-
Notifications
You must be signed in to change notification settings - Fork 0
ci(af01): establish workflow trust baseline #43
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
TheHalfMoon
wants to merge
17
commits into
main
Choose a base branch
from
feat/af01-stack-a-workflow-trust
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
17 commits
Select commit
Hold shift + click to select a range
daae1ef
docs(af01): inventory workflow trust authority
TheHalfMoon 0f373b6
feat(af01): define workflow trust policy
TheHalfMoon d602343
feat(af01): add deterministic workflow trust audit
TheHalfMoon cbac27b
test(af01): cover workflow trust counterexamples
TheHalfMoon ad8d0fc
ci(af01): harden mandatory workflow trust
TheHalfMoon 9163611
ci(af01): pin registry smoke runner
TheHalfMoon 6ba5364
ci(af01): harden oracle workflow authority
TheHalfMoon e844f5b
test(af01): register audit module before execution
TheHalfMoon 0be4766
fix(af01): close action metadata checkout authority gap
TheHalfMoon 95a2b48
test(af01): prove metadata checkout and policy fail closed
TheHalfMoon d76afa1
fix(af01): audit logical cargo invocations
TheHalfMoon 0d639dc
test(af01): cover logical cargo command parsing
TheHalfMoon 8550a64
test(af01): construct literal cargo continuation
TheHalfMoon bb7183e
fix(af01): close workflow policy parser bypasses
TheHalfMoon 47fe525
docs(af01): bind trust rules to rationale
TheHalfMoon c6d8434
test(af01): regress all trust parser bypasses
TheHalfMoon 3c84f9a
docs(af01): record completed Stack A implementation tasks
TheHalfMoon File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| { | ||
| "schema": 1, | ||
| "rules": { | ||
| "cargo_locked_subcommands": [ | ||
| "bench", | ||
| "build", | ||
| "check", | ||
| "clippy", | ||
| "doc", | ||
| "metadata", | ||
| "run", | ||
| "test" | ||
| ], | ||
| "require_container_digest": true, | ||
| "require_checkout_credentials_disabled": true, | ||
| "require_external_uses_full_sha": true | ||
| }, | ||
| "rationales": { | ||
| "cargo_locked_subcommands": "Lockfile-consuming Cargo commands must use the checked-in Cargo.lock rather than silently resolving a different dependency graph during assurance execution.", | ||
| "require_container_digest": "Job and service containers on proof-relevant workflows must resolve to an immutable image generation so a mutable tag cannot silently change the execution environment.", | ||
| "require_checkout_credentials_disabled": "Checkout must not persist the GitHub token into repository Git configuration because later steps do not require ambient repository write credentials.", | ||
| "require_external_uses_full_sha": "External Actions and reusable workflows must be bound to an immutable 40-hex commit so mutable tags or branches cannot change executed code without a repository diff." | ||
| }, | ||
| "workflows": { | ||
| ".github/workflows/cf06-oracle.yml": { | ||
| "jobs": { | ||
| "oracle-changed-profile": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 25 | ||
| }, | ||
| "oracle-proof": { | ||
| "permissions": {}, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 5 | ||
| }, | ||
| "oracle-self-smoke": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 20 | ||
| } | ||
| } | ||
| }, | ||
| ".github/workflows/cf11-multi-version-proof.yml": { | ||
| "jobs": { | ||
| "real-package-graph": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 20 | ||
| } | ||
| } | ||
| }, | ||
| ".github/workflows/cf11g-context-proof.yml": { | ||
| "jobs": { | ||
| "deterministic-context-cli": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 15 | ||
| } | ||
| } | ||
| }, | ||
| ".github/workflows/cf12-impact-proof.yml": { | ||
| "jobs": { | ||
| "deterministic-impact-cli": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 15 | ||
| } | ||
| } | ||
| }, | ||
| ".github/workflows/cf13-quality-gate-proof.yml": { | ||
| "jobs": { | ||
| "deterministic-quality-gate": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 15 | ||
| } | ||
| } | ||
| }, | ||
| ".github/workflows/ci.yml": { | ||
| "jobs": { | ||
| "rust": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 30 | ||
| } | ||
| } | ||
| }, | ||
| ".github/workflows/registry-download-smoke.yml": { | ||
| "jobs": { | ||
| "registry-download": { | ||
| "permissions": { | ||
| "contents": "read" | ||
| }, | ||
| "runner": "ubuntu-24.04", | ||
| "timeout_minutes": 15 | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "exceptions": [] | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
110 changes: 110 additions & 0 deletions
110
specs/015-af-01-trusted-development-baseline/stack-a-inventory.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| # AF-01 Stack A Workflow Trust Inventory | ||
|
|
||
| Status: IMPLEMENTATION_EVIDENCE / T010 | ||
|
|
||
| Canonical inventory base: | ||
|
|
||
| ```text | ||
| main: eeecb0bc03c7040bb18b70bce8b69d618384f783 | ||
| tree: d5abe932f1436a9612f45bf130ba29aadbc5a133 | ||
| AF-01 planning: CANONICAL | ||
| ``` | ||
|
|
||
| This inventory records the tracked GitHub workflow/action authority that AF-01 Stack A must make machine-checkable. It is not a substitute for the repository-owned discovery audit: the audit must discover future workflow and Action metadata files automatically. | ||
|
|
||
| ## Tracked workflow files | ||
