docs: add protected GitHub Pages publication lane - #98
seonghobae wants to merge 25 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughGitHub Pages 수동 배포 워크플로를 추가했다. ChangesPages 문서 배포
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant BuildJob
participant PagesArtifact
participant DeployJob
participant PublicSite
BuildJob->>PagesArtifact: 문서 빌드 결과와 source-sha.txt 업로드
PagesArtifact->>DeployJob: Pages 아티팩트 전달
DeployJob->>PublicSite: 아티팩트 배포
DeployJob->>PublicSite: HTTPS source-sha.txt 요청
PublicSite-->>DeployJob: 공개 소스 SHA 응답
Merge Risk: ⚪ Minimal · up to The Pages workflow has no remaining actionable issue from this review and is ready to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current technical re-review on 891156096cff7692694aab74afe5036025c4863f: re-read the full three-path child range after terminal execution and revalidated the pinned GitHub Pages action authority. The workflow remains manual-only and fails closed off refs/heads/main; checkout and the public source-sha.txt marker are bound to the exact protected SHA; build/Jekyll authority has only contents: read + pages: read; deployment/OIDC authority is isolated to the deploy job; deployment is serialized without cancelling an in-flight publish; and post-deploy verification requires HTTPS plus exact public source-SHA convergence. actions/configure-pages@45bfe019... documents enablement=false by default and that enablement needs non-GITHUB_TOKEN admin+Pages write authority, so repository-owner enablement correctly remains outside this source lane. Current exact CI 34669688301, Supply Chain 34669688233, TLS H2 Performance 34669688274, PgErd capacity 34669688226, and Release Reproducibility 34669688225 are all terminal success. Fresh review threads are empty. I found no additional writer-safe source/test/doctoring or authority-boundary defect. This COMMENT is technical evidence only, not an independent APPROVED review; has_pages:false means no public-site completion or protected merge/release/cutover credit is claimed.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current technical re-review on db93bb100faa37da1525f1dc0d6e246c7286b8ef: re-read all three writer-safe paths after the HTTPS redirect-downgrade repair and terminal exact-head execution. The historical verifier could follow an initial HTTPS Pages URL onto HTTP; hostile characterization reproduced that acceptance. Current source now constrains both initial and redirect protocols on both public verification requests with curl --proto '=https' --proto-redir '=https', while preserving the exact protected-SHA marker, manual protected-main authority, exact action pins, job-scoped least privilege and serialized deployment. The structural contract requires both HTTPS-only controls twice, and TRACEABILITY records the transport-integrity RCA and recovery boundary. Current exact CI 34670282108, Supply Chain 34670282112, TLS H2 Performance 34670282095, PgErd bounded-origin capacity 34670282140, and Release Reproducibility 34670282161 are all terminal success. Fresh review threads are empty. I found no additional writer-safe source/test/doctoring or authority-boundary defect. This COMMENT is technical evidence only, not an independent APPROVED review; repository has_pages:false still prevents publication-completion credit.
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="db93bb100faa37da1525f1dc0d6e246c7286b8ef"
actual_head="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual_head" "$expected_head"
test "$actual_head" = "$expected_head"
printf '\n== Changed paths against first parent ==\n'
git diff-tree --no-commit-id --name-status -r HEAD^ HEAD
printf '\n== Workflow ==\n'
nl -ba .github/workflows/pages.yml
printf '\n== Structural test ==\n'
nl -ba tests/pages_workflow_contract.rs
printf '\n== Traceability document ==\n'
nl -ba docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.md
printf '\n== Exact diff ==\n'
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- \
.github/workflows/pages.yml \
tests/pages_workflow_contract.rs \
docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.md
printf '\n== Workflow YAML parser availability and parse ==\n'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/pages.yml"); puts "ruby_yaml_parse=ok"'
else
echo "ruby unavailable; skipped"
fi
printf '\n== Relevant repository workflow conventions ==\n'
fd -a -t f -e yml -e yaml .github/workflows -x sh -c 'echo "--- $1"; sed -n "1,240p" "$1"' sh {} \;Length of output: 24069 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="db93bb100faa37da1525f1dc0d6e246c7286b8ef"
test "$(git rev-parse HEAD)" = "$expected_head"
base="$(git merge-base HEAD origin/main)"
printf 'MERGE_BASE=%s\nHEAD=%s\n' "$base" "$(git rev-parse HEAD)"
printf '\n== All PR paths and diff from main merge base ==\n'
git diff --name-status "$base" HEAD
git diff --no-ext-diff --check "$base" HEAD
git diff --no-ext-diff --unified=100 "$base" HEAD -- \
.github/workflows/pages.yml \
tests/pages_workflow_contract.rs \
docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.md
printf '\n== Commit scope from merge base ==\n'
git log --format='%H %s' --no-decorate "$base"..HEAD
printf '\n== Workflow files ==\n'
fd -a -t f . .github/workflows -x sh -c 'echo "--- $1"; nl -ba "$1"' sh {}
printf '\n== Cargo test registration/context ==\n'
rg -n -C 3 --glob 'Cargo.toml' --glob '*.rs' 'pages_workflow_contract|mod[[:space:]]+pages_workflow_contract|include!.*pages_workflow_contract' .
