Repository navigation
glaeda-cmux-runner: trusted-only runners for a mini that holds a secret - #1203
Merged
Merged
Conversation
A host's overrides.runner.trustedRef (refs/heads/main) gives its runners their own glaeda-trusted-<class>-xcode-<version> pool and a hook gate that admits only push, schedule and workflow_dispatch jobs on that ref, so the fleet-cas writer mini can run main and nightly builds without ever running PR code as the user that reads the key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d cross-checks Review: a dispatch on main can check out any ref from its inputs, and an org-scoped runner would take main of any org repo. Drop workflow_dispatch, require trustedRepo with trustedRef, match repository/ref/default branch in env and payload, refuse payloads carrying pull_request, workflow_run or merge_group, and document the limits the gate cannot see (push rules, pinned actions, PR-writable caches, runner group scope). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Leo wants cmux7s (the fleet-cas signing writer) to run builds again. Its signing key is readable by the build user, so it must never run PR code (see docs/experiments/fleet-compilation-cache-signed-writes-2026-09-24.md, Limits).
overrides.runner.trustedRefin the manifest (validated asrefs/heads/...).glaeda-trusted-<class>-xcode-<version>andglaeda-trustedin place of the std pool label, so the PR picker never counts or routes to it.--trusted-ref REFinto the job-started hook. The hook refuses unless the event is push, schedule or workflow_dispatch andGITHUB_REFequals REF, and for a push the payloadrefmust match too. pull_request, merge_group and workflow_run are refused. That holds even if a PR's workflow names the trusted label, because the hook lives on the host.Tests: a table for the hook gate (main push, schedule, and dispatch are admitted; branch dispatch, branch push, mismatched payload, PR, merge queue, and a missing ref are refused), pool labels and validation, and the baked hook flag. 81 runner tests, the fleet and mini-fleet suites pass.
A follow-up (separate-user runner on 7s, so PR jobs can run there too) needs Leo's sudo to create the user.
🤖 Generated with Claude Code