Phase 6b: gitlab runner port - #60
Closed
grubmeshi wants to merge 1 commit into
Closed
Conversation
Ports PLAN_DETAIL_06B_gitlab.md, reusing the 06A manual template unchanged (handler
shape, event-driven report.Reporter seam, config compat, persona wiring, Dockerfile
pattern). Additive and always-green: the Kotlin gitlab-block-runner module and its
Gradle/CI legs are untouched (removal + the acceptance gate + the meshfed-release
touch-points are deferred to the flip PR, see CROSS_REPO_TODO.md — they need a live
GitLab/meshStack this environment can't provide).
Umbrella-assigned shared artifacts shipped here (first consumer, per 06A §4.4/§17):
- meshapi.Decryptor + CertDecryptor/NoopDecryptor: the shared decrypt seam every
phase-6 port injects, with the Kotlin decrypt("") == "" empty-string guard (T8/G-P11)
the underlying crypto lacked.
- meshapi.DecryptInputs: decrypts ONLY sensitive STRING/CODE/FILE input values
(Kotlin's decryptBlockRunInputs asymmetry, umbrella §7.6) — the structural fix so an
outbound payload can never carry a decrypted implementation secret. Table-driven
tests incl. a real-keypair cross-check and the secret-hygiene leak assertion.
- gitlab.ExternalCallError: the MeshHttpException equivalent (06A §4.4 shape), with the
four-way GitLab error classification (404 / identity-verification / generic /
undeserializable body) collapsing into the one wire-visible FAILED update Kotlin sends.
Gitlab persona (internal/gitlab, cmd/gitlab, bbrunner gitlab subcommand):
- One external POST (multipart trigger payload: token/ref/MESHSTACK_BEHAVIOR/
MESHSTACK_RUN + env/non-env inputs + the four callback URLs, missing-link ⇒ omit),
redirects disabled at the client (G-P10), base-URL sanitization ported from
UrlSanitizerService.
- Always-async handover (D9): register one PENDING gl-trigger step, then exactly one
final update — IN_PROGRESS+SUCCEEDED on a successful trigger, FAILED+FAILED on any
trigger-path failure — never a terminal SUCCEEDED from the runner itself.
- Polling (dispatch.Loop + InProcess, mgmt on 8103, PORT alias) and single-run (file
source, NoOp decryptor — the k8s controller pre-decrypted both inputs and the trigger
token, §2.6 caveat pinned as-is — R12 exit rule).
- New shared top-level base containers/runner-config.yml (deep-merged under the
per-impl file, base < per-impl < env): carries the well-known dev private key shared
by gitlab/azdevops/github, re-wrapped into standard multi-line PEM (Go's stdlib
encoding/pem rejects the Kotlin classpath's unbroken single-line form; DER bytes are
byte-identical, verified in internal/config/basekey_test.go).
Coverage gate: internal/gitlab joins thresholds.txt at 90 (measures 92.1%, no
exclusions) via the scenario suite (meshapitest + a fake GitLab httptest server) plus
keep-as-unit tables for the pure mappings (valueString, sanitizeBaseUrl, error
classification). Manually verified end-to-end via `docker build` + `docker run` against
a hand-rolled mock meshfed API: claim → register → trigger attempt → FAILED report all
observed with the exact pinned message shapes.
Kotlin pin tests (G-P1–G-P13) were not added — gradle is not runnable in this
environment and the module isn't being modified/removed in this commit; recorded as a
flagged follow-up in CROSS_REPO_TODO.md rather than silently skipped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 6b — gitlab runner port
Second of the four stacked Kotlin→Go port PRs. Base:
phase-6a-manual.Ports the GitLab CI/CD-trigger runner to Go (
internal/gitlab,cmd/gitlab,cmd/bbrunner gitlab, container). Async handover per D9: register → one final IN_PROGRESS+SUCCEEDED or FAILED+FAILED update. Ships the umbrella-assigned shared artifacts first:internal/meshapi/decryptor.go— sharedDecryptor/CertDecryptor/NoopDecryptor(theCertDecryptorempty-string guard reproduces Kotlindecrypt("") == "", T8/G-P11).internal/meshapi/decryptinputs.go— byte-basedDecryptInputs(raw run JSON in/out, byte-preserving forwarding forMESHSTACK_RUN, §16.6) preserving the impl-secret-vs-input decryption asymmetry structurally.containers/runner-config.yml— the shared base config layer carrying the well-known dev private key.internal/gitlabnew at 92.1% (gate 90). Secret-hygiene leak test provesMESHSTACK_RUNnever carries the decrypted trigger token while sensitive STRING/CODE/FILE inputs are decrypted. Build, race tests, lint (0 issues), coverage gate all pass on the stacked tree.Sanctioned deltas / deferrals
encoding/pemrefuses; re-wrapped the identical DER bytes into standard multi-line PEM (internal/config/basekey_test.goproves byte-parity). Load-bearing for 06C/06D.CROSS_REPO_TODO.md); plan §15 confirms gitlab needs no mandatory cross-repo edits.🤖 Generated with Claude Code