printf '\n== Repository branch protection and Pages settings (if GitHub credentials are available) ==\n'
gh api repos/ContextualWisdomLab/pingora-gateway --jq '{default_branch, has_pages, private, visibility}' || true
gh api repos/ContextualWisdomLab/pingora-gateway/branches/main/protection --jq '{required_status_checks, enforce_admins, required_pull_request_reviews, restrictions}' || trueLength of output: 209206 🤖 web_search executed:
Length of output: 17597
The workflow is manual-only. It fails unless the dispatch ref is The authority separation is correct. The build job has no deployment or OIDC authority. Only the deploy job has The workflow writes the verified source SHA into the rendered artifact before upload. It then requires the public Both public fetches restrict the initial protocol and all redirect protocols to HTTPS. An HTTPS-to-HTTP redirect cannot satisfy the publication check. The structural test covers the reviewed authority, source-binding, ordering, and redirect-protocol invariants. The traceability document accurately retains the repository-owner Pages enablement boundary. It does not claim current publication. This is an independent source review of the specified head. It does not transfer predecessor review credit. I did not execute the workflow in this sandbox. ✅ Action performedReview finished.
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current technical re-review on 0342fbda2c0e4f97d412d12d4a025fdffd46b599: re-read the complete three-path Pages child after the build-origin rendered-root repair and terminal exact-head execution. The prior verifier trusted public index-sha256.txt as its expected root digest, allowing a fresh source marker to coexist with a stale digest+root pair. Current source now computes SHA-256 of exact _site/index.html in the build job, writes it into the uploaded artifact, exports the same value through the workflow DAG, and requires both the public digest file and fetched root SHA-256 to equal that build-origin value. Manual protected-main-only authority, exact action pins, job-scoped least privilege, direct HTTPS/no-redirect transfer, real curl success and exact HTTP 200 remain intact. Current exact CI 34680605405, Supply Chain 34680605333, Release Reproducibility 34680605311, PgErd bounded-origin capacity 34680605316, and TLS H2 Performance 34680605315 are all terminal success. Fresh review threads are empty. I found no additional writer-safe workflow/test/doctoring or authority-boundary defect. This COMMENT is technical evidence only, not an independent APPROVED review; repository has_pages:false still prevents publication-completion credit.
seonghobae
added
documentation
ChatGPT Codex Connector
|
2026-09-19 live metadata/readback reconciliation: repository settings report |
|
2026-09-20 central desired-state cross-link Central PR ContextualWisdomLab/.github#2110 now records this exact publication owner as This does not transfer #98's five GREEN workflows or publish from the Draft head. #98 remains Draft, mechanically mergeable, three files, unresolved threads 0, independent APPROVED count 0. Protected-main integration, live Actions source selection, manual protected-main deployment, HTTP 200, source marker, and rendered-root digest remain required before publication is complete. |
1 participant
Refs #51, #58, #97.