|
|
||
| 1. `.github/workflows/ci.yml` | ||
| 2. `.github/workflows/cf06-oracle.yml` | ||
| 3. `.github/workflows/cf11-multi-version-proof.yml` | ||
| 4. `.github/workflows/cf11g-context-proof.yml` | ||
| 5. `.github/workflows/cf12-impact-proof.yml` | ||
| 6. `.github/workflows/cf13-quality-gate-proof.yml` | ||
| 7. `.github/workflows/registry-download-smoke.yml` | ||
|
|
||
| ## Tracked Action metadata | ||
|
|
||
| - `action.yml` | ||
|
|
||
| No `action.yaml` metadata file is present at the inventory base. AF-01 discovery still treats both `action.yml` and `action.yaml` at any tracked path as authoritative scan inputs. | ||
|
|
||
| ## Job authority inventory | ||
|
|
||
| | Workflow | Job | Current effective permission | Current runner | Current container | Current timeout | Stack A disposition | | ||
| |---|---|---|---|---|---|---| | ||
| | `ci.yml` | `rust` | `contents: read` | `ubuntu-latest` | none | none | pin runner/actions, disable checkout credentials, add timeout | | ||
| | `cf06-oracle.yml` | `oracle-self-smoke` | `contents: read` | `ubuntu-latest` | none | none | fixed runner, explicit job permission, timeout | | ||
| | `cf06-oracle.yml` | `oracle-changed-profile` | `contents: read` | `ubuntu-latest` | none | none | fixed runner, explicit job permission, timeout | | ||
| | `cf06-oracle.yml` | `oracle-proof` | inherited `contents: read` | `ubuntu-latest` | none | none | reduce to no repository permission, fixed runner, timeout | | ||
| | `cf11-multi-version-proof.yml` | `real-package-graph` | `contents: read` | `ubuntu-24.04` | Rust digest pinned | 20m | retain | | ||
| | `cf11g-context-proof.yml` | `deterministic-context-cli` | `contents: read` | `ubuntu-24.04` | Rust digest pinned | 15m | retain | | ||
| | `cf12-impact-proof.yml` | `deterministic-impact-cli` | `contents: read` | `ubuntu-24.04` | Rust digest pinned | 15m | retain | | ||
| | `cf13-quality-gate-proof.yml` | `deterministic-quality-gate` | `contents: read` | `ubuntu-24.04` | Rust digest pinned | 15m | retain | | ||
| | `registry-download-smoke.yml` | `registry-download` | `contents: read` | `ubuntu-latest` | none | 15m | fixed runner | | ||
|
|
||
| ## External Action / reusable-workflow references | ||
|
|
||
| Immutable references already used by current proof workflows: | ||
|
|
||
| ```text | ||
| actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 | ||
| actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 | ||
| dtolnay/rust-toolchain@032958afbdc797a9164d3bc0b56325c1308924a5 | ||
| actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 | ||
| ``` | ||
|
|
||
| Current `ci.yml` is the outlier: | ||
|
|
||
| ```text | ||
| actions/checkout@v4 | ||
| dtolnay/rust-toolchain@1.97.1 | ||
| ``` | ||
|
|
||
| `action.yml` is a local composite Action and contains no external `uses:` reference at this base. | ||
|
|
||
| ## Checkout credential inventory | ||
|
|
||
| Every current checkout in the proof/oracle/registry workflows sets: | ||
|
|
||
| ```yaml | ||
| persist-credentials: false | ||
| ``` | ||
|
|
||
| `ci.yml` does not and must be reconciled. | ||
|
|
||
| ## Container identity inventory | ||
|
|
||
| Current containerized proof jobs use digest-bound Rust images. No service containers are present at this base. AF-01 policy applies the digest rule to every future job or service container that appears; a mutable tag is never accepted merely because it is new or non-proof-labeled. | ||
|
|
||
| ## Cargo lockfile-consuming command inventory | ||
|
|
||
| Current workflow commands that build/check/test/run against the Rust dependency graph already use `--locked` in the proof/oracle/registry workflows and in the relevant `ci.yml` clippy/test/run invocations. `cargo fmt` and `cargo --version` are not lockfile-consuming commands and are outside this rule. | ||
|
|
||
| AF-01 audit treats at least these cargo subcommands as lockfile-consuming when present in workflow shell commands: | ||
|
|
||
| ```text | ||
| bench | ||
| build | ||
| check | ||
| clippy | ||
| doc | ||
| metadata | ||
| run | ||
| test | ||
| ``` | ||
|
|
||
| ## Machine-checkable target after T014/T015 | ||
|
|
||
| - every discovered workflow has an exact policy entry for every discovered job; | ||
| - effective workflow/job permissions equal the policy declaration, with no unresolved GitHub default authority; | ||
| - all current runners become `ubuntu-24.04`; | ||
| - every job has an explicit bounded `timeout-minutes`; | ||
| - all external `uses:` references are full 40-hex commit SHAs; | ||
| - all checkout steps persist no credentials; | ||
| - every job/service container reference, if present, is digest-bound with `sha256`; | ||
| - all lockfile-consuming cargo invocations use `--locked`; | ||
| - every tracked `action.yml` and `action.yaml` is scanned for external `uses:` references. | ||
|
|
||
| ## Scope boundary | ||
|
|
||
| Stack A changes development-assurance configuration only. It does not change commandF product semantics, CF-06 production oracle identity, the CF-10 frozen corpus, report schemas, or runtime authority. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
2. Trust rules lack rationale
📘 Rule violation▣ TestabilityAgent Prompt
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools