Repository navigation
Protect registry writes with the main-only publication environment - #324
Conversation
rmcdaniel
added
github_actions
|
|
SECURITY SOURCE/CONFIG PASS — exact head 9eec543 over base 75329c1. Scope is only the publication-environment closure. The two-file delta adds environment: devcontainer-publication to exactly build, assemble, and promote. Those are exactly the three packages: write jobs; each retains the exact main-only condition. Scan and qualify remain non-writing and unbound. DAG, commands, timeouts, scan, qualification, and promotion predicates are unchanged. The focused contract test enumerates the complete writer set and binds the environment and main condition. Independent API readback matches the owning record: environment ID 26419747949; custom branch policy ID 65677941 for branch main only; no tag or wildcard policy; zero environment secrets and variables; no reviewer or wait rule. Existing repository main protections are outside this narrow diff and are not relabeled here. No concrete source/config finding. This PASS does not select or accept a registry operation. Current-head qualification is still nonterminal, and the refreshed effect packet plus no-active-publisher/readback gates remain required before any original dispatch. General partial-promotion risk ownership remains separate and is not a Security PASS for a partial result. |
|
Exact #324 current-head qualification PASS: All four expected protected contexts are green. Original CI42124485128/1 passes both PHP suites at 194 tests/1713 assertions, retaining the existing Playground warning, plus microservice/policy/Python checks. The new focused test binds the complete build/assemble/promote writer set to Original native qualification42124485181/1 passes both amd64 and arm64, each with four build-boundary plus final completed-image apt/libapt2.6.2 readbacks. Product, recipe, qualifier/scanner/policy/tool blobs are unchanged. This is untrusted PR qualification, not a registry operation. Independent Security SOURCE/CONFIG PASS binds this exact head and actual empty main-only environment: ID26419747949, branch policy65677941 for branch main only, no tag/wildcard, secrets/variables/reviewers/wait. It is not registry selection or a partial-result PASS. General's risk/recovery disposition remains separate. Owner/next action: normal protected merge, exact actual-main result and refreshed effect packet. Original optional SDK/timer checks still active are not represented as green. Old packet6671087841 remains superseded; no dispatch, registry write, rollback, deletion, republish or retry. #318/Core1043 remain open for the real public-image outcome or explicit General disposition. |
|
#324 normally merged at Current-head proof retains PHP194/1713, both native completed-image apt/libapt2.6.2 qualifications, exact writer/environment/main-guard controls and Security source/config PASS. The merged remote branch is absent, candidate retained and actual-main checkout clean. Original resulting-main workflows are running; pending optional PR results are not claimed green early. sample-app owns final original-main acceptance and the refreshed effect packet. The successor workflow is blob |
Terminal original-main acceptance and current effect readback#324 is accepted on actual main The normal merge has ordered parents
Both root application jobs (PHP8.4, PHP8.5) pass 194 tests / 1,713 assertions, retaining the existing Playground warning. Original app-kernel output reads PHP8.4.27/8.5.12, Laravel13.34.0, installed Core2.20.4/ Fresh source/config/publisher readback: 2026-11-05T23:16:44.850237+00:00 → 2026-11-05T23:16:51.282171+00:00. Protected main/tree match above; workflow330646635 is active at blob Timestamped anonymous prior-channel observations:
Both responses are OCI indexes with linux/amd64 andlinux/arm64 children; Docker-Content-Digest equals SHA256 of the retained raw bytes. They equal the earlier historical observations. Client: Python3.14.4, OpenSSL 3.5.5 27 Jan 2026; TLS certificate/hostname verification enabled,120 effective CA roots,0 named blocked roots, no proxy/redirect/retry. Four bounded read-only HTTP GETs fetched anonymous pull tokens and index bytes only; no credential/token was printed or retained, no image/layer/container/write occurred. Both identical public raw index bodies are retained once below: No local sample-app-prefixed container, network or volume exists, and this successor used no local build/runtime. The read-only run observer has exited. This receipt closes source/main acceptance and cleanup; it does not select publication. Successor packet and Security effect-packet PASS/admission conditions now have terminal-green main carry. General retains the separate one-original-run decision under its partial-promotion/forward-recovery disposition. Re-read perishable facts immediately before any selected dispatch. #318 and Core1043 remain open through the actual public-image result or General's explicit artifact disposition. |
The registry-writing jobs lack the GitHub Environment required by the organization agent guide. Bind only
build,assembleandpromotetodevcontainer-publicationand add a focused machine-contract test for the writer set, exact environment name and main-ref guards.General configured the empty main-only environment separately: receipt 6671486885. Independent API readback shows only branch
main, no tag/wildcard, zero environment secrets/variables, and only the branch-policy protection rule. No credential is moved or provisioned, and no reviewer/wait/paid feature is added.Local validation: seven parsed positive/mutation controls pass. Removing only the three environment fields makes the workflow identical to accepted main
75329c1975bc2dc4c76bb6f6b389b8f2e69f8e3c. All seven compiled jobs, DAG, timeouts, main guards and existing permissions are preserved. Ten product/recipe/tool inputs are byte-identical, including the fixed Bookworm recipe, central source binding, qualifier, scanner/policy and product locks. Staged secret/public-boundary/diff checks pass. The PHP test and normal source/native qualifications run through existing CI; no local build/runtime was performed.The prior #323 source/main result is accepted: 15 main workflows / 28 checks and 17 candidate workflows all passed on attempt 1, including both native installed apt/libapt2.6.2 qualifications. Its old effect-packet PASS was superseded before dispatch for this concrete missing environment boundary. This successor gets its own normal current-head qualification and exact refreshed effect packet. No old result is represented as new-head clearance.
Tracks #318 and Workflow #1043. General retains publication selection and its explicit partial-main risk/forward-recovery disposition. No workflow dispatch, registry write, rollback, deletion, republish, retry or production effect is selected by this source PR. #318 stays open for its actual public-image outcome or General's explicit artifact disposition.