Pin workflow dependencies and define release trust boundary - #295
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThe repository documents supply-chain controls, pins GitHub Actions to full commit SHAs, configures monthly Dependabot updates, adds policy tests, and runs them through validation. ChangesRepository supply-chain controls
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.github.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14fd318f33
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/human-security-review.yml (1)
1-11: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd a
concurrencyguard for the 5-minute schedule.This workflow re-evaluates every open pull request every 5 minutes with no
concurrencygroup. If a run takes longer than 5 minutes (for example, with many open PRs), the next scheduled run can start before the previous one finishes. Overlapping runs waste GitHub API calls and can post duplicate or out-of-order commit statuses for the same PRs.Add a
concurrencygroup so overlapping scheduled runs queue or cancel instead of running in parallel.♻️ Proposed concurrency guard
permissions: contents: read pull-requests: read statuses: write +concurrency: + group: human-security-review + cancel-in-progress: false + jobs: gate:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/human-security-review.yml around lines 1 - 11, Add a workflow-level concurrency configuration near the top-level triggers in “Human Security Review,” using a stable group that identifies this workflow and prevents overlapping scheduled runs. Configure the guard to queue or cancel an in-progress run so successive 5-minute schedule executions cannot process the same pull requests concurrently.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@bin/human-security-review-gate`:
- Around line 25-50: Introduce a distinct exception and non-1 exit status for
infrastructure failures raised by gh_json and gh_paginated_json, including API,
parsing, response-shape, and pagination-limit abort paths, while preserving the
existing status for HUMAN_SECURITY_REVIEW_REQUIRED. Update the workflow case
handling for the new status range to report state=error and
infrastructure_error=1 instead of treating it as review required.
In `@bin/repository-security-policy-test.rb`:
- Around line 42-79: Add a test in the security policy test suite that
require_relative-loads bin/human-security-review-gate and verifies
HumanSecurityReviewGate.high_risk_path? returns true for representative paths
covering every documented protected pattern. Derive the samples from the
CODEOWNERS or agent-workflow policy pattern sets so the runtime HIGH_RISK_PATHS
gate is cross-checked against both policy lists and drift causes the test to
fail.
---
Nitpick comments:
In @.github/workflows/human-security-review.yml:
- Around line 1-11: Add a workflow-level concurrency configuration near the
top-level triggers in “Human Security Review,” using a stable group that
identifies this workflow and prevents overlapping scheduled runs. Configure the
guard to queue or cancel an in-progress run so successive 5-minute schedule
executions cannot process the same pull requests concurrently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 982cfae7-23de-4274-93dc-06387e4ac298
📒 Files selected for processing (15)
.agents/agent-workflow.yml.github/CODEOWNERS.github/dependabot.yml.github/workflows/claude-code-review.yml.github/workflows/claude.yml.github/workflows/human-security-review.yml.github/workflows/validate.ymlCHANGELOG.mdREADME.mdbin/human-security-review-gatebin/human-security-review-gate-test.rbbin/repository-security-policy-test.rbbin/validatedocs/repository-supply-chain.mddocs/security-posture.md
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec651cc208
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
justin808
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/repository-supply-chain.md`:
- Around line 25-34: Update the documented two-step review flow around
upgrade-agent-workflows to run a complete git diff HEAD..origin/main before git
merge --ff-only, in addition to the existing summary and log commands, so users
review the full executable changes before fast-forwarding.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ef268654-0165-410a-a570-4eec3190e2ad
📒 Files selected for processing (6)
CHANGELOG.mdREADME.mdbin/repository-security-policy-test.rbbin/validatedocs/repository-supply-chain.mddocs/security-posture.md
💤 Files with no reviewable changes (1)
- bin/validate
🚧 Files skipped from review as they are similar to previous changes (2)
- CHANGELOG.md
- docs/security-posture.md
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d77c64bea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: full PR history; there was no previous address-review checkpoint. Mattered
Skipped
All three inline threads were replied to and resolved. No deferred work was created. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14ef8ed32f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 196d6b81f5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T15:22:17Z. Mattered
Skipped
Both new inline threads were replied to and resolved. Exact-head hosted validation is rerunning after the final ancestry fix. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2bd4fca0cb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T15:54:35Z. Mattered
Skipped
The new inline thread was replied to and resolved. Exact-head hosted validation is rerunning after the binding fix. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c25bfbf57
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 085668e2a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T16:09:21Z. Mattered
Skipped
Both inline threads were replied to and resolved. Exact-head hosted validation is rerunning after these final bindings. Next default scan starts after this comment. Say |
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T16:43:12Z. Mattered
Skipped
The inline thread was replied to and resolved. Exact-head hosted validation is rerunning after this precision fix. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f797eaf2c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T17:00:39Z. Mattered
Skipped
The inline thread was replied to and resolved. Exact-head hosted validation is rerunning after the composite-action coverage fix. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 66ac7313e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T17:14:22Z. Mattered
Skipped
The inline thread was replied to and resolved. Exact-head hosted validation is rerunning after the local-action precision fix. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c9b71ad290
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: activity after the prior checkpoint at 2026-08-01T17:28:28Z. Mattered
Skipped
The inline thread was replied to and resolved. Exact-head hosted validation is rerunning after the Docker-digest compatibility fix. Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f7699407e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@bin/repository-security-policy-test.rb`:
- Line 100: Update the schedule interval assertion in the repository security
policy test to require the documented weekly Dependabot schedule instead of
monthly, preserving the existing action_updates.dig("schedule", "interval")
validation.
- Around line 112-117: Update acceptable_action_reference? to validate complete
external reference formats: check the Docker digest pattern first, then require
a valid GitHub owner/action reference before accepting a 40-character commit
SHA. Ensure malformed values with extra @ separators, such as
owner/action@v1@SHA or docker://alpine@SHA, are rejected while preserving local
"./" references.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5a69f419-8603-4e55-9b69-01cac444911e
📒 Files selected for processing (5)
.github/dependabot.ymlCHANGELOG.mdbin/repository-security-policy-test.rbdocs/repository-supply-chain.mddocs/security-posture.md
🚧 Files skipped from review as they are similar to previous changes (4)
- docs/security-posture.md
- .github/dependabot.yml
- CHANGELOG.md
- docs/repository-supply-chain.md
Address-review summaryScan scope: since previous summary at 2026-08-01T17:51:14Z. Mattered
Skipped
Deferred-work tracking: existing issue #273. Exact-head closeout: Next default scan starts after this comment. Say |
…n-security-review * origin/main: Support direct merges without merge queues (#297)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9a4b784550
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| def test_github_actions_are_pinned_to_full_commit_shas | ||
| reference_sets = Dir.glob(File.join(ROOT, ".github/workflows/*.{yml,yaml}")).map do |path| | ||
| workflow = YAML.safe_load_file(path, aliases: true) |
There was a problem hiding this comment.
When a workflow contains an unquoted ISO date such as env: { START_DATE: 2026-08-02 }, this whole-document load raises Psych::DisallowedClass: Tried to load unspecified class: Date under the Ruby 3.4 used by validation, before any action references are inspected. The scalar is valid workflow YAML and may be unrelated to uses, yet it makes the repository-required bin/validate gate fail; parse without constructing timestamp objects or explicitly handle Date.
AGENTS.md reference: AGENTS.md:L28-L34
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Confirmed on Ruby 3.4 / Psych: an unquoted ISO date raises Psych::DisallowedClass before the scanner reaches uses. Because #295 is already merged and the exact merged main validation is green, this is tracked as the post-merge robustness fix in #302 rather than triggering rollback: #302. The review thread remains open with that MUST-FIX follow-up pending.
|
head_sha: 9a4b784
|
Address-review summaryScan scope: review activity after the prior checkpoint at 2026-08-02T03:40:37Z, plus the post-merge late-feedback sweep. Mattered
Skipped
Deferred-work tracking: new issue #302 Next default scan starts after this comment. Say |
…206-workflows * commit '4ed056be38a82d00b2a06a7812f82cd1770da55b': Pin workflow dependencies and define release trust boundary (#295)
…/pr291-redesign-implementation * commit '6239fd0afa5bb7d87cd3fb09cc22ae30bcf1e369': Fix locale-dependent test, surface policy-only CLAUDE.md follow-ups, add read-only seam-drift audit (#337) Add PR #377 changelog entry (#382) Make PR descriptions human-first (#377) Remove unsupported signed-launch enforcement (#374) Emit coordination telemetry and provenance at workflow checkpoints (#290) Add explicit multi-language lint CI (#313) Reconcile later-completed audit targets (#315) Report source lines in security preflight findings (#311) Gate completed-batch publication on terminal scope and QA (#308) Add guarded merge submission seam (#304) Fix exact-head readiness when status rows omit SHA (#307) fix: allow YAML timestamps in action scanner (#305) Pin workflow dependencies and define release trust boundary (#295) Support direct merges without merge queues (#297)
1 participant
Summary
Motivation
A maintainer raised a valid supply-chain concern: this repository ships shell/Ruby helpers and agent instructions, and an AI review alone should not establish a trusted release.
The first version of this PR put a human gate on nearly every meaningful pull request. That was too broad and would have slowed ordinary development. This revision keeps
mainfast and places mandatory independent human review at the stable-release promotion boundary instead.agent-workflowsdoes not have version tags or GitHub releases today, so this PR does not pretend that the current native marketplaces, live checkouts, or default upgrade flow are stable, human-reviewed channels. A shell recipe cannot make a live checkout immutable while an installer reads it. Issue #296 defines the proper follow-up using immutable reviewed release artifacts, withteam-reports-pluginrelease work as a reference.Verification
ruby bin/repository-security-policy-test.rb— 8 runs, 30 assertionsactionlint -shellcheck=git diff --checkagent-workflows-trust-audit-testhang; hosted Linuxvalidateis the aggregate gatePost-merge administrator checklist
After this pinning change reaches
main:Closes none; refs #273 and #296.
Summary by CodeRabbit
Security
Documentation
Maintenance