fix(scheduler): prove workflow-starting mutation token - #2003
seonghobae wants to merge 7 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
added
bug
ChatGPT Codex Connector
Baseline reproduction confirms credential/fixture failure exists before #2005Independent clean-detached reproduction was completed at parent stack head .venv/bin/python -m pytest tests/test_pr_review_merge_scheduler.py -q -k 'cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs or force_cancel_failure_logs_reason_and_does_not_raise or force_cancel_multiple_runs_reports_only_failures or workflow_starting_credentials_allow_head_mutations' --tb=shortResult: 4 failed, 330 deselected / 13.60s / terminal 1. For #2003 ownership specifically, Required repair boundary:
The other three focused failures are cancellation mocks that reject the new |
Preserve this PR's bounded RED→GREEN delta while integrating protected-main CodeQL fixes through its exact parent branch. No force update; both parent SHAs are recorded.
Preserve stacked security-workflow coverage while inheriting exact workflow-starting credential and cancellation-double repairs. No rebase or force update.
|
Exact-head repair receipt —
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head source review for 71e76785b9f7ce900a4a85c23a49d5da4684a262 on parent #2002@b18b7ca77ba6a8cb733a4661c00d1035408c5eec: no new substantive finding in the six-file stacked delta.
The final head-mutation boundary now proves four distinct facts instead of trusting a source label: the declared source is workflow-starting, selected GH_TOKEN is present, the workflow-token comparison value is present, and the two values differ. The caller exposes SCHEDULER_WORKFLOW_TOKEN only to the scheduler mutation job. Missing/equal evidence fails closed, while operator guidance renders the immutable recorded decision rather than mutable later environment state.
The parent-baseline credential fixture is coherently repaired to supply distinct selected/workflow tokens. No timeout, provider, review, permission, ruleset, or production safety check is weakened.
This is an independent source review, not approval or hosted GREEN. Preserve #2002 as the explicit prerequisite and regenerate exact-head checks/reviews after any parent movement; no predecessor evidence transfers.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/pr-review-merge-scheduler.yml— GitHub Actions review jobCHANGELOG.md— repository behaviordocs/doctoring/workflow-starting-mutation-credential-proof.md— operator or user guidancedocs/product-technical-gap-baseline.md— operator or user guidancescripts/ci/pr_review_merge_scheduler_core.py— review and security gate shell pathtests/test_pr_review_merge_scheduler.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_merge_scheduler_core.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_merge_scheduler_core.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_pr_review_merge_scheduler.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_pr_review_merge_scheduler.py"]
R5 --> V5["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
71e76785b9f7ce900a4a85c23a49d5da4684a262 - Workflow run: 34179686961
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_merge_scheduler_core.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_merge_scheduler_core.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_pr_review_merge_scheduler.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_pr_review_merge_scheduler.py"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
|
Exact-head repair receipt for The hosted RED remains run Non-force lineage:
Local exact-tree evidence:
The PR remains Draft/Proposed. Fresh exact-head hosted checks and independent review are still required; no predecessor evidence transfers. |
|
Scoped workflow/read-credential finding for coordination with this scheduler stack: #2120 . Consumer paper PR10 at Please coordinate the minimal job/caller read-permission contract repair and canonical regression with the current workflow writer. No source, token/App grant or branch has been modified by this investigation. The issue includes exact job evidence, source lines and endpoint contract; no status-write permission or weakening of unknown-status fail-closed behavior is proposed. Actual hosted read validation remains required after owner integration. |
1 participant
Root cause
An allowlisted mutation credential source did not prove that the selected
GH_TOKENwas present and distinct from the workflowgithub.token. GitHub suppresses new workflow runs for events produced byGITHUB_TOKEN, so an empty App/PAT secret could fall back to that token while the source label still authorized a head mutation. The moved head would then require checks that its mutation credential cannot start.This is a bounded successor for a second valid delta preserved in historical Draft #1231. It is stacked on #2002 because both touch the scheduler credential boundary.
RED → GREEN
ebcc6715e68d6bd4dc78f1ce6c3e473a2dfef899github.tokene2204eeb1ec2789ff791036140ba1672995d25f5SCHEDULER_WORKFLOW_TOKENonly to the scheduler mutation jobdocs/product-technical-gap-baseline.mdAuthority and safety
fix/scheduler-central-actions-credential-routing@7bf3451a47768dbda903115a393b1da1d98e1dba