Repository navigation
fix(strix): use exclusively owned trusted workspaces - #2658
seonghobae wants to merge 1 commit into
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 32 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/strix.yml— GitHub Actions review jobtests/test_strix_private_workspace.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_strix_private_workspace.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_strix_private_workspace.py"]
R2 --> V2["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
d37defe946640ca80aaef325ed58f9c97047fc95 - Workflow run: 38725712270
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_strix_private_workspace.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_strix_private_workspace.py"]
R2 --> V2["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
This branch has not been deployed
1 participant
Runtime failure
Strix jobs 116383483250 (#2642) and 116388379628 (#2603) failed before scanning with "remote origin already exists". Both re-initialized the fixed runner temporary trusted-workspace directory, retaining an earlier Git remote.
Repair
Allocate one exclusive 0700 trusted checkout per job. Both event materialization routes and the substantive scanner consume the allocator's exact path. Always-cleanup validates the owned path, device/inode and UID and removes only that original directory; existing fixed directories, other workspaces and ambiguous replacements are not deleted. Allocation handoff failure removes only the newly created root.
This does not reset existing remotes, sweep shared temp, prune images or weaken any security/review gate. Trusted-base execution and PR-head-as-data scanning are preserved.
Verification
Boundaries
Ready for normal exact-head review and CI, not merge or runtime acceptance. No predecessor approval transfers. Fresh remote Strix execution and independent qualifying approval remain required.
Owned-path cleanup is hygiene, not hostile same-UID isolation: another process with equivalent guest privileges can race or mutate state. Disposable guest isolation, host/network denial, credential boundaries and external teardown remain separate requirements. No production runner registration, ACL, credential or network change is included.
Existing #2573 lifecycle diagnostics and #2649 gh-bootstrap backport remain untouched; this narrowly repairs workspace reuse on current main.