feat(ops): audit and safely disable orphaned Actions identities - #497
feat(ops): audit and safely disable orphaned Actions identities#497seonghobae wants to merge 47 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthrough보호 브랜치의 SHA와 전체 워크플로 레지스트리를 대조하는 감사 CLI와, 검토된 활성 고아 워크플로만 비활성화하는 dry-run 우선 정리 CLI를 추가했습니다. SHA·경로·상태를 재검증하고 사후 감사 결과를 확인합니다. Changes워크플로 레지스트리 운영
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to This PR adds workflow-identity auditing and explicitly authorized cleanup, but the current head is not merge-ready because audit results may be incomplete or incorrectly handled in several edge cases, cleanup requests may wait indefinitely, and required exact-head checks and approval are still pending. Sequence Diagram(s)sequenceDiagram
participant Operator
participant workflow_registry_cleanup
participant workflow_registry_audit
participant GitHub_Actions_API
Operator->>workflow_registry_cleanup: --apply와 검토된 workflow ID 전달
workflow_registry_cleanup->>workflow_registry_audit: 보호 브랜치 감사 실행
workflow_registry_audit->>GitHub_Actions_API: SHA·워크플로·트리 증거 조회
GitHub_Actions_API-->>workflow_registry_audit: 감사 증거 반환
workflow_registry_cleanup->>GitHub_Actions_API: 대상 SHA·identity 재검증
workflow_registry_cleanup->>GitHub_Actions_API: workflow disable API 호출
GitHub_Actions_API-->>workflow_registry_cleanup: disabled_manually 상태 반환
workflow_registry_cleanup->>workflow_registry_audit: 사후 감사 실행
Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent Review exact current head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent review Please submit an independent formal review for exact current head |
|
@opencode-agent @cwl-noema-review Please perform a fresh independent formal review of exact current head |
|
@opencode-agent Request independent review for exact current head |
Pull request was converted to draft
|
@coderabbitai review Please review exact current head |
|
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head094739e8bd9d8e778854c447bb84ef3c957aa07d. -
Head SHA:
094739e8bd9d8e778854c447bb84ef3c957aa07d -
Workflow run: 32123435753
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: workflow-registry-audit.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: workflow-registry-audit.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (2 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (4 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (4 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: workflow-registry-audit.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: workflow-registry-audit.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (2 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (5 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (5 files)"]
R4 --> V4["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head60e675e2ca9605de047cc0511f7c1a85ac25d567. -
Head SHA:
60e675e2ca9605de047cc0511f7c1a85ac25d567 -
Workflow run: 32165987915
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 2
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: workflow-registry-audit.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: workflow-registry-audit.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script (2 files)"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (5 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (5 files)"]
R4 --> V4["targeted test run"]
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
opencode-agent
Bot
added
priority: medium
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Buyer and operator impact
ScopeWeave has a bounded control-plane path from proof to authorized remediation for stale GitHub Actions registry identities. Deleting workflow YAML is not enough: the read-only detector reconciles a live Actions-registry observation against one unchanged protected
developtree, and the separate operator command can disable only an explicitly reviewed subset of exact workflow IDs after fresh fail-closed checks.This remains a bounded executable slice of #478. It does not claim that live orphan identities have already been disabled or that #478 is closed.
Exact current identity
develop@2c328875e00e86537df3e965170be80532571cad;9d23bbf5768f41542f3b3c5eac75d17220b0dcf0;feat/workflow-registry-audit-478;fix(ops): bound GitHub registry audit reads;Any contributor-head, protected-base, review, required-gate, or workflow-registry movement invalidates revision-sensitive evidence until freshly reconciled.
Read-only and authorized-cleanup contract
The audit:
unresolvedrather than guessing inactive/active semantics;.github/workflowsdirectory through immutable commit/tree evidence instead of trusting an ambiguous Contents 404;AbortSignal.timeout(...), preventing the read-only registry audit from hanging indefinitely on a stalled provider request.The registry itself is a live control-plane read and is not commit-addressable; the protected-tree side is SHA-bound, and the start/end protected-branch equality check proves that the tree used for classification did not move during the audit window.
Mutation remains dry-run by default and requires explicit
--apply, an exact protected SHA, explicit reviewed positive safe-integer workflow IDs, Actions-write authorization, zero unresolved identities, currentactive_orphanclassification, per-target live preflight, exact-ID disable, and fresh postcondition audit on the same protected SHA. The cleanup path also rejects option-token consumption in value flags and bounds each disable request.Current-head review state
The latest Devin review on exact head
9d23bbf...posted informational observations only:disabled_manuallyverification but remains sufficient in combination with the zero-unresolved requirement;Historical OpenCode
CHANGES_REQUESTEDreviews target predecessor heads (094739e...,60e675e...) and failed organization-owned coverage evidence. They do not transfer to exact head9d23bbf.... CodeRabbit/Devin COMMENTED reviews are supplementary, not independent approval.Current exact-head workflow truth
All six repository workflow runs associated with exact contributor head
9d23bbf5768f41542f3b3c5eac75d17220b0dcf0are terminal GitHub-success:32463473601— success;32463473635— success;32463473633— success;32463474085— success;32463473658— success; and32463473698— success.These labels are not promoted to immutable contributor-head merge authority while the known revision-evidence defects remain unresolved. ScopeWeave #523 owns repository-native exact-head Server Tests/coverage integrity. The organization-owned reusable exact-head SAST/Security repair remains in the existing central
.githubowner path. Predecessor, synthetic-only, status-only, model-only, pending, skipped, absent, stale, author-only, or infrastructure-only evidence is non-authorizing.Operational completion boundary
After protected integration and authorization, #478 still requires a fresh complete registry audit, review of current PR/non-default-branch writer ownership for every candidate, explicit preservation/non-selection of legitimate active identities, an exact-SHA apply naming only reviewed IDs, and a second live inventory proving selected orphans are disabled while supported ScopeWeave automation remains operational and no unresolved registry identity remains.
Merge gate
Do not merge or enable auto-merge until the unchanged exact head remains reconciled to freshly resolved protected
develop, repository/organization exact-head evidence controls are protected-shipped and regenerated on this exact head, every applicable functional/browser/owned statement-branch-function-line coverage/docstring/CodeQL/SAST/security/dependency/supply-chain/package/provenance gate is substantively terminal-passing under corrected contracts, valid unresolved current-head defects are zero, and a qualifying independent current-head/last-push approval exists under live rulesets.Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic-only, status-only, author-only, model-only, rate-limited, or infrastructure-only evidence is non-passing.
Refs #478