr-parity"] makes all four newly required axes appear as skipped: not-in-profile rather than selected github-only gates. This makes the parity evidence contradict the hosted required-check policy; add the profile to all four policy entries and regenerate the manifest.
AGENTS.md reference: AGENTS.md:L294-L295
Useful? React with 👍 / 👎.
1 participant
What changed
Promotes the four hostile-environment CI axes from an advisory lane to required merge gates. PR #727 reduced the flakes that could trip them and all four axes have proven green together (tmpdir/workspace/root/uidmap).
.github/workflows/ci.yml— removedcontinue-on-error: truefrom thehostile-envjob so a red axis fails the job; rewrote the job comment to say the four contexts are now required.max-parallel: 1and everything else unchanged.policy/github-hosted-controls.toml— added the four contexts to[required_status_checks].contexts:Hostile environment (tmpdir),Hostile environment (workspace),Hostile environment (root),Hostile environment (uidmap).internal/metadatautil/workflows.go— validator mapping update (see below).internal/metadatautil/workflow_validation_test.go— added a matrix-job fixture toTestCheckWorkflowsRecognizesRequiredJobNamesproving the four expanded leg contexts map throughCheckWorkflows.policy/workflow-lane-policy.json/policy/workflow-lanes.json/docs/github-workflows.md— corrected the now-false "advisory / continue-on-error / not a required check" language to reflect the required gate (manifest regenerated from the source policy;authority/local_modeunchanged — both remain accurate).Matrix-mapping approach
CheckWorkflowsrequires each context string to match a collected workflow job name literally. Thehostile-envjob'sname:is the templateHostile environment (${{ matrix.axis }}), which does not literally equal the four leg contexts — so a naive add would have failed the PR's ownValidate repositorycheck.Following the repo's existing handling of matrix lanes,
CollectWorkflowJobNamesnow expands a matrix job'sname:template againstmatrix.include, reusing the existingworkflowLaneExpandMatrix/workflowLaneRenderJobNamehelpers. Non-matrix jobs expand to their single unchanged name (no behavior change for the existing nine contexts). This yields exactly the four concrete leg names as matchable required contexts.Live ruleset
The live default-branch ruleset (
main-status-checks) must add the same four contexts to itsrequired_status_checksrule before the post-merge push-to-main hosted-controls run, which cross-checks live against this TOML. That update is applied separately at merge time — it is not part of this PR, and the PR's own required checks pass without it (the live cross-check does not run on PRs).