Repository navigation
test(OMN-20298): positive control, do not merge - #4428
Closed
jonahgabriel wants to merge 15 commits into
Closed
jonahgabriel wants to merge 15 commits into
jonahgabriel wants to merge 15 commits into
Conversation
…m the deploy-source tree, not the lanes' canonical clones (#4401) deploy-agent-dev took OMNI_HOME from the operator env store (/data/omninode/omni_home, the lanes' tree), so RT-1's clean checkout detached and clean -ffdx'd omnimarket, omnibase_core and omnibase_compat there on every dev job, and the clone guard refused every in-process delegate on the host. The unit now declares OMNI_HOME=/data/omninode, the root reconcile-host converges and locks under (OMN-20154), and protects the name from the env store. Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
…us costs the slowest host, not the sum (#4403) Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
Onex-Workflow: Lane census refresh (OMN-18606) Onex-Run: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/36829703055 Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
…ack only (#4410) The collaborator lane broker runs with admin_api_require_auth false and published its Admin API on every host interface (55644:9644). Bind it to 127.0.0.1, keeping the OMN-17143 reserved host port 55644. The governance boundary test's port scrape now also reads a loopback-prefixed publish and asserts it still sees 55644. Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
#4409) omnimarket#3172 adds node_projection_savings 093_savings_series_persisted_baseline.sql, which replaces projection_delegation_savings_series so it never invents a baseline for event-only rows, and sets security_invoker back after the replace. The node-migration vendor-parity gate requires the vendored copy here first. Byte-for-byte copy of omnimarket be7062387 (sha256 3c53f906...). Numbered 093 so it applies after the infra-side 092_restore_savings_views_security_invoker.sql. test_real_forward_corpus_preserves_invoker_rights fails on the pre-fix copy and passes on this one.
* chore(OMN-13912): post-release dev version bump to 0.38.62 Disarms the OMN-13412 release-identity gate that publishing v0.38.61 armed against dev. Triggered-by: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/36839193167 * fix(OMN-13912): regenerate the runner image identity lock for the 0.38.62 bump --------- Co-authored-by: onexbot-occ-writer[bot] <onexbot-occ-writer[bot]@users.noreply.github.com> Co-authored-by: jonahgabriel <jonah.gabriel@gmail.com>
…oted reserved key word as a relation target (#4413) * fix(OMN-20201): the application-database SQL lint never reads an unquoted reserved key word as a relation target Audit row I21. The relation-target patterns landed on SQL grammar: ALL in GRANT ... ON ALL TABLES IN SCHEMA, OR and THEN after the LIKE operator once its literal is blanked, TRUE and FALSE in CHECK (x IS TRUE). Unquoted, a PostgreSQL fully reserved key word cannot name a relation, so _record_sql_target now returns for any of them; this replaces the narrower true/false guard from OMN-17486. A quoted identifier is still held to the lint. Over all 477 tracked .sql files the change removes six findings and adds none. Six baseline rows are removed: the four the fix makes stale (all twice, or, then) and the true/false rows the OMN-17486 guard had already made stale. Version 0.38.62 for the release-identity gate. Evidence-Ticket: OMN-20201 * test(OMN-20201): the SQL lint over the real corpus and the frozen baseline holds no reserved key word target Evidence-Ticket: OMN-20201 * chore(OMN-20201): regenerate the runner image identity for the 0.38.62 lockfile Evidence-Ticket: OMN-20201 --------- Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
…nly (#4408) * fix(OMN-20260): publish the dev lane Redpanda admin API on loopback only The base compose file published the Redpanda Admin API on every host interface while admin_api_require_auth is false, so any LAN or tailnet host could create SCRAM users and rewrite cluster config on the lab dev lane. Bind the publish to 127.0.0.1, the shape the dev-105/dev-200/dev-202 overlays already use. In-network consumers use redpanda:9644 and are unaffected. The private-IP security scan now exempts exactly a loopback port publish, with a control proving a loopback host dependency still fails. * fix(OMN-20260): move the keycloak provenance citation to its new infra compose line The loopback admin publish comment adds eight lines above KC_DB_USERNAME in docker/docker-compose.infra.yml, so the in-repo provenance citation in test_application_database_acl_connect_inputs.py moves 891 -> 899. The merge group run caught it (Tests Split 1/15). --------- Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
…s by run id, so a page that hides the newest run cannot decide (#4416) Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
…4415) Onex-Workflow: Publish downstream pin bumps Onex-Run: https://github.com/OmniNode-ai/omnibase_core/actions/runs/36845876557 Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
…ants (#4418) * feat(OMN-20260): gated apply path for governed-lane compose-config grants scripts/apply_governed_compose_config.py consumes the new compose_config grant kind (onex_change_control grants/governed_lane_grants.yaml, read at @main only). It refuses unless the grant matches the lane and project, is unexpired, unconsumed and not self-granted, the checkout is at compose_ref with the grant's compose files unmodified, and the in-process docker compose config digest equals rendered_digest. --execute then runs the OMN-15218 attribution preflight and recreates exactly the granted services with up -d --no-deps --no-build. * fix(OMN-20260): the apply path interpolates with the operator env file, as deploy-runtime.sh does --------- Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
