Skip to content

Commit 7fbc491

Browse files
xiaojiou176xiaojiou176
authored
fix(ci): align hosted push-main closeout gates
- keep hosted-first push_main alerts queries advisory until hosted analysis exists\n- preserve fail-closed behavior on local hooks and pre-push\n- sync root/docs/scripts/AI entrypoints with the hard-cut canonical routing contract
1 parent 44608cf commit 7fbc491

8 files changed

Lines changed: 42 additions & 25 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,13 +272,21 @@ jobs:
272272
CORTEXPILOT_DOC_GATE_MODE: ci-diff
273273
CORTEXPILOT_DOC_GATE_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
274274
CORTEXPILOT_DOC_GATE_HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
275+
CORTEXPILOT_CI_ROUTE_ID: ${{ needs.ci-trust-boundary.outputs.route_id }}
276+
CORTEXPILOT_CI_RUNNER_CLASS: github_hosted
275277
CORTEXPILOT_HYGIENE_QUICK_PATH: "1"
276278
GH_TOKEN: ${{ github.token }}
277279
TRUSTED_ROUTE_ALLOWED: ${{ needs.ci-trust-boundary.outputs.trusted_route_allowed }}
278280
run: |
279281
set -euo pipefail
280282
github_alert_mode="require"
281-
if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
283+
if [[ "${CORTEXPILOT_CI_RUNNER_CLASS:-}" == "github_hosted" ]]; then
284+
case "${CORTEXPILOT_CI_ROUTE_ID:-}" in
285+
trusted_pr|untrusted_pr|push_main)
286+
github_alert_mode="auto"
287+
;;
288+
esac
289+
elif [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
282290
github_alert_mode="auto"
283291
fi
284292
export CORTEXPILOT_GITHUB_ALERTS_MODE="${github_alert_mode}"

‎AGENTS.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,9 @@ Work in CortexPilot as a contract-first engineering agent:
7979
`example.com` contract, preserve `.jsonl` temp-report hints in portable scan
8080
scratch names, fail closed on tracked direct email/phone markers plus
8181
forbidden runtime files, fail closed on open GitHub secret/code scanning
82-
alerts in local hooks and pre-push while GitHub-hosted `pull_request`
83-
Quick Feedback / hosted policy lanes stay advisory under integration-token
82+
alerts in local hooks and pre-push while GitHub-hosted `trusted_pr`,
83+
`untrusted_pr`, and hosted-first `push_main` Quick Feedback / hosted policy
84+
lanes stay advisory under integration-token and first-analysis timing
8485
limits, keep workflow static security (`actionlint` + `zizmor`), canonical
8586
secret scanning, and Trivy dependency scanning wired into repo-owned
8687
entrypoints, and sync the root/docs entrypoints when that hygiene contract

‎CHANGELOG.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,9 @@ All notable changes to this repository will be documented in this file.
2424
`security-events: read` plus an explicit `GH_TOKEN` injection, aligning the
2525
route-report policy test with the grouped `GITHUB_ENV` export block used by
2626
the current workflow hardening, and teaching hosted `trusted_pr` /
27-
`untrusted_pr` repo hygiene to keep the live alerts query advisory when the
28-
GitHub integration token still cannot read the alerts APIs
27+
`untrusted_pr` / `push_main` repo hygiene plus Quick Feedback to keep the
28+
live alerts query advisory when the GitHub integration token still cannot
29+
read the alerts APIs or the first hosted analysis has not materialized yet
2930
- scrubbed maintainer-local path fixtures and raw token-looking literals from
3031
public orchestrator/security tests, generalized the modules-root ignore rule,
3132
and documented the same public-fixture hygiene contract across the root AI

‎CLAUDE.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,9 @@ This file mirrors the root AI entrypoint for tools that prefer `CLAUDE.md`.
2222
`example.com` contract, preserve `.jsonl` temp-report hints in portable scan
2323
scratch names, fail closed on tracked direct email/phone markers plus
2424
forbidden runtime files, fail closed on open GitHub secret/code scanning
25-
alerts in local hooks and pre-push while GitHub-hosted `pull_request`
26-
Quick Feedback / hosted policy lanes stay advisory under integration-token
25+
alerts in local hooks and pre-push while GitHub-hosted `trusted_pr`,
26+
`untrusted_pr`, and hosted-first `push_main` Quick Feedback / hosted policy
27+
lanes stay advisory under integration-token and first-analysis timing
2728
limits, keep workflow static security (`actionlint` + `zizmor`), canonical
2829
secret scanning, and Trivy dependency scanning wired into repo-owned
2930
entrypoints, and sync the root/docs entrypoints when that contract shifts

