Repository navigation
ci: add isolated contextual-orchestrator security supplier - #2634
seonghobae wants to merge 3 commits into
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 37 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
Approve the citable supplier source: comparison with the supplied baseline preserves the four executable workloads and event exclusions, while the SARIF retry change correctly retains terminal upload failures. This approval does not establish deployment readiness or clean-per-job runner isolation.
Reviewed changed lines
.github/workflows/contextual-orchestrator-security.yml:6 (RIGHT): The supplier exposes only workflow_call; it does not independently introduce push, pull-request, or scheduled executions. Triggering and concurrency remain caller responsibilities..github/workflows/contextual-orchestrator-security.yml:18 (RIGHT): All four jobs explicitly select the isolated runner group and corresponding labels, without the former privileged-runner expression or a hosted fallback. This establishes source placement, not runner lifecycle guarantees..github/workflows/contextual-orchestrator-security.yml:59 (RIGHT): The full pytest invocation is retained. Static comparison also preserves native builds, benchmark coverage and docstring thresholds, wheel verification, eight fuzz targets, Rust gates, dependency audits, SBOM generation, and CodeQL analysis..github/workflows/contextual-orchestrator-security.yml:239 (RIGHT): The security job retains the same-repository PR restriction alongside its draft, closed-event, and schedule exclusions. Fork PRs remain excluded from this write-permission job..github/workflows/contextual-orchestrator-security.yml:246 (RIGHT): Security-events write remains scoped to the security job, matching the baseline. The other jobs retain contents-read permissions, and checkout credential persistence remains disabled..github/workflows/contextual-orchestrator-security.yml:333 (RIGHT): Capturing the failed pipeline status inside else avoids the baseline's capture of the completed if statement's successful status. The final retry exits with the captured failure rather than silently succeeding.tests/fixtures/contextual-orchestrator-security-8c8daebf.yml:8 (RIGHT): The historical push trigger is comparison data under tests/fixtures, not an Actions-discovered workflow.
Adversarial validation
.github/workflows/contextual-orchestrator-security.yml:59 (RIGHT)falsified: Extracting the supplier drops or weakens an executable quality or security gate. — Static comparison finds the workloads unchanged except for the intentional SARIF status-capture correction. Full pytest, 100% benchmark coverage and docstrings, wheel checks, all eight fuzz targets, Rust formatting/clippy/tests/audit, dependency audit, SBOM upload, and CodeQL analysis/upload remain present..github/workflows/contextual-orchestrator-security.yml:235 (RIGHT)falsified: The reusable-workflow conversion changes repository or event admission and runs unintended jobs. — Using the caller's GitHub context, an unrelated repository fails every guard; an eligible main push admits all four jobs; the Monday schedule admits only security and the Tuesday schedule only fuzz; draft and closed PRs admit none. An eligible fork PR admits tests/fuzz/rust but not security, preserving the baseline event restrictions while adding the intended repository restriction..github/workflows/contextual-orchestrator-security.yml:333 (RIGHT)falsified: Exhausted SARIF upload retries still return success, or a recovered upload is incorrectly failed. — The upload pipeline is conditional, so errexit does not preempt its failure branch. Else immediately captures the pipeline status. Repeated 19 produces five attempts and exit 19; immediate 0 produces one attempt and exit 0; 19/19/0 produces three attempts and exit 0. These traces match the supplied synthetic test expectations; no execution is claimed.tests/fixtures/contextual-orchestrator-security-8c8daebf.yml:8 (RIGHT)falsified: Adding the baseline fixture accidentally activates a second push or scheduled workflow. — The fixture is under tests/fixtures rather than .github/workflows. The actual supplier declares only workflow_call, so the fixture's historical triggers do not register executions.- Residual risk: Validation was static; the supplied tests were inspected, not executed. The truncated allowlist excludes the Python test file, so no formal line-level verdict is issued there. Runner disposability, installed prerequisites, and caller integration—including concurrency, trigger selection, and sufficient token permissions—remain unverified deployment requirements.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
bb94e9c85bf9d08bc123cfefe3c2fc5191080d18 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
Current-main refresh, exact head
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/contextual-orchestrator-security.yml— GitHub Actions review jobtests/fixtures/contextual-orchestrator-security-8c8daebf.yml— regression suitetests/test_cargo_audit_digest.py— regression suitetests/test_contextual_orchestrator_security_supplier.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: contextual-orchestrator-security.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: contextual-orchestrator-security.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: contextual-orchestrator-security-8c8daebf.yml"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: contextual-orchestrator-security-8c8daebf.yml"]
R2 --> V2["targeted test run"]
Evidence --> S3["Test: test_cargo_audit_digest.py (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_cargo_audit_digest.py (2 files)"]
R3 --> V3["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
3e40380a206f54b0c9db45a6b3243efdd640d992 - Workflow run: 38725230641
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: contextual-orchestrator-security.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: contextual-orchestrator-security.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: contextual-orchestrator-security-8c8daebf.yml"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: contextual-orchestrator-security-8c8daebf.yml"]
R2 --> V2["targeted test run"]
Evidence --> S3["Test: test_cargo_audit_digest.py (2 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_cargo_audit_digest.py (2 files)"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
This branch has not been deployed
1 participant
Central reusable CO tests/fuzz/Rust/supply-chain supplier. Fixed CWL CI isolated group and label; no Hosted fallback, arbitrary runner input, inherited secrets, or privileged pool. Four baseline jobs preserved, SARIF terminal failure propagation repaired. Independent 3-file source review PASS; focused tests 12 passed under -W error; actionlint and patch application checks exit 0.
Explicitly incomplete: runner repository admission, clean-per-job custody/canary, actual Actions, formal App approval, and consumer caller adoption. CO caller is unchanged and must reference the immutable merged supplier commit in a separate reviewed change. Managed Code Quality stop is separately observed and is not a passing gate. No secrets, runner ACLs, protection, paid calls or deployment changed.