Repository navigation
feat(OMN-11143): add OmniGate Sigstore signer - #1630
Merged
jonahgabriel merged 2 commits intoMay 18, 2026
Merged
jonahgabriel merged 2 commits into
jonahgabriel merged 2 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com>
|
jonahgabriel
merged commit May 18, 2026
2c96207
into
jonah/omn-11142-omnigate-executor
6 checks passed
jonahgabriel
added a commit
that referenced
this pull request
May 20, 2026
* feat(gate): add omnigate check executor * feat(OMN-11143): add OmniGate Sigstore signer (#1630) * feat(OMN-11143): add OmniGate Sigstore signer * feat(OMN-11144): add OmniGate PR verifier action (#1631) Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com> --------- Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com> * test(OMN-11142): add integration coverage for OmniGate executor Adds tests/integration/gate/test_omnigate_executor_integration.py and pins omnibase-core to PR #1088 head SHA (OmniGate models) until that branch lands in a tagged release. The new integration test exercises the real bash -eo pipefail subprocess path, real stdout/stderr capture, real secret-pattern scanning, and the validator-registry composition path — none of which the unit suite covers because it patches subprocess.run. Pin will revert to a tagged omnibase-core release after PR #1088 merges. * fix(OMN-11142): resolve CodeRabbit and CodeQL findings on OmniGate executor - gate/__init__.py: switch to eager top-level imports so __all__ names are statically visible to CodeQL (closes CodeQL "explicit export not defined" findings 1-8). Eager imports are fine here because the stacked-core branch dependency is now satisfied by the pinned PR #1088 head SHA, removing the need for lazy loading. - gate/signer.py: gate `AbstractContextManager` import behind TYPE_CHECKING so CodeQL stops flagging it as unused while keeping the runtime-string cast valid (closes CodeQL "unused import" #9). - gate/executor.py: add `redact_if_secret_bearing()` public helper so the validator path can scrub secret-bearing strings. - gate/validator_registry.py: redact secret-bearing previews before writing them to receipts; drop raw exception text in failure receipts in favor of the exception class name (closes CR threads 13, 14). - gate/action_verify.py: drop raw exception text from decision reasons and add a 10s timeout to `git cat-file` (closes CR threads 11, 12). * chore: retrigger receipt-gate with updated PR body (Evidence-Source: OCC#1121) * ci(OMN-11142): retrigger CI after transient runner network failures * fix(OMN-11142): remove redundant casts in OmniGate gate module mypy --strict flagged two [redundant-cast] errors in PR 1626: - signer.py: canonical_receipt_payload already returns bytes; cast removed. - validator_registry.py: EntryPoint.load() can be called directly without casting entry_point through EntryPoint first. Cleans up newly unused imports (EntryPoint, cast) in validator_registry. Evidence-Source: OCC#1121 Evidence-Ticket: OMN-11142 * fix(OMN-11142): use sigstore Bundle.from_json and advance core pin Replace removed sigstore.verify.VerificationMaterials with sigstore.models.Bundle.from_json (removed in sigstore>=4.0.0; the verify path would have raised KeyError at runtime). Update signer mocks to the new module path. Advance omnibase_core pin to a rev that ships the omnibase_core.gate module (receipt_canonical), which resolves the mypy no-any-return on serialize_for_signing and lets the gate unit tests import. Register the new gate module in the test-selection adjacency map so test_every_src_module_has_adjacency_entry passes. * test: allow omnigate validator callable protocol --------- Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com>
jonahgabriel
added a commit
that referenced
this pull request
May 20, 2026
* feat(gate): add omnigate check executor * feat(OMN-11143): add OmniGate Sigstore signer (#1630) * feat(OMN-11143): add OmniGate Sigstore signer * feat(OMN-11144): add OmniGate PR verifier action (#1631) Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com> --------- Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com> * test(OMN-11142): add integration coverage for OmniGate executor Adds tests/integration/gate/test_omnigate_executor_integration.py and pins omnibase-core to PR #1088 head SHA (OmniGate models) until that branch lands in a tagged release. The new integration test exercises the real bash -eo pipefail subprocess path, real stdout/stderr capture, real secret-pattern scanning, and the validator-registry composition path — none of which the unit suite covers because it patches subprocess.run. Pin will revert to a tagged omnibase-core release after PR #1088 merges. * fix(OMN-11142): resolve CodeRabbit and CodeQL findings on OmniGate executor - gate/__init__.py: switch to eager top-level imports so __all__ names are statically visible to CodeQL (closes CodeQL "explicit export not defined" findings 1-8). Eager imports are fine here because the stacked-core branch dependency is now satisfied by the pinned PR #1088 head SHA, removing the need for lazy loading. - gate/signer.py: gate `AbstractContextManager` import behind TYPE_CHECKING so CodeQL stops flagging it as unused while keeping the runtime-string cast valid (closes CodeQL "unused import" #9). - gate/executor.py: add `redact_if_secret_bearing()` public helper so the validator path can scrub secret-bearing strings. - gate/validator_registry.py: redact secret-bearing previews before writing them to receipts; drop raw exception text in failure receipts in favor of the exception class name (closes CR threads 13, 14). - gate/action_verify.py: drop raw exception text from decision reasons and add a 10s timeout to `git cat-file` (closes CR threads 11, 12). * chore: retrigger receipt-gate with updated PR body (Evidence-Source: OCC#1121) * ci(OMN-11142): retrigger CI after transient runner network failures * fix(OMN-11142): remove redundant casts in OmniGate gate module mypy --strict flagged two [redundant-cast] errors in PR 1626: - signer.py: canonical_receipt_payload already returns bytes; cast removed. - validator_registry.py: EntryPoint.load() can be called directly without casting entry_point through EntryPoint first. Cleans up newly unused imports (EntryPoint, cast) in validator_registry. Evidence-Source: OCC#1121 Evidence-Ticket: OMN-11142 * fix(OMN-11142): use sigstore Bundle.from_json and advance core pin Replace removed sigstore.verify.VerificationMaterials with sigstore.models.Bundle.from_json (removed in sigstore>=4.0.0; the verify path would have raised KeyError at runtime). Update signer mocks to the new module path. Advance omnibase_core pin to a rev that ships the omnibase_core.gate module (receipt_canonical), which resolves the mypy no-any-return on serialize_for_signing and lets the gate unit tests import. Register the new gate module in the test-selection adjacency map so test_every_src_module_has_adjacency_entry passes. * test: allow omnigate validator callable protocol --------- Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
Stacked on OMN-11142 / PR #1626.