) * chore(OMN-17292): advance omnimarket contract pin to 303aff486dfb [bot] Onex-Workflow: Omnimarket contract pin refresh Onex-Run: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/36827032339 * fix(OMN-17292): delete the provider_quota_state bridge entry now that the omnimarket pin declares it The pinned omnimarket contracts derive provider_quota_state (omnimarket#3134), so the supplemental legacy-migration declaration and its _INTERIM_ENTRIES row are redundant. Regenerated instances are byte-identical. * test(OMN-17292): prove the provider_quota_state bridge retirement keeps migrations and writer grants * test(OMN-17292): drop the vendor test that asserts the retired provider_quota_state bridge The bridge entry was deleted by this PR now that the pinned omnimarket contract declares the table. test_bridge_derives_the_shipped_table_grant on dev still required exactly one LEGACY_MIGRATION_TABLE_DECLARATIONS entry for provider_quota_state, so Tests (Split 7/15) failed in every merge group. Its shipped-grant half is already proven by test_provider_quota_state_bridge_retired_omn17292.py. --------- Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com> Co-authored-by: jonahgabriel <jonah.gabriel@gmail.com>
* chore(deps): bump omnibase_core to 0.47.28 Automated dependency cascade from OmniNode-ai/omnibase_core release 0.47.28. Onex-Workflow: Release Onex-Run: https://github.com/OmniNode-ai/omnibase_core/actions/runs/36845730794 * fix(OMN-18595): regenerate runner image lock for the omnibase-core 0.47.28 bump --------- Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com> Co-authored-by: jonahgabriel <jonah.gabriel@gmail.com>
Moves canonical handler-shape, flip-bundle seam, and Plugin* lifecycle guards out of the lint job into independent CI jobs to prevent skip-on-failure via `needs: [occ-preflight, route]`. Adds canonical-handler-shape-gate, no-plugin-daemon-classes-gate, and shape-gate-independence jobs in .github/workflows/ci.yml. The latter validates detector independence using pinned omnibase_core commit 5220ecf1758b4475c2963ec13171b6431fdc2224 (PR 1833 head). Updates STRICT_GATE_JOBS in scripts/ci/ci_summary_gate.py and config/runner_routing_policy.yaml. Adds pre-commit hook check-shape-gate-independence and new test tests/ci/test_shape_gate_jobs_independent_omn20298.py. Adjusts tests/ci/test_lint_validator_runner.py for the new job structure.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
605
to
+677
| @@ -672,15 +674,70 @@ jobs: | |||
| --baseline scripts/ci/canonical_handler_shape_baseline.py \ | |||
| --receipts-dir scripts/ci/adequacy_receipts | |||
|
|
|||
| - name: Run mypy type checking | |||
| # OMN-18640: scripts/deploy-agent/deploy_agent is IN the scope. It is | |||
| # the code that runs every deploy on the lab lane and it sat outside | |||
| # the type gate carrying ten errors, three of which were functions | |||
| # declared to return `str` while returning `Any`. Its tests have their | |||
| # own workflow because it is a standalone uv sub-project; its TYPES are | |||
| # checked here, with the root project's mypy, because that is where | |||
| # this repository declares type scope. | |||
| run: uv run mypy src/omnibase_infra scripts/deploy-agent/deploy_agent | |||
| no-plugin-daemon-classes-gate: | |||
| name: No Plugin Daemon Classes Gate (OMN-20298) | |||
| runs-on: >- | |||
| ${{ | |||
| (github.event_name == 'pull_request' && | |||
| github.event.pull_request.head.repo.full_name != github.repository) | |||
| && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]') | |||
| || fromJSON((github.event_name == 'merge_group' && vars.OMNI_REQUIRED_CI_RUNS_ON_JSON) || vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]') | |||
| }} | |||
| timeout-minutes: 30 | |||
| steps: | |||
| - name: Checkout code | |||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |||
| with: | |||
| fetch-depth: 2 | |||
|
|
|||
| - name: Setup Python and uv | |||
| uses: ./.github/actions/setup-python-uv | |||
| with: | |||
| python-version: ${{ env.PYTHON_VERSION }} | |||
| uv-version: ${{ env.UV_VERSION }} | |||
| cache-version: ${{ env.CACHE_VERSION }} | |||
| cache-enabled: "false" | |||
|
|
|||
| # OMN-19613: the guard is an AST check on each file's own classes, so a | |||
| # file the PR did not touch cannot turn it red. On pull_request it scans | |||
| # only the PR's files; it scans the whole tree on push (which proves the | |||
| # merged union on dev, OMN-18835), merge_group and dispatch, when the PR | |||
| # changes .pre-commit-config.yaml or this workflow, when the PR moves the | |||
| # omnibase-core pin in uv.lock (the validator's code lives in core), and | |||
| # whenever the base cannot be resolved. The step always runs; only the | |||
| # file list narrows, so the check never goes missing from a PR. | |||
| - name: Check Plugin* lifecycle class guard (OMN-13284, relocated to omnibase_core) | |||
| env: | |||
| EVENT_NAME: ${{ github.event_name }} | |||
Comment on lines
678
to
717
Comment on lines
+5
to
+6
| uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@52851458622f368c3b596c82bf810bc6acce1d5e | ||
| canonical-inference-gate: |
Comment on lines
+7
to
+10
| needs: occ-preflight | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - run: echo canonical-inference |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scratch PR planting a detector job behind the preflight. The Shape-Gate Independence job must fail. Closed and branch deleted after the run.