‎README.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -270,11 +270,13 @@ current-tree plus fresh-clone secret scanning
270270
(`bash scripts/check_secret_scan_closeout.sh --mode both`), while pull
271271
requests also run the official GitHub Dependency Review action with the
272272
repo-owned `.github/dependency-review-config.yml` policy.
273-
GitHub-hosted `pull_request` routes keep the live alerts query in advisory
274-
mode for both Quick Feedback and the hosted policy slice, because the
275-
integration token cannot always read the secret/code-scanning alert APIs
276-
there; the fail-closed contract still holds on local hooks, local repo
277-
hygiene, pre-push, and other routes that carry authoritative credentials.
273+
GitHub-hosted `trusted_pr`, `untrusted_pr`, and hosted-first `push_main`
274+
routes keep the live alerts query in advisory mode for Quick Feedback and the
275+
hosted policy slice, because the integration token cannot always read the
276+
secret/code-scanning alert APIs there and a fresh hosted `push_main` route may
277+
not have CodeQL/secret-scanning analysis materialized yet; the fail-closed
278+
contract still holds on local hooks, local repo hygiene, pre-push, and other
279+
routes that carry authoritative credentials.
278280

279281
Hosted-first `push_main` follows the same external-truth boundary as PR routes:
280282
protected upstream/provider smoke stays a manual closeout concern, so the

‎docs/README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,10 @@ owns the repo-wide Trivy filesystem/dependency lane, and
3434
secret scanning against the current tree or a fresh clone. Pull requests also
3535
run the official GitHub Dependency Review action under the repo-owned
3636
`.github/dependency-review-config.yml` policy file. On GitHub-hosted
37-
`pull_request` routes the live alerts query stays advisory for both Quick
38-
Feedback and the hosted policy slice because the integration token may not be
39-
allowed to read the alerts APIs there.
37+
`trusted_pr`, `untrusted_pr`, and hosted-first `push_main` routes the live
38+
alerts query stays advisory for both Quick Feedback and the hosted policy
39+
slice because the integration token may not be allowed to read the alerts APIs
40+
there and a fresh hosted `push_main` route may not have live analysis yet.
4041

4142
## Repository Entry
4243

‎scripts/README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -156,12 +156,13 @@ user's ambient Python environment.
156156
repo hygiene, the host-compatible pre-commit quality gate, a dedicated
157157
pre-commit hook, pre-push, and Quick Feedback so cloud-side security
158158
regressions cannot hide behind a locally clean worktree. GitHub-hosted
159-
`pull_request` routes keep this query advisory-only in Quick Feedback and
160-
the hosted policy slice because the integration token may not be able to
161-
read the alerts APIs there. The gate now queries the GitHub REST API
162-
directly from `GH_TOKEN` / `GITHUB_TOKEN` and only falls back to
163-
`gh auth token` for local token discovery, so containerized CI lanes do not
164-
depend on a `gh` binary being installed.
159+
`trusted_pr`, `untrusted_pr`, and hosted-first `push_main` routes keep this
160+
query advisory-only in Quick Feedback and the hosted policy slice because
161+
the integration token may not be able to read the alerts APIs there and a
162+
fresh hosted `push_main` route may not have live analysis yet. The gate now
163+
queries the GitHub REST API directly from `GH_TOKEN` / `GITHUB_TOKEN` and
164+
only falls back to `gh auth token` for local token discovery, so
165+
containerized CI lanes do not depend on a `gh` binary being installed.
165166
- `check_workflow_static_security.sh` is the repo-owned GitHub Actions static
166167
security gate. It bootstraps pinned `actionlint` + `zizmor` binaries through
167168
`scripts/lib/release_tool_helpers.sh`, then runs both scanners fail-closed

‎scripts/check_repo_hygiene.sh‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@ INCLUDE_EXTERNAL_TRUTH="${CORTEXPILOT_HYGIENE_INCLUDE_EXTERNAL:-0}"
77
QUICK_PATH="${CORTEXPILOT_HYGIENE_QUICK_PATH:-0}"
88
if [[ -n "${CORTEXPILOT_GITHUB_ALERTS_MODE:-}" ]]; then
99
GITHUB_ALERTS_MODE="${CORTEXPILOT_GITHUB_ALERTS_MODE}"
10-
elif [[ "${CORTEXPILOT_CI_RUNNER_CLASS:-}" == "github_hosted" && ( "${CORTEXPILOT_CI_ROUTE_ID:-}" == "trusted_pr" || "${CORTEXPILOT_CI_ROUTE_ID:-}" == "untrusted_pr" ) ]]; then
11-
# GitHub-hosted PR integration tokens cannot reliably read the alerts APIs.
12-
# Keep local / repo-owned gates fail-closed, but avoid blocking hosted PR
13-
# slices on a permission model they cannot satisfy.
10+
elif [[ "${CORTEXPILOT_CI_RUNNER_CLASS:-}" == "github_hosted" && ( "${CORTEXPILOT_CI_ROUTE_ID:-}" == "trusted_pr" || "${CORTEXPILOT_CI_ROUTE_ID:-}" == "untrusted_pr" || "${CORTEXPILOT_CI_ROUTE_ID:-}" == "push_main" ) ]]; then
11+
# GitHub-hosted integration tokens cannot reliably read the alerts APIs, and
12+
# fresh hosted-first push_main routes may not have CodeQL/secret-scanning
13+
# analysis materialized yet. Keep local / repo-owned gates fail-closed, but
14+
# avoid blocking hosted routes on a permission/timing model they cannot
15+
# satisfy.
1416
GITHUB_ALERTS_MODE="auto"
1517
else
1618
GITHUB_ALERTS_MODE="require"

0 commit comments

Comments
 (0)