Skip to content

feat(runner-policy): approve the review lanes at ci-workflows v0.59.1 #839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kyle-sexton wants to merge 1 commit into from
Closed

feat(runner-policy): approve the review lanes at ci-workflows v0.59.1 #839

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions components/runner-policy/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1353,6 +1353,13 @@ v0.55.0 entry. Its `workflow_call` inputs, secrets, top-level and job
permissions and `runs-on` are unchanged; a new report step lists timeouts and
accepted 429 and 5xx links in the job summary (ci-workflows#844). No input,
secret, caller permission, or routing changes.
At the v0.59.1 tag `8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b`, sign-off
pending, `pr-review` and `pr-review-security` are verbatim copies of their
v0.55.0 entries. Their `workflow_call` inputs, secrets and permissions are
unchanged; the claude-code-action pin moves from v1.0.252 to v1.0.253 on both
review steps, which receive the OAuth token (ci-workflows#838), and the
findings count is raised to the summary's manifest flag lines
(ci-workflows#848). No input, secret, caller permission, or routing changes.
The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
uses its reviewed `runner` input and checksum-verified native Linux binary, so
enrolled consumers may route that advisory lane onto the managed fleet
Expand Down
32 changes: 32 additions & 0 deletions components/runner-policy/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,6 +391,25 @@
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review.yml@8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": [
"runner",
"incremental-review",
"allowed-bot-sender-ids",
"model-args",
"allowed-author-ids"
],
"allowedSecrets": {
"CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
},
"allowedCallerPermissions": {
"contents": "read",
"pull-requests": "write",
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
"routing": "runner-input",
"runnerInput": "runner",
Expand Down Expand Up @@ -547,6 +566,19 @@
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b": {
"routing": "runner-input",
"runnerInput": "runner",
"allowedInputs": ["runner", "incremental-review", "allowed-bot-sender-ids", "model-args"],
"allowedSecrets": {
"CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
},
"allowedCallerPermissions": {
"contents": "read",
"pull-requests": "write",
"id-token": "write"
}
},
"melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
"routing": "runner-input",
"runnerInput": "runner",
Expand Down
25 changes: 25 additions & 0 deletions components/runner-policy/runner-policy.test.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ const REPINE_LANE_SHA_V0_55_0 = "3a2c748fdef9cfb9ceec5a66289e21842189689f";
const REPINE_LANE_SHA_V0_56_0 = "1bb8953644d16f21d10718962c6702f01ea3308a";
const REPINE_LANE_SHA_V0_58_0 = "5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c";
const REPINE_LANE_SHA_V0_59_0 = "4aff99320ef484a7beac35ee3a7b7b854ec1e33f";
const REPINE_LANE_SHA_V0_59_1 = "8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b";
const STANDARDS_SYNC_SHA = "35f2684ac953794b854bac1959df00e74eeca1d9";
const REUSABLE_PATH = "melodic-software/ci-workflows/.github/workflows/osv-scanner.yml";
const REUSABLE_REFERENCE = `${REUSABLE_PATH}@${SHA}`;
Expand Down Expand Up @@ -9617,6 +9618,30 @@ test("the online link-check contract at the v0.59.0 tag copies its v0.55.0 entry
);
});

// v0.59.1 keeps both review interfaces: inputs, secrets and permissions are
// unchanged; the claude-code-action pin moves from v1.0.252 to v1.0.253 on the
// steps that receive the OAuth token (ci-workflows#838) and the findings count
// is raised to the summary's manifest flag lines (ci-workflows#848), so each
// v0.55.0 entry carries forward verbatim.
test("both review contracts at the v0.59.1 tag copy their v0.55.0 entries forward verbatim", () => {
const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
const reusables = ["pr-review", "pr-review-security"];
for (const reusable of reusables) {
const workflowPath = `melodic-software/ci-workflows/.github/workflows/${reusable}.yml`;
const previous = contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_55_0}`];
assert.ok(previous, `expected a v0.55.0 contract for ${reusable}`);
assert.deepEqual(
contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_59_1}`],
previous,
`${reusable} at the v0.59.1 tag is not a verbatim copy of its v0.55.0 entry`,
);
}
assert.equal(
Object.keys(contracts).filter((key) => key.endsWith(`@${REPINE_LANE_SHA_V0_59_1}`)).length,
reusables.length,
);
});

// Convergence as a property, never as a hardcoded SHA. The daily
// claude-lanes-repin lane rewrites these components on every ci-workflows
// release, and a test naming one revision would go red by construction on
Expand Down
Loading