Repository navigation
feat(OMN-16513): add OMNI_SECURITY_SCAN_RUNS_ON_JSON seam to security-scan jobs - #2038
Merged
Merged
Conversation
…-scan jobs Stage 0b of the cloud CI offload plan (docs/plans/2026-08-23-cloud-ci-offload-plan.md, Rev 4, §3 Stage 0b + §3.0b-M). This workflow has four distinct job classes routed through OMNI_TRUSTED_CI_RUNS_ON_JSON (137 infra job-sites) -- not CodeQL-only, so the seam is named OMNI_SECURITY_SCAN_RUNS_ON_JSON rather than OMNI_CODEQL_RUNS_ON_JSON to avoid understating its own blast radius (the same error the plan's F2 finding raised against Rev 1's original OMNI_DOCKER framing). Adds OMNI_SECURITY_SCAN_RUNS_ON_JSON as first-choice on runs-on for: - dependency-scan (:38-42) - codeql (:139-143) - container-scan (:183-187) - iac-scan (:284-288) falling back to OMNI_TRUSTED_CI_RUNS_ON_JSON, then self-hosted -- identical shape to the OMNI_DOCKER_CI_RUNS_ON_JSON pattern in omnibase_infra's docker-build.yml. secret-scan (hardcoded ubuntu-latest already) is untouched -- out of scope per the plan's 4-site table. The OMNI_PUBLIC_PR_RUNS_ON_JSON fork-PR branch is untouched on all four sites. Note: this workflow has no pull_request trigger (schedule + workflow_dispatch + push:[main,'hotfix/**'] only), so the fork-PR branch on these selectors is dead code today -- unchanged by this edit, just recorded per §3.0b-M's own observation. No variable is set in this PR. Unset means a no-op fallthrough to existing OMNI_TRUSTED_CI_RUNS_ON_JSON behavior. Variable set + trigger-aware canary (workflow_dispatch on main, since no pull_request trigger exists here) is a follow-up step per §3.0b-M, not part of this workflow edit.
|
Warning Review limit reachedNext included review available in 47 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 124 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
Comment |
Contributor
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. |
Contributor
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical/error findings | No |
blocked |
CRITICAL or ERROR findings found | Yes |
degraded |
Reviewer ran but every model failed mid-run | No (pilot) |
infra_error |
cli_review failed to run at all (install/crash) after 2 attempts | Yes |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)
jonahgabriel
pushed a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Aug 25, 2026
…7075) * evidence: OCC companion pass 1 for OmniNode-ai/omniclaude#2038 * evidence: OCC companion self-bind for #7075 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
jonahgabriel
added a commit
that referenced
this pull request
Aug 26, 2026
…verted by #2038 (#2046) Re-lands #2034, which merged and was reverted 34 minutes later. ## What happened | Time | Event | |---|---| | 11:11 | #2038 created — branches from a dev that still has the old file | | 11:14 | **#2034 merges** — adds 60 `tier` lines | | 11:48 | **#2038 merges** — carries the stale file forward, deleting all 60 | ``` plugins/onex/lib/event_registry/omniclaude.yaml | 60 ------------------ 1 file changed, 60 deletions(-) ``` #2038 is `feat(OMN-16513): add OMNI_SECURITY_SCAN_RUNS_ON_JSON seam to security-scan jobs` — nothing to do with event registries, so the revert was invisible in its review. ## Why it matters **omniclaude cannot emit to Kafka at all through the daemon on dev right now.** `node_emit_daemon` refuses to load a registry whose fan-out rules omit `tier` (`event_registry.py:214-220`) and dies at startup: ``` ValueError: Fan-out rule for event 'session.started' -> 'onex.evt.omniclaude.session-started.v1' has no 'tier'. ``` The merged-then-reverted state is worse than never having merged: the ticket reads as fixed. ## This change The same 60 rules, byte-identical to what merged in #2034 (verified against merge commit `8a610a59b`). Tiers are **re-derived, not copied from the reverted commit**: 57 come from the authoritative default registry `node_emit_daemon/registries/topics.yaml`, which already carries tiers for these exact omniclaude topics — so `session-outcome`, `compliance-evaluate`, `delegate-task`, `gate-decision`, `dod-*` and `audit-*` keep `duty_critical`. The three absent there (`validator-catch`, `agent-action`, `evidence-written`) default to `telemetry`, matching their siblings. ## Verification - `EventRegistry.from_yaml` loads it (was `ValueError`) - Byte-identical to `8a610a59b` - Full pre-commit suite green ## Worth a look beyond this PR A PR branched minutes before an unrelated fix merged silently reverted it, and no gate noticed. If the queue does not require branches to be current with the base before merging, this class recurs — and it is invisible precisely because the reverting PR touches an unrelated subject. @coderabbitai ignore Evidence-Ticket: OMN-14751 Evidence-Source: OCC#7141 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stage 0b of the cloud CI offload plan (
docs/plans/2026-08-23-cloud-ci-offload-plan.md, Rev 4, §3 Stage 0b + §3.0b-M,omni_homerepo). This workflow has four distinct job classes — not CodeQL-only — routed throughOMNI_TRUSTED_CI_RUNS_ON_JSON(137 infra job-sites), so the seam is namedOMNI_SECURITY_SCAN_RUNS_ON_JSONrather thanOMNI_CODEQL_RUNS_ON_JSONto avoid understating its blast radius.Adds
OMNI_SECURITY_SCAN_RUNS_ON_JSONas first-choice onruns-onfor:dependency-scancodeqlcontainer-scaniac-scanfalling back to
OMNI_TRUSTED_CI_RUNS_ON_JSON, then self-hosted — identical shape toomnibase_infra'sOMNI_DOCKER_CI_RUNS_ON_JSONpattern.secret-scan(already hardcodedubuntu-latest) is untouched — out of scope per the plan's 4-site table. TheOMNI_PUBLIC_PR_RUNS_ON_JSONfork-PR branch is untouched on all four sites.Structural note (§3.0b-M): this workflow has no
pull_requesttrigger (schedule+workflow_dispatch+push:[main,'hotfix/**']only), so the fork-PR branch on these selectors is dead code today, unchanged by this edit. All four target jobs alsoneeds: occ-preflight, so a preflight miss silently skips them.No variable is set in this PR. Unset means a no-op fallthrough to existing
OMNI_TRUSTED_CI_RUNS_ON_JSONbehavior. Variable set + trigger-aware canary is a follow-up step, not part of this PR.Test plan
pre-commit run --files .github/workflows/security-scan.yml— all applicable hooks passgh pr checks --watchgreen before merge (mandatory per repo CLAUDE.md)OMNI_SECURITY_SCAN_RUNS_ON_JSONrepo-scoped var + prove §3.0b-M rows Add Claude Code GitHub Workflow #2-Phase 3: Local Template System Implementation #5 viaworkflow_dispatchonmain(nopull_requesttrigger exists to prove them another way) — evidence must includeocc-preflight's own conclusion alongside each target job's, and observedself-hostedlabels count as canary FAILURE not a passOMN-16513
Evidence-Ticket: OMN-16513
Evidence-Source: OCC#7075