Skip to content

[node-maintenance-repair/1] Receive a signed webhook and read the installed repository - #42

Merged
omry merged 1 commit into
mainfrom
pr42
Nov 1, 2026
Merged

[node-maintenance-repair/1] Receive a signed webhook and read the installed repository#42
omry merged 1 commit into
mainfrom
pr42

Conversation

@omry

@omry omry commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Adds the stateless Cloudflare receiver for the shared Security Maintenance GitHub App. It verifies webhook signatures over the original bytes, creates an App JWT from either GitHub-downloaded PKCS#1 or PKCS#8 RSA keys, and reads canonical repository metadata with a token restricted to one repository.

Webhook input and sequential GitHub reads share one eight-second processing budget. Stalled input and upstream calls abort within that budget; failures return a sanitized response. The operator reference covers repeatable checks and recovery.

Validation:

  • 19 Worker unit tests, with 100% line coverage.
  • Native Workers runtime: signed ping, signature rejection, streamed size limit, JWT/scoped read, and the shared deadline across two slow sequential reads.
  • 1,294 Node maintenance tests, Ruff, formatting, and Pyrefly.
  • Pinned Wrangler bundle validation; CI also exercises the existing Node 22/24 package-manager matrix.

Hosted acceptance is recorded for each source/deployment pair before a slice is accepted. The initial deployment at 587cc8a247788e490b1d754d2595340472468e47 passed real signed ping and PR deliveries, forged-signature rejection, and the one-repository token boundary against a verified private probe. Those initial receipts predate the key-format and deadline corrections; delivery tracks the matching receipts for each updated deployment separately.

This is infrastructure slice node-maintenance-repair/1. Checks, dispatch, storage, and dependency repairs follow in later slices. The larger draft #41 remains parked until its remaining work has transferred to linked replacements.

