Repository navigation
fix(ci): isolate fork PR execution on ephemeral runners (#318) + runner token scope (#357) - #365
Merged
Merged
Conversation
The deployed binary on 192.168.1.202 (69245e2 bundle, Oct 29) predates the job-level environment field; its parser rejects the key (fail-closed per 0857218), so every push event for 7f4e8fd failed with 'unknown job key environment'. The top-level environment: {} remains — that one the deployed parser requires and accepts.
Clippy (rust 1.99 in dsc-ci-rust:12) flags the manual str::repeat pattern as manual_str_repeat/manual_repeat_n under -D warnings. Co-Authored-By: Claude <noreply@anthropic.com>
A busy branch occupied its repository's FIFO trigger lane for the whole of each ~10-minute pipeline, leaving other refs of the same repo starved: five main-branch trigger requests sat pending for hours while codex-branch pushes kept re-arming the lane, and the republish redrive could not help because it re-queued into the same lane. Lane keys now include the ref name, so ordering holds within a ref while cross-ref starvation is impossible.
sqlx's per-connection depth counter can desync in two directions. The 2026-10-08 fix (bare ROLLBACK probe) handles the SQLite-side orphan, but the counter-side direction - depth stuck above zero with no live Transaction owner - rejected every begin_with carrying a custom statement with "attempted to call begin_with at non-zero transaction depth" before any statement reached SQLite. Raw ROLLBACK cannot fix that direction: the counter only moves through sqlx's managed commands. Live 2026-11-02: every pipeline-activation trigger failed five times with the depth error while healthy runs kept serving from the same pool, so an OpenCodifier commit sat un-run for hours. begin_immediate now detects the depth-error signature and unwinds the counter with a managed begin/rollback pair (SAVEPOINT at depth > 0, decrement on rollback) before retrying. Regression test injects the stuck state on a single-connection pool, mirroring the deterministic MRU re-handout that made every retry fail.
…ership (F1, F2) F1: runner registration was an unauthenticated write surface — anyone who could reach the API could register a runner and receive jobs. Registration now requires the shared GITFORGE_RUNNER_REGISTRATION_TOKEN via constant-time comparison; with the variable unset the endpoint fail-closed and rejects every registration. F2: the webhook trigger enqueued pipelines without checking that the caller owns the pipelines repository, so a valid trigger token on repo A could fire pipelines for repo B. The trigger now verifies ownership of the target repository before enqueueing. Both defects carry pinned regression tests in crates/gitforge-api/tests/ (runners_routes.rs, webhook_routes.rs): register_without_token_is_unauthorized, register_without_configured_token_is_disabled, webhook_refuses_a_non_owner_of_ the_pipelines_repository, webhook_owner_trigger_is_unaffected_by_the_ authorization_check. All 27 tests across runners/webhook/admin suites pass. Co-Authored-By: Claude <noreply@anthropic.com>
Registration (POST /runners on scheduler and gateway) now accepts the shared runner token (back-compat) or a dedicated GITFORGE_RUNNER_REGISTRATION_TOKEN, but the registration token no longer authorizes job lifecycle routes. Runner config grows registration_token; tests cover scope separation on both surfaces. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Trigger, watch, create, list, show, and delete errors were printed with a ❌ prefix and swallowed; watch timeouts also exited 0. Convert every pipeline error path to anyhow::bail so failures exit non-zero, and fail a trigger whose run was never scheduled. Co-Authored-By: Claude <noreply@anthropic.com>
Persistent self-hosted runners must never execute fork pull_request code. Same-repo PRs and push/tag/schedule keep the gitforge-github runner; fork PRs run the same checks on disposable ubuntu-latest. Also fix qualityctl: pass GITFORGE_BUILD_SOCKET to the daemon it spawns, and drop test parallelism to 2 to survive memory pressure. Co-Authored-By: Claude <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
🤖 AI Code Review ResultsAI review skipped: provider 'anthropic' is not configured; deterministic gates remain authoritative. ✅ No critical issues found. AI Code Review powered by GitForge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routes GitHub Actions
pull_requestevents from forks to disposableubuntu-latestrunners so persistent self-hosted runners never executefork-supplied code. Same-repo PRs, push, tag, and schedule events keep the
gitforge-githubself-hosted runner.Also lands the #357 hardening: a dedicated registration-token scope for
runners, and webhook repo-ownership enforcement.
Commits
ce06089efix(ci): route fork PRs to ephemeral hosted runners (Harden public PR runner trust and required-check coverage #318)cf648aaafix(cli): pipeline commands fail loudly instead of exit 0e58597d0style(scheduler): rustfmt drift in registration middleware8088c282fix(scheduler): dedicated runner registration token scope (security(critical): POST /api/runners is unauthenticated and hijacks existing runner identities #357)338a43b1fix(api): require runner registration token, enforce webhook repo ownership (F1, F2)Validation
GitForge CI chain on 202, run
cdd70c1c-85fe-4756-9344-a3d1ce37887e,exact commit
ce06089eb6a414ff00e48a8585c8627d1d809463, status succeeded:Test plan
gitforge-githubgitforge-github🤖 Generated with Claude Code