Repository navigation
Enforce the fork boundary before restoring executable CI caches #270
Description
DELIVERED: PR #271 merged as 76f333804e68725059039fd54df241d40d855cd3 on November 2 at 01:56:26 UTC, exact source a948e64bbab36b12bcb2524e23e1d4d7cfbcdc6e. All seven source checks, Security review, actual Sonar zero findings and normal main follow-through passed. Repository prerequisites #929/#254/#973 are merged. Fresh immutable public-main scan: 97 workflows / 11 targets pass without overlays; private Cloud excluded. Normal Python modules:122 tests/2local missing-client skips. No permissions, required checks, cache cap or spending limits changed.
The trusted workflow policy permits an exact shared cache key on a restore-only step in a pull_request workflow without checking whether an external fork can reach that step. For executable build output, branch isolation alone does not preserve final-head CI integrity: an earlier malicious revision can populate the same PR merge-ref cache, which is searched before trusted main output on a later revision.
Security found this during review of SDK-Rust's cache change. The SDK correction 384b202 excludes external forks from executable cache restore and adds a seven-context regression. This follow-up concerns central enforcement, not a remaining Security hold on that SDK change. No GitHub cache poisoning experiment or credential impact is claimed.
General owns this follow-up before reusing the cache pattern broadly.
Acceptance:
- Reject executable cache restores reachable from external fork PRs, including an exact shared key, while retaining the intended protected-main and same-repository paths.
- Keep successful protected-main-only cache writes, precise compiler/dependency keys, safe paths and existing privileged-consumer restrictions.
- Add positive and negative central-policy fixtures for the SDK pattern, a missing fork guard, a fork-shaped event with a main-looking ref, and unrelated/manual triggers.
- Inventory existing governed cache use and run the full policy tests/catalog validation before merging. Preserve required checks and do not grant new permissions or broaden storage/spending limits.
Activity
rmcdaniel commentedon Nov 1, 2026
Implemented in draft PR #271 at
83bd7cee5d21b019ab77ad360318c0d6d3ad24cf.Next: complete Security/required CI and merge the repository prerequisites, refresh the public main catalog, then mark #271 ready only after that catalog satisfies the new policy. Existing permissions, check selection, writers and cache limits remain unchanged.
rmcdaniel commentedon Nov 1, 2026
Workflow prerequisite #973 merged through normal protected checks as
95f7ec01b5d1ab7c91573a918c795b58eb982d68on November 1 at 22:18 UTC. The four intended cache conditions are in main; job predicates, keys, test selection and coverage remain unchanged. No package release is needed.Central enforcement #271 remains draft until the Waterline and Server prerequisites have also merged and a fresh public main catalog passes. Server #929 is currently held with the other lower-priority Server CI work while its owner drains the merge queue.