@omry

omry commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
    "evidence": {
      "attestations": [
        {
          "closure_identity": "sha256:6cf076773cd968a6ac1dcfaf1dfda82c543b5f3e2658013d265407e3e97be1e6",
          "document_identity": "sha256:59cc4c60e3c82a2c6d63ccc1826ff14e5cc26f89052dbb23bd864ffe8fb3f0a9",
          "sidecar_identity": "sha256:23cc87503b0b509365d991bd815ad7f2a18b3623756ceac875f9696da82802ab"
        }
      ],
      "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120349689752
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120349689630
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120349689836
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120349690011
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120349689833
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120349689870
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120349689903
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120349689886
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:30864b71ab338fed981033be94bea8674dd6a7ba114697a380175fef1a7ab7ce",
      "operation_identity": "sha256:897e0d0e0e5538ba0313fc76b82526f280846e95b4b758dcfb1aee0c898bbb6d",
      "review_request": {
        "body_digest": "sha256:f7bb8963eb826b82fd6c90c565fe7dffdbe25cfd2d4dff04a210849d264070f1",
        "id": 6362183690
      },
      "review_result": {
        "body_digest": "sha256:bdd9477d83d6084b2101c23dc7efa986099a9c377d7328a738537381cb44125f",
        "id": 6362228282
      }
    },
    "evidence_fingerprint": "sha256:7b08f320c2a46adb65969ccf7de29dce0d935395540577f492cabbfe60419e33",
    "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
    "operation_identity": "sha256:897e0d0e0e5538ba0313fc76b82526f280846e95b4b758dcfb1aee0c898bbb6d",
    "review_request_id": 6362183690,
    "review_result_id": 6362228282,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "repair-app",
      "run_id": 120349689752
    },
    {
      "conclusion": "SUCCESS",
      "name": "test",
      "run_id": 120349689630
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, npm, 11.9.0)",
      "run_id": 120349689836
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.20.0)",
      "run_id": 120349690011
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.21.0)",
      "run_id": 120349689833
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, npm, 11.9.0)",
      "run_id": 120349689870
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.20.0)",
      "run_id": 120349689903
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.21.0)",
      "run_id": 120349689886
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120315927460,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927460"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120315927750,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927750"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120315927922,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927922"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120315927629,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927629"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120315927837,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927837"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120315927624,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927624"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120315927679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120315927862,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927862"
        }
      ],
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": "sha256:09e994d0701c66a64a82f7da69411651f7ef8e312022098d515258087b7d17ab",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120308132534,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132534"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120308132270,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132270"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120308132708,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132708"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120308132675,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132675"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120308132808,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132808"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120308132600,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132600"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120308132660,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132660"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120308132581,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132581"
        }
      ],
      "head_sha": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": "sha256:4fdad83ffcaee6b1401b14f546e01f8c8da2e75a0ae69d531c8b41d0d16c832b",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120349689752,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689752"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120349689630,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689630"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120349689836,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689836"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120349690011,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349690011"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120349689833,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689833"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120349689870,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689870"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120349689903,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689903"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120349689886,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689886"
        }
      ],
      "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": "sha256:cb2fef0bcb0e6dc78bcb39745baaa3f6b1bf0710482824b83c7958e9fe7082bf",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120132953699,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953699"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120132954220,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132954220"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120132953679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120132953633,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953633"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120132953599,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953599"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120132953726,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953726"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120132953890,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953890"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120132953707,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953707"
        }
      ],
      "head_sha": "587cc8a247788e490b1d754d2595340472468e47",
      "id": "sha256:e5f7ba987cdf2fbb42c62cef0ae77aff813335cddf0cbb42355edeb78e32cb07",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "classification": "current-slice defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4357434171",
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4357549587",
        "/tmp/node-maintenance-keyfix-local-validation.json",
        "0155e8bd89c57e1cbcafb1bec3731f9446b02b02"
      ],
      "id": 4357434171,
      "invariant": "GitHub App JWT signing accepts GitHub-downloaded PKCS#1 RSA keys and existing PKCS#8 keys.",
      "path": "repair-app/worker.mjs",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "severity": "P1",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vhcLl"
    },
    {
      "classification": "current-slice defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4358070701",
        "https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks#respond-within-10-seconds",
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4358233195",
        "/home/omry/.local/state/awd/runs/run_07h2fm1myttbq3ckm56j1gvyew/deadline-correction/local-validation.json",
        "6009198151028e1d42d6f26a76545852d6553c2e"
      ],
      "id": 4358070701,
      "invariant": "Webhook processing shares an overall deadline below GitHub's 10-second response limit, including sequential upstream calls.",
      "path": "repair-app/worker.mjs",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "severity": "P2",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vi9p7"
    }
  ],
  "pr": {
    "base_ref": "main",
    "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
    "body_digest": "sha256:46aba7b39490a238fd88726d965a854d66f6817dbd853b8f34fc75d7de153aa9",
    "diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
    "head_ref": "pr42",
    "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
    "pr": 42,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:022f2c6b4dd2ed5124111dd0f6f37ec86f48189ee1e506f6c9d241d4351d085d"
  },
  "record_version": 16,
  "review_observations": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "evidence_digest": "sha256:4bc10751540ab46f43cec6a65a35e548861656d9a9e4711660d3895bfcac365e",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": "sha256:9dfd6919e49fab100878835bf869529d2578a2d86f70441d4c62f6b4d6374f78",
      "request_comment_id": 6360695964,
      "status": "timeout"
    }
  ],
  "review_requests": [
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:17050a7c0a918d189733536a49fe5527ac3b1b96ce7342f8fc6e9e8670cbb423",
      "created_at": "2026-10-22T23:04:36Z",
      "head_sha": "587cc8a247788e490b1d754d2595340472468e47",
      "id": 6353257750,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:794866d8b1c0f5b7404817230111d3ec461bf2901a2579f30619647c37ede684",
      "created_at": "2026-10-23T08:04:04Z",
      "head_sha": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": 6360383602,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:63f9a10b776c2ff3aabe50569bb2ec90dd321620def280ec287fa74798ab39b7",
      "created_at": "2026-10-23T08:22:47Z",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 6360695964,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:63f9a10b776c2ff3aabe50569bb2ec90dd321620def280ec287fa74798ab39b7",
      "created_at": "2026-10-23T09:24:55Z",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 6361750828,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:f7bb8963eb826b82fd6c90c565fe7dffdbe25cfd2d4dff04a210849d264070f1",
      "created_at": "2026-10-23T09:50:10Z",
      "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": 6362183690,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bf75cd1f5e15c28b24c7367be1e49f68c6cf7b6eb8a2e0975ab2d4e3a5731cc4",
      "commit_id": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": 5625558404,
      "inline_message_ids": [
        4357434171
      ],
      "request_comment_id": 6360383602,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-23T08:06:28Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vhcLl"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:2823743bd0f45953398d7a8bd09d929143528a8897067228914375eb282471ac",
      "commit_id": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 5626376684,
      "inline_message_ids": [
        4358070701
      ],
      "request_comment_id": 6361750828,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-23T09:26:56Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vi9p7"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:cf875ed4763470a33935f946fcd700897e2eb6f54f3a6c0929988bba1418fec1",
      "commit_id": "587cc8a247788e490b1d754d2595340472468e47",
      "id": 6353297263,
      "inline_message_ids": [],
      "request_comment_id": 6353257750,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-22T23:07:16Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bdd9477d83d6084b2101c23dc7efa986099a9c377d7328a738537381cb44125f",
      "commit_id": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": 6362228282,
      "inline_message_ids": [],
      "request_comment_id": 6362183690,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-23T09:52:47Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:8b98ef71dde4c1a5377cedff83732aecffcd619657bec24240f64861da28a038",
      "finding_ids": [],
      "invariants": [
        "Original-byte signature verification precedes payload processing.",
        "Installation tokens and repository reads stay scoped to one canonical repository.",
        "No Check, dispatch, repair or repository write enters slice 1.",
        "All required checks and complete local validation pass; hosted acceptance remains explicitly pending."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "587cc8a247788e490b1d754d2595340472468e47",
      "review_observation_id": null,
      "review_request_id": 6353257750,
      "review_result_id": 6353297263,
      "reviewed_head": "587cc8a247788e490b1d754d2595340472468e47",
      "root_cause": "No actionable defect found by the attributable exact-head regular review or current local validation.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "disposition_changes": [
        4357434171
      ],
      "effective_diff_digest": "sha256:c43fb28b62838e3f0d9d6701d6bab743c18b14d631085fbe96e2c02227184897",
      "finding_ids": [
        4357434171
      ],
      "invariants": [
        "GitHub-downloaded RSA PKCS#1 and PKCS#8 keys both produce valid App JWTs."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "resulting_head": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "review_observation_id": null,
      "review_request_id": 6360383602,
      "review_result_id": 5625558404,
      "reviewed_head": "b81526100ff43863d7a62b52e81b8c682d225372",
      "root_cause": "Receiver assumed PKCS#8 PEM and could not decode GitHub-downloaded PKCS#1 keys.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "disposition_changes": [
        4358070701
      ],
      "effective_diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
      "finding_ids": [
        4358070701
      ],
      "invariants": [
        "One overall webhook deadline stays below GitHub's 10-second response window."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "resulting_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "review_observation_id": null,
      "review_request_id": 6361750828,
      "review_result_id": 5626376684,
      "reviewed_head": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "root_cause": "Two sequential calls each used an independent 15-second timeout; streamed cancellation could also wait indefinitely.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
      "finding_ids": [],
      "invariants": [
        "Signed ingress, supported App keys, one-repository reads and the shared deadline remain within receiver scope."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "review_observation_id": null,
      "review_request_id": 6362183690,
      "review_result_id": 6362228282,
      "reviewed_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "root_cause": null,
      "round": 4,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 22, 2026 22:58
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-23T09:52:48.911754Z 6009198 Manual request
🔒 Security Review ✅ Completed 2026-10-22T23:01:42.905263Z 587cc8a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 587cc8a

