fix(operations): bound workflow registry response streaming - #504
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough워크플로 레지스트리 감사와 비활성화 흐름의 입력 검증, GitHub 응답 처리, deadline, 스트리밍 제한, 변이 전후 감사 검증, 토큰 오류 정제를 강화했습니다. Changes워크플로 레지스트리 보안 강화
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to The change strengthens bounded response processing for privileged workflow-registry operations, but merge should wait because the required exact-head image validation has not yet reached terminal success and its runtime, security, and provenance checks remain unconfirmed. Sequence Diagram(s)sequenceDiagram
participant Operator
participant runWorkflowRegistryDisablement
participant collectLiveWorkflowRegistryAudit
participant GitHubTransport
participant disableWorkflow
Operator->>runWorkflowRegistryDisablement: workflow ID 전달
runWorkflowRegistryDisablement->>collectLiveWorkflowRegistryAudit: 초기 감사 요청
collectLiveWorkflowRegistryAudit->>GitHubTransport: GitHub JSON 요청
GitHubTransport-->>collectLiveWorkflowRegistryAudit: 제한된 JSON 응답
runWorkflowRegistryDisablement->>collectLiveWorkflowRegistryAudit: 변이 직전 감사 재요청
runWorkflowRegistryDisablement->>disableWorkflow: 재검증된 workflow 비활성화
runWorkflowRegistryDisablement->>collectLiveWorkflowRegistryAudit: 사후 감사 요청
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Triage note (not a merge action — this PR is already self-documented as blocked behind #500 and has no approving review yet). Current head This is the Grype embedded-runtime scan over the patch-validator image's bundled Node runtime, and it looks like a real finding rather than a flake (the rest of the job — Trivy image scan, SBOM, smoke — passed). The raw per-component Grype JSON is written to a build artifact rather than echoed to the log, so I couldn't pull the exact CVE/package from the log alone; whoever picks this up should download the Generated by Claude Code |
Root-cause diagnosis:
|
…-registry-stream-bounds Co-Authored-By: Claude <noreply@anthropic.com>
…gistry-stream-bounds Co-Authored-By: Claude <noreply@anthropic.com> # Conflicts: # scripts/lib/delegated-github-token.mjs # scripts/workflow-registry-live-audit.mjs # scripts/workflow-registry-live-disable.mjs # test/maintainer-app-token-capability.test.ts
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
2 participants
Repair authority
Canonical Noema workflow-registry privileged-transport and destructive-mutation authority lane for #226.
main@59cc1abf8531f4f151cbb9b490ccc1659adf775a;85ab7fb38b011e1a77f3cdf2c352bfa3a178d017;Current repair contract
This branch preserves fail-closed workflow-registry response handling and destructive-operation authority, including bounded streaming with no unsafe
arrayBuffer()fallback, one unchanged end-to-end request deadline, cancellation of rejected unread response bodies without replacing the owning failure, exact repository/workflow/path/status semantics, strict UTF-8/JSON authority, delegated-token closure, protected-main SHA binding, fresh active-PR ownership revalidation immediately before mutation, and immutable before/after receipt rules.The accumulated test-first lineage covers unstreamable responses, timeout/EOF races, response-body size/media/status rejection, late cleanup, protected-main drift, capability-path aliases, active-PR ownership changes, and post-mutation audit integrity.
Exact current evidence
Only unchanged exact-head evidence for
85ab7fb38b011e1a77f3cdf2c352bfa3a178d017is eligible.33316529385: terminal-success; exact checkout/live-base/lockfile control, typecheck, full release tests, release security, KPI, dependency-license inventory, acquisition manifest/integrity and final base-drift refusal passed;33316529392: terminal-success; hash-pinned dependencies, exact 100% line+branch coverage, 100% docstring coverage, authenticated/scanned distroless sandbox and real no-network CodeGraph smoke passed;33316529372: terminal-success; exact base/head OSV, exact-head Dependency Review support+gate, exact-head Trivy, and Scorecard completed successfully;patch-validator-image33316529368: terminal-success; exact-head build, static Node identity, dynamic-runtime exclusion, real no-network/read-only/non-root smoke, CycloneDX SBOM, static/embedded runtime vulnerability receipts, exact-source/image receipt verification and stale-head refusal all passed;Central security authority
The live organization ruleset
18794436requires.github/workflows/security-scan.yml@refs/heads/mainon Noema's default branch, has no bypass actors, and reportscurrent_user_can_bypass=never.Central
.github/mainadvanced after this Security Scan run from parent6ffd8f8a03999cae6420c3b0b970be19f0d52386to1ff8268255b061461d9d49b4cab4febf9a8e7bfa, but the requiredsecurity-scan.ymlblob is unchanged at148e944310593958d7c6dd96590c5327a0c4b355. Therefore the successful exact-head Security Scan was produced under the same required-workflow source bytes that are live now; no stale scanner-generation evidence is being transferred.Merge boundary
This exact head is technically merge-eligible only while head/base/governance remain unchanged and no valid unresolved finding appears. Source/check evidence does not synthesize external workflow-registry/OIDC production postconditions. Central
.github, naruon, contextual-orchestrator, and other dedicated-writer repositories remain read-only source dependencies.