Phase 6d: github runner port - #62
Closed
grubmeshi wants to merge 1 commit into
Closed
Conversation
Port PLAN_DETAIL_06D_github.md: the GITHUB_WORKFLOW persona in Go.
- App-JWT auth chain, stdlib RS256 (crypto/rsa SignPKCS1v15 + x509.ParsePKCS1PrivateKey),
no JWT dependency (§4.2/§16.13); whitespace-tolerant PKCS#1 parsing matching Kotlin (G-P2).
- githubClient: 5 REST calls, frozen headers, actions=write permission gate, 422
unsupported-input heuristic (pure classify fn), validated run/job status enums.
- Dual input modes: Mode A base64-JSON run object (impl stripped to {type}, G-P10 leak
hygiene, json.Number fidelity D8), Mode B url+token+conditional-endpoint table.
- In-handler sync poller: heuristic find-window (5 newest, -30s, 12x10s), 30m poll budget,
job-step batches (trigger step in first batch, completed-job re-report quirk G-P4),
terminal update from conclusion; ctx-cancel reports terminal ABORTED (never SUCCEEDED).
- Config compat (blockrunner: block, private-key order, SPRING_PROFILES_ACTIVE alias),
cert/NoOp decryptor, event-driven reporter seam, R12 single-run exit (G-P11 tightening).
- Persona wiring: cmd/github (+ bbrunner github subcommand), mgmt on 8102, per-app
Dockerfile + runner-config.yml (baked dev key, umbrella §10.5).
- Gate: thresholds += internal/github 90 (91.3%, no exclusions), depguard github group.
Template fit-check (§4.6) passed unchanged. Because 06B is not landed in this base
(phase-6a-manual), the ExternalCallError/DecryptInputs shapes it promised are implemented
package-locally for now and should be reconciled to the shared meshapi twins at
consolidation. JVM teardown (steps 10-11) and CI flips are deferred to consolidation to
keep this slice disjoint from the parallel 6b/6c siblings.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 6d — github runner port
Fourth of the four stacked Kotlin→Go port PRs. Base:
phase-6c-azdevops.Ports the GitHub Actions
workflow_dispatchrunner to Go (internal/github,cmd/github,cmd/bbrunner github, container): App JWT (stdlib RS256 + tolerant PKCS#1, no external JWT lib) → installation token → dispatch → async handover / sync poll.internal/githubnew at 91.3% (gate 90). Build, race tests, lint (0 issues), coverage gate all pass on the full stacked tree (all 11 gates PASS).Consolidation notes
personaGithubincmd/bbrunner; apersonaGithubregistration assertion was added tocmd/bbrunner/main_test.go(missing in the original slice) so all four phase-6 personas are pinned.PLAN_DETAIL_06D_github.mdcopied in from the plan branch (was absent) so the §4.6 Template fit-check subsection lives with the sub-plan, matching 06B/06C.Fit-check reconciliation (flagged)
PLAN_DETAIL_06D §4.6 assumed github would consume a shared
meshapi.DecryptInputsand a sharedExternalCallError. In the landed stack neither is consumed by github, and this is consistent rather than divergent:ExternalCallErroris package-local in ALL three ports (06B put it ininternal/gitlab, not meshapi) — each persona classifies its own external-call failures, so there is no shared type to consume.[]runInput, which neither the byte-basedmeshapi.DecryptInputsnor the typedmeshapi.DecryptInputSpecscan express, so it keeps a package-local decode+decrypt path plus a package-localDecryptortwin — the same choiceinternal/tfalready makes. Details inCROSS_REPO_TODO.md(phase-6d).Sanctioned deltas / deferrals
github-block-runner/,block-runner-core/, Gradle machinery; flip CI) deferred to the acceptance-gated flip PR.Content-Type(§16.2), deterministic sorted permission-map rendering (§16.5), unifiedClockfor JWT+poll (§16.9), single-run exit tightening (G-P11).🤖 Generated with Claude Code