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 587cc8a247

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added approved and removed approved labels Oct 22, 2026
@omry

omry commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: b815261

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 23, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b81526100f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread repair-app/worker.mjs Resolved
@omry

omry commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Superseded at the maintainer’s request by a fresh regular review of commit 0155e8bd89c57e1cbcafb1bec3731f9446b02b02. The previous attempt remained pending; this comment is retained as history.

Original stalled review request 
@codex review

Exact head: 0155e8bd89c57e1cbcafb1bec3731f9446b02b02

@omry

omry commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 0155e8b

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 23, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0155e8bd89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread repair-app/worker.mjs Resolved
@omry
[node-maintenance-repair/1] Receive a signed webhook and read the ins…
6009198 
…talled repository

Add the preview GitHub App receiver for the first infrastructure slice. Verify webhook signatures over original bytes, enforce the 2 MB limit while streaming, and validate delivery and repository identities before a canonical metadata read. Request a Contents-read installation token for exactly the event repository.

Keep this slice stateless. It performs no Check writes, workflow dispatch, dependency repair or repository writes. Add unit/native Workers tests, pinned development tooling, a dry-run CI check and operator preview instructions.

Validation: 15 Worker tests with 100% line/branch/function coverage; native Workerd smoke; Wrangler dry-run bundle; 1,294 existing repository tests; Ruff check/format and Pyrefly.

Live acceptance remains pending. Named GitHub App and Cloudflare targets need G-SETUP authorization, followed by real signed ping/PR deliveries and positive/negative repository-scope evidence. Local mocks and this PR do not establish hosted success. Do not start slice 2 before that proof.

Related to #41, which remains parked until its work has been transferred to the smaller replacement PRs.
@omry

omry commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 6009198

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 6009198151

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved label Oct 23, 2026
@omry omry mentioned this pull request Oct 23, 2026
Merged
@omry
omry added this pull request to stack #44 October 23, 2026 12:06
This was referenced Oct 23, 2026
Merged
Merged
Merged
Merged
Merged
Merged
This was referenced Nov 1, 2026
Merged
Merged
Merged
@omry
omry merged commit 179c862 into main Nov 1, 2026
16 checks passed
@omry
omry deleted the pr42 branch November 1, 2026 18:50
omry added a commit that referenced this pull request Nov 1, 2026
@omry
[node-maintenance-repair/2] Show the selected batch in the native Check
e69cf0b 
Reads the selected exact patch updates from a managed maintenance PR and shows them in the shared App's **Dependency repair** Check. The receiver fetches the canonical repository and PR, requires an open bot-authored PR from `maintenance/node-security` in the same repository targeting its current default branch, and writes only its own Check.

The C1 parser validates checked and unchecked rows, rejects duplicates and malformed or non-increasing same-minor patches, and preserves version strings. Shared fixtures bind sorted selections, PR number, head and base to the exact SHA-256 fingerprint. PR edits refresh an existing idle Check, including when overlapping initial deliveries created duplicates; a changed head receives a Check bound to that head. Bounded canonical rechecks reconcile edits that arrive during a Check write. Empty or invalid selections cannot expose an action.

The token stays restricted to one repository with Contents read, Pull requests read and Checks write. This slice adds no Run action, database, dispatch or dependency repair. It depends on the receiver in #42.

Validation: 96 Worker unit tests with 100% line and function coverage; native Workers receiver regression and pinned Wrangler bundle; 1,294 repository tests, Ruff, formatting and Pyrefly. Live selection and head-refresh acceptance is tracked separately for the approved deployment.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry