From 22f99e5a05e1e503de074a630a37b850e2b2f8a9 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 25 Aug 2026 19:25:24 +0500 Subject: [PATCH 1/2] feat(cache): emit optional delivery evidence --- internal/cachebroker/cachebroker_test.go | 8 +++++++- internal/cachebroker/handler.go | 4 ++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/internal/cachebroker/cachebroker_test.go b/internal/cachebroker/cachebroker_test.go index 5c89623..149b61e 100644 --- a/internal/cachebroker/cachebroker_test.go +++ b/internal/cachebroker/cachebroker_test.go @@ -147,7 +147,8 @@ func TestHandlerReturnsExactScopedDeliveryOnce(t *testing.T) { t.Fatal(err) } requestBody, _ := json.Marshal(ClaimRequest{InstanceName: "runner-example", RunnerName: "runner-example", Repository: "example-org/example-actions", Token: base64.RawURLEncoding.EncodeToString(token)}) - handler := Handler{Config: config, Store: store, Logger: slog.New(slog.NewTextHandler(io.Discard, nil))} + var logs bytes.Buffer + handler := Handler{Config: config, Store: store, Logger: slog.New(slog.NewJSONHandler(&logs, nil))} request := httptest.NewRequest(http.MethodPost, "https://gateway.example"+ClaimPath, bytes.NewReader(requestBody)) response := httptest.NewRecorder() handler.ServeHTTP(response, request) @@ -161,6 +162,11 @@ func TestHandlerReturnsExactScopedDeliveryOnce(t *testing.T) { if delivery.Role != "trusted-writer" || delivery.PrefixRoot != "example-org/example-actions/trust/trusted" || delivery.AccessKey != "AKIA0123456789ABCDEF" { t.Fatalf("delivery=%+v", delivery) } + logged := logs.String() + if !strings.Contains(logged, `"msg":"cache claim delivered"`) || !strings.Contains(logged, delivery.DeliveryID) || + strings.Contains(logged, delivery.AccessKey) || strings.Contains(logged, delivery.SecretKeyB64) { + t.Fatalf("delivery evidence is missing or secret-bearing: %s", logged) + } request = httptest.NewRequest(http.MethodPost, "https://gateway.example"+ClaimPath, bytes.NewReader(requestBody)) response = httptest.NewRecorder() handler.ServeHTTP(response, request) diff --git a/internal/cachebroker/handler.go b/internal/cachebroker/handler.go index ec1f5a8..4b894cd 100644 --- a/internal/cachebroker/handler.go +++ b/internal/cachebroker/handler.go @@ -168,7 +168,11 @@ func (h Handler) ServeHTTP(writer http.ResponseWriter, request *http.Request) { writer.Header().Set("Content-Type", "application/json") if err := json.NewEncoder(writer).Encode(delivery); err != nil { logger.ErrorContext(ctx, "encode cache delivery", "error", err) + return } + logger.InfoContext(ctx, "cache claim delivered", "instance", claim.InstanceName, + "repository", claimRequest.Repository, "role", delivery.Role, "mode", delivery.Mode, + "delivery_id", delivery.DeliveryID) } func validateJobCorrelation(request ClaimRequest) error { From c4ff8284adc6786f6e062ace13b19b944df822f6 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 25 Aug 2026 19:35:22 +0500 Subject: [PATCH 2/2] fix(cache): source evidence identity from config --- internal/cachebroker/cachebroker_test.go | 3 ++- internal/cachebroker/handler.go | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/internal/cachebroker/cachebroker_test.go b/internal/cachebroker/cachebroker_test.go index 149b61e..2d36bb4 100644 --- a/internal/cachebroker/cachebroker_test.go +++ b/internal/cachebroker/cachebroker_test.go @@ -163,7 +163,8 @@ func TestHandlerReturnsExactScopedDeliveryOnce(t *testing.T) { t.Fatalf("delivery=%+v", delivery) } logged := logs.String() - if !strings.Contains(logged, `"msg":"cache claim delivered"`) || !strings.Contains(logged, delivery.DeliveryID) || + if !strings.Contains(logged, `"msg":"cache claim delivered"`) || !strings.Contains(logged, `"repository":"example-org/example-actions"`) || + !strings.Contains(logged, delivery.DeliveryID) || strings.Contains(logged, delivery.AccessKey) || strings.Contains(logged, delivery.SecretKeyB64) { t.Fatalf("delivery evidence is missing or secret-bearing: %s", logged) } diff --git a/internal/cachebroker/handler.go b/internal/cachebroker/handler.go index 4b894cd..e7179c1 100644 --- a/internal/cachebroker/handler.go +++ b/internal/cachebroker/handler.go @@ -170,8 +170,8 @@ func (h Handler) ServeHTTP(writer http.ResponseWriter, request *http.Request) { logger.ErrorContext(ctx, "encode cache delivery", "error", err) return } - logger.InfoContext(ctx, "cache claim delivered", "instance", claim.InstanceName, - "repository", claimRequest.Repository, "role", delivery.Role, "mode", delivery.Mode, + logger.InfoContext(ctx, "cache claim delivered", "repository", repositoryConfig.Name, + "role", identity.Role, "mode", identity.Mode, "delivery_id", delivery.DeliveryID) }