Repository navigation
fix(OMN-16152): route dependabot into the fork fail-closed lane in Application Database Domain Enforcement - #2780
Conversation
…plication Database Domain Enforcement GitHub withholds all repo secrets from dependabot-triggered pull_request runs even when the head branch is same-repo (not a fork). The "Checkout exact service ownership dependency" step's if: only tested for fork-vs-same-repo, so dependabot PRs were routed into the CROSS_REPO_PAT-gated checkout of the private omninode_infra repo with an empty token -- actions/checkout treats an explicitly-passed empty token as required-and-missing rather than falling back to github.token, so the step hard-fails with "Input required and not supplied: token" on every dependabot PR. Extend the existing fork fail-closed lane (already proven for fork PRs) to cover github.actor == 'dependabot[bot]' too: the CROSS_REPO_PAT checkout and the "trusted" SQL-enforcement step now skip for dependabot, and the "public fork, fail closed" step's condition now also fires for dependabot so it still gets a real (narrower) SQL-enforcement pass. The job itself still completes to a genuine success -- no ci_summary_gate.py changes needed.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 24 minutes Limit details: You’ve used the included review currently available. Your 116 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Comment |
✅ Hostile Reviewer — PASSEDBlocking findings (critical): 0 Gate semantics (pilot phase)
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524) |
#6652) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2780 * evidence: OCC companion self-bind for #6652 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai> Co-authored-by: Jonah Gray <jonah@omninode.ai>
1 participant
Summary
All 6 open dependabot PRs (#2773-#2778) fail the required
Application Database Domain Enforcement (OMN-15361)job withInput required and not supplied: token. Root cause:github.event.pull_request.head.repo.full_name == github.repositoryis TRUE for dependabot PRs (same-repo branch, not a fork), so the "Checkout exact service ownership dependency" step'sif:routed dependabot into the CROSS_REPO_PAT-gated checkout of the privateomninode_infrarepo. GitHub withholds all repository secrets from dependabot-triggeredpull_requestruns by design (independent of fork status, and independent of the secret's own validity -- this is not the OMN-16107/OMN-16085 "PAT expired" class), sosecrets.CROSS_REPO_PATresolves to an empty string, andactions/checkouttreats an explicitly-passed emptytoken:as required-and-missing rather than falling back togithub.token.This job already has a proven fail-closed narrow lane for exactly this problem shape -- the fork case. The "Enforce schema qualification in changed SQL (public fork, fail closed)" step skips the CROSS_REPO_PAT-gated checkout entirely and validates against only the public omnimarket ownership manifest. This PR extends that lane's condition, and the two "trusted" steps' guard conditions, to also cover
github.actor == 'dependabot[bot]'.The job itself keeps running to a genuine SUCCESS for dependabot PRs (it is not skipped) -- no
ci_summary_gate.py/ACTOR_CONDITIONAL_CONTEXTSchange is needed, since that mechanism exists for jobs whose check-run never materializes at all, which is not this case.Does NOT widen secret scope to dependabot -- the narrower lane simply omits the private manifest, same as the fork case.
Test plan
test_cross_repo_pat_lane_is_dependabot_fail_closed_toointests/ci/test_application_database_domain_enforcement_contract.py, confirmed failing against the unfixed workflow.tests/ci/test_application_database_domain_enforcement_contract.py(26 tests) andtests/ci/test_ci_workflow_resilience.py(34 tests) pass with no regressions.ruff format/ruff checkclean;pre-commit run --filesclean on both changed files.Application Database Domain Enforcement (OMN-15361)readssuccess.OMN-16152
Evidence-Ticket: OMN-16152
Evidence-Source: OCC#6652