[ci] Audit typed matrix execution path - #3594
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## G347jsgltowjlm4i3umxjtudzc57bjmde #3594 +/- ##
====================================================================
Coverage ? 91.85%
====================================================================
Files ? 20
Lines ? 6093
Branches ? 0
====================================================================
Hits ? 5597
Misses ? 496
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
348b0f9 to
d0ff708
Compare
3143da8 to
89b8771
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
89b8771 to
f9ea695
Compare
f9ea695 to
438d2d3
Compare
665458f to
0949141
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
0949141 to
e96e0b4
Compare
438d2d3 to
135f323
Compare
e96e0b4 to
9d34d33
Compare
135f323 to
104d5a2
Compare
9d34d33 to
e28ac83
Compare
104d5a2 to
a0ff093
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0ff093116
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
e28ac83 to
e09f241
Compare
a0ff093 to
01a6565
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01a6565c51
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
e09f241 to
b45794c
Compare
01a6565 to
4a0f23d
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
b45794c to
e8f9cbc
Compare
4a0f23d to
a0f67ad
Compare
joshlf
changed the title
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Require reviewed planned roles to equal build_test and miri. Audit their exact top-level shapes, display names, hosted runners, read-only permissions, plan_ci and build_docker_env dependencies, and build run defaults. Reject unreviewed job controls and strategy fields. Require exact matrix gates and fan-out expressions. Include every Miri selector, including toolchain, in its display name. Bind one named executor step to each job's steps mapping, with the exact selector environment and checked CLI arguments for its role. Audit the image producer's exact fields, permissions, output, and five steps. Derive its artifact output and each consumer input from shared job, output, and upload-step identifiers so a protocol rename cannot silently update only one side. Build the image from an isolated context containing only an audited Dockerfile and an audited ignore file which excludes every context path. Reject any extra context entry. Install the three common Rust toolchains directly instead of executing checkout code, and require their Docker argument defaults to match the validated inventory. This also avoids compiling cargo-zerocopy only to seed the image and prevents ordinary tools-tree changes from invalidating that layer. The expected latency improvement is a more reliable Docker cache hit and less work when the final image layer does need to rebuild. Audit every mutable local action and image source against an independent compiled snapshot. Open each source once for both its identity and its contents. Reject symbolic links, paths outside the checkout, non-files, and hard-link aliases across the complete reviewed source set. Audit the complete ordered matrix setup and executor sequences and shared YAML anchors. Preserve comment-looking data beneath every YAML block scalar when comparing exact steps, rather than only beneath run blocks. Run a trusted Git integrity gate after setup. Build a disposable index from the expected commit under an empty Git configuration so mutable index flags, local attributes, and clean filters cannot hide changes. Reject any changed tracked, untracked, or ignored checkout path before invoking the typed executor. Audit privileged custom shells and explicit absolute Docker bridges. Require the fixed Bash entrypoint, no-startup privileged arguments, and Docker option terminator, with every run line treated as load-bearing. Tests: CARGO_NET_OFFLINE=true ./tools/cargo.sh test --locked -p zc Tests: warning-denied Clippy for all zc targets Tests: CARGO_NET_OFFLINE=true ./zerocopy/cargo.sh ci audit Tests: ./ci/check_actions.sh Tests: ./ci/check_fmt.sh Tests: git diff --check *Authored by an agent, posting via joshlf's account* gherrit-pr-id: Gcl7ijadfh2m7eft4ucy5czoaghddreiq
e8f9cbc to
6a79b53
Compare
a0f67ad to
61315e4
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Require reviewed planned roles to equal build_test and miri. Audit
their exact top-level shapes, display names, hosted runners, read-only
permissions, plan_ci and build_docker_env dependencies, and build run
defaults. Reject unreviewed job controls and strategy fields.
Require exact matrix gates and fan-out expressions. Include every
Miri selector, including toolchain, in its display name. Bind one named
executor step to each job's steps mapping, with the exact selector
environment and checked CLI arguments for its role.
Audit the image producer's exact fields, permissions, output, and five
steps. Derive its artifact output and each consumer input from shared
job, output, and upload-step identifiers so a protocol rename cannot
silently update only one side.
Build the image from an isolated context containing only an audited
Dockerfile and an audited ignore file which excludes every context
path. Reject any extra context entry. Install the three common Rust
toolchains directly instead of executing checkout code, and require
their Docker argument defaults to match the validated inventory.
This also avoids compiling cargo-zerocopy only to seed the image and
prevents ordinary tools-tree changes from invalidating that layer. The
expected latency improvement is a more reliable Docker cache hit and
less work when the final image layer does need to rebuild.
Audit every mutable local action and image source against an independent
compiled snapshot. Open each source once for both its identity and its
contents. Reject symbolic links, paths outside the checkout, non-files,
and hard-link aliases across the complete reviewed source set.
Audit the complete ordered matrix setup and executor sequences and
shared YAML anchors. Preserve comment-looking data beneath every YAML
block scalar when comparing exact steps, rather than only beneath run
blocks.
Run a trusted Git integrity gate after setup. Build a disposable index
from the expected commit under an empty Git configuration so mutable
index flags, local attributes, and clean filters cannot hide changes.
Reject any changed tracked, untracked, or ignored checkout path before
invoking the typed executor.
Audit privileged custom shells and explicit absolute Docker bridges.
Require the fixed Bash entrypoint, no-startup privileged arguments, and
Docker option terminator, with every run line treated as load-bearing.
Tests: CARGO_NET_OFFLINE=true ./tools/cargo.sh test --locked -p zc
Tests: warning-denied Clippy for all zc targets
Tests: CARGO_NET_OFFLINE=true ./zerocopy/cargo.sh ci audit
Tests: ./ci/check_actions.sh
Tests: ./ci/check_fmt.sh
Tests: git diff --check
Authored by an agent, posting via joshlf's account
Latest Update: v15 — Compare vs v14
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/Gcl7ijadfh2m7eft4ucy5czoaghddreiq && git checkout -b pr-Gcl7ijadfh2m7eft4ucy5czoaghddreiq FETCH_HEADCheckout
git fetch origin refs/heads/Gcl7ijadfh2m7eft4ucy5czoaghddreiq && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/Gcl7ijadfh2m7eft4ucy5czoaghddreiq && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.