Writer-safe publication child of #93 exact
175b831895a58791c5243778c508b17c25f14e46.Fresh repository metadata now reports
has_pages:true; the previoushas_pages:falsestatement is stale. That proves only that GitHub Pages is enabled at repository level. It does not prove that GitHub Actions is the selected publishing source, that this PR's workflow exists on protectedmain, or that any buyer-facing deployment has published and passed byte-identity verification. Protectedmaincurrently has no.github/workflows/pages.yml, so the source/workflow half of the publication contract still requires dependency-ordered integration before an actual publication run can exist. A checked-in Markdown page or repository-level Pages enablement alone is not public-site evidence.Changes:
.github/workflows/pages.ymlas a manual-only publication lane that fails closed unless dispatched from protectedmain;github.sha, builds only./docsthrough GitHub's Jekyll Pages builder, writessource-sha.txt, computes the exact rendered_site/index.htmlSHA-256, exports that digest as a trusted build-job output, writes the same digest toindex-sha256.txt, uploads the rendered artifact, deploys through thegithub-pagesenvironment, and verifies both source identity and buyer-facing root bytes after deployment;checkout@v6,configure-pages@v6,jekyll-build-pages@v1,upload-pages-artifact@v5,deploy-pages@v5);permissions: {}, build-onlycontents: read+pages: read, deploy-onlypages: write+id-token: write;--max-redirs 0, preserves curl failure status, and requires exact HTTP200;index-sha256.txtas the expected-digest authority;tests/pages_workflow_contract.rsto lock manual/main-only authority, job-scoped least privilege, exact pins, source/rendered-root binding, build-to-deploy digest propagation, zero-redirect/failure-preserving/exact-200 public verification, deployment ordering and serialization;docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.mdwith the admin boundary, alternatives, action authority, transport/origin/exit-status/HTTP-status/rendered-root evidence, acceptance and forward-recovery model.The lane intentionally does not use
configure-pages enablement: true: exactactions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0ddocuments that enabling Pages requires a token other thanGITHUB_TOKENand, for a GitHub App, administration+Pages write permission. Repository-level Pages enablement is now present, but the publishing-source selection remains an administration boundary until live configuration/deployment evidence proves otherwise; no repository secret or administrator bypass is introduced here.RED/repair history includes the earlier job-permission isolation, HTTPS downgrade rejection, cross-origin redirect rejection, curl failure-status preservation, exact-HTTP-200 gates, and rendered-root binding. Fresh review found one remaining evidence-integrity gap in
2780f08f53c36f7f367a043b1097e13449552596: the verifier fetchedindex-sha256.txtfrom the public site and then used that public value as the expected digest. A cache-skewed state with a freshsource-sha.txtbut staleindex-sha256.txtplus matching stale/could therefore satisfy the predicate. Test-first352c39c441e204c1a7ce15821b58e93bc49f1a67requires build-origin digest authority;95084621c54fae4f707969b8e3a868066bcbf082exports the rendered-root digest from the build step and passes it through the workflow DAG to deploy; current exact0342fbda2c0e4f97d412d12d4a025fdffd46b599records the RCA and recovery boundary.Current exact head is
0342fbda2c0e4f97d412d12d4a025fdffd46b599, an ordinary-forward repair touching only the existing workflow/test/TRACEABILITY scope. Fresh exact-head CI34680605405, Supply Chain34680605333, Release Reproducibility34680605311, PgErd bounded-origin capacity34680605316, and TLS H2 Performance34680605315are all terminal success. Exact-current technical re-review5185751327re-read the complete three-path range after execution and found no additional writer-safe workflow/test/doctoring or authority-boundary defect; fresh review threads are empty. Ready is restored solely to admit independent review on the unchanged current head. The protected-source publication prerequisite is not integrated and no independentAPPROVEDreview applies to this current head; both remain merge gates. The terminal exact-head workflows and technical COMMENT are source evidence only; they do not make the review gate, protected integration, or publication complete.This does not claim publication yet. Fresh live metadata proves repository-level Pages enablement (
has_pages:true), while protectedmainstill lacks this PR'spages.yml; there is therefore no protected-main exact-SHA publication receipt to promote. After dependency-ordered protected integration, verify the live Pages publishing source, then run the manual workflow from protectedmain. The public HTTPS source marker must equal the protected source SHA, the public digest file must equal the build-origin rendered-root digest, and the public root bytes must hash to that same digest before issue #97 can close. No product release, gateway deployment, canary/cutover or legacy-removal credit follows from Pages enablement or publication alone.