feat(managed-files-guard): ship an advisory hosted-only caller for the fleet - #511
Conversation
…kwards Enumerate the managed-files-guard caller component among the extra caller files the daily re-pin rewrites, and teach apply to leave a fallback-form pin alone when its recorded commit date is after the release commit's: such a pin names a commit the release cannot contain, so rewriting it would move the pin behind the fix it was taken for. resolve now emits the release commit date; the workflow passes it through and commits the new component directory.
…e fleet Add the managed-files-guard-caller component: a thin pull_request workflow that calls the ci-workflows managed-files-guard composite action on the approved hosted label, pinned by full SHA to the commit that closed the guard's fail-open (3b2f4eab, fallback pin-comment form since no release carries it yet), with standards-ref: main for the soak. Manage it for the seven hosted-only-eligible targets, hold it locally-owned in ci-workflows (which already runs the action from its own tree), and defer the four selector-enrolled private targets to a selector-routed sibling. Advisory: no ci-status change anywhere. The contract test asserts the caller shape against the parsed YAML, the manifest wiring and target boundary, and byte-exact materialization through the real engine; CI runs it in the actionlint job and adds the component file to the pin-comment and zizmor scans.
…boundary The caller must audit clean on every target that manages it under that target's hosted-only inventory (claude-code-plugins executes the gate), and must not be admitted to a selector-enrolled private consumer, which is the property the second-hop exclusion rests on.
…oak finding class
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude finished @kyle-sexton's task in 3m 44s —— View job Review complete
No inline findings — I didn't find a defect I'm confident enough in to anchor to a line. What I checked
One thing worth a sanity check, not a blocker
Not independently re-verified
Everything else — the manifest, the fence logic, the test coverage, and the cross-references between the four docs touched — checked out consistent and correct. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7bf9c6514
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
Day-truncated pin-comment dates treat a same-UTC-day fallback pin as contained even when the release predates it. apply now asks GitHub's compare API whether the pinned SHA is an ancestor of the release SHA (ahead/diverged stays put; behind/identical rewrites; lookup failure is fatal). Dates remain argv/provenance only. Also scope old-sha extraction to ci-workflows uses: lines so a sibling actions/checkout pin is not reported as a ci-workflows SHA. Co-authored-by: ksextonmelodic <ksextonmelodic@gmail.com>
The assignment already runs under set -e, so a failed compare exits without an || condition that disables errexit inside the function. Co-authored-by: ksextonmelodic <ksextonmelodic@gmail.com>
2 participants
Closes #496
Summary
Ships the first hop of the
managed-files-guardrollout: a new sync-managed component,managed-files-guard-caller, that lands an advisory.github/workflows/managed-files-guard.ymlon every hosted-only-eligible manifest target. The caller runsmelodic-software/ci-workflows.github/actions/managed-files-guardon each consumer PR and fails when a sync-managed file was hand-edited, closing the seam ADR 0007 asked us to keep binary.This hop is deliberately scoped:
ci-statusand is not a required check. Nothing is promoted here.ubuntu-24.04with noselect-runnerindirection. Targets enrolled in selector-routed runner policy (dotfiles,github-iac,medley,provisioning) are excluded and get a selector-routed sibling in the second hop.standards-ref: mainduring soak, per the action's own input docs. This is a workflow input into a different repo, so the pin-comment convention does not apply and it is intentionally not SHA-pinned in this hop.Targets managing the caller (confirmed against
distribution/sync-manifest.yml, none invented):melodic-software/.github,agent-plugins,ci-runner,claude-code-plugins,claude-code-proxy,codex-plugins,cursor-plugins.melodic-software/ci-workflowsis declaredlocally-ownedbecause it already runs the guard as a job inside its ownci.yml.Fix
New component
components/managed-files-guard/managed-files-guard.yml— the caller.on: pull_request,permissions: contents: read, canonical concurrency block, single job onubuntu-24.04withtimeout-minutes: 10,actions/checkoutSHA-pinned (persist-credentials: false,fetch-depth: 0so the guard can diff base..head), thenuses: melodic-software/ci-workflows/.github/actions/managed-files-guard@3b2f4eab5b4bb58a150e400613350ede37742ee8 # 3b2f4ea 2026-08-30withstandards-ref: main.README.md— records advisory soak, hosted-only first hop, excluded selector-routed targets and their removal trigger, theci-workflowslocally-owned reason,standards-ref: mainuntil soak completes, the pin-advance path, the checkout-pin/Dependabot interaction as an expected soak finding class, and the live consumer list.managed-files-guard.test.sh— component contract test (see Verification).Pin.
3b2f4eab5b4bb58a150e400613350ede37742ee8is re-verified as the latest commit touching the action path onci-workflowsmainas of 2026-09-02. The latest release,v0.17.2(2026-08-21), predates that fix, so the pin has no matching release tag and uses the convention's fallback form# <short-sha> <date>.Re-pin cascade (
components/claude-lanes/,.github/workflows/claude-lanes-repin.yml)EXTRA_CALLER_FILESinrepin-callers.sh, so it advances with the fleet when a release postdates the pin.REPIN_TARGETSinrepin-policy-lockstep.mjs: that file's kind system expresses reusable-workflow contracts (workflow_callsurface +policy.jsonentry). A composite action has neither, so aREPIN_TARGETSentry would lie about kind. Reason recorded in the component README.3b2f4ea (2026-08-30)back tov0.17.2 (2026-08-21).repin::resolvenow emits the release commit date alongside tag and SHA;repin::applyskips any fallback-form pin whose recorded date is later than the release date and reports it as a notice instead of a rewrite. The workflow passes the date through and addscomponents/managed-files-guardto the PRadd-paths.Manifest and repo wiring
distribution/sync-manifest.yml— newmanaged-files-guard-callercomponent mappingcomponents/managed-files-guard/managed-files-guard.yml→.github/workflows/managed-files-guard.yml;managedon the seven targets above;locally-ownedonci-workflows.distribution/README.md— records the caller as the second documented exception to "callers are consumer-owned", alongside the claude-lanes callers..github/workflows/ci.yml— runs the new component test in theactionlintjob, adds the caller to thezizmorand pin-comment-convention scan paths.components/runner-policy/runner-policy.test.mjs— asserts the caller audits clean on every target that manages it and is not admissible on a selector-enrolled private consumer. NoapprovedReusableWorkflowContractsentry was added: composite actions are not SHA-allowlisted and a hosted-only caller on a public/un-enrolled repo does not need one.Not touched:
ci-status, required-check configuration,repin-policy-lockstep.mjs.Admission evidence (docs/component-lifecycle.md)
ci-workflowsalready runs the same action locally, proving the action end to end.melodic-software/standardsowns the caller shape and the pin;melodic-software/ci-workflowsowns the action's behavior..github/workflows/managed-files-guard.yml. The action resolves the manifest fromstandards-ref: main, so target roster and component changes take effect without re-syncing the caller.ci-statusnow — rejected, it must soak advisory first. (c) A single selector-routed caller for all targets — rejected for this hop, hosted-only targets must not take a runner-policy dependency they do not have.contents: readonly, hosted runner, 10-minute timeout, canonical concurrency. Failure mode is a red advisory check on the consumer PR with the guard's own diagnostic; rollback is removing the target from the manifest'smanagedlist.claude-lanes-repin(EXTRA_CALLER_FILES, fenced so it never moves backwards).actions/checkoutpin advances with sibling workflows in this repo.standards-refgets SHA-pinned when soak completes (operator-hosted follow-up, not this PR).Verification
Run locally on the final branch state (
GIT_CONFIG_GLOBAL=/dev/nullso a hostinsteadOfrewrite does not leak into the materialization tests):components/managed-files-guard/managed-files-guard.test.shstandards-ref, manifest wiring, materialization on all 7 targets is byte-identical andactionlint-clean,ci-workflowsreceives no callercomponents/claude-lanes/repin-callers.test.shcomponents/claude-lanes/claude-lanes.test.shcomponents/runner-policy/runner-policy.test.mjscomponents/concurrency-policy(node --test)components/pin-comment-convention/pin-comment-convention.test.shdistribution/sync-manifest.sh validateactionlinton the caller and all.github/workflows/*.ymlshellcheckonrepin-callers.shand the new testPin re-verified via
gh api repos/melodic-software/ci-workflows/commits?path=.github/actions/managed-files-guard&sha=main: latest is3b2f4eab5b4bb58a150e400613350ede37742ee8(2026-08-30); latest releasev0.17.2(2026-08-21).Related
docs/adr/0007-keep-the-managed-file-seam-binary.md— the decision this enforces.melodic-software/ci-workflows.github/actions/managed-files-guard— the action being called.dotfiles,github-iac,medley,provisioning), soak monitoring, promotion intoci-status, and SHA-pinningstandards-refremain operator-hosted after this PR. No new tracking issue was filed.