Repair shared source scans and refresh reviewed Semgrep metadata #103
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!103
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/semgrep-reviewed-rules"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Shared scans fail because the official Semgrep pack changed its full-content checksum and selected base-image folders were incorrectly passed to a complete Git-history scan.
The comparison covers every field of all 225 rules: upstream only added metadata.semgrep.dev.rule.path, equal to each existing rule ID. Detection patterns, severities, languages, options and messages are unchanged (48 ERROR, 172 WARNING, 5 INFO). Commit
34f0c57756updates the canonical-rules-v1 checksum while retaining full metadata hashing and fail-closed scanner errors; licensed payloads stay private.Commit
ab0004bpasses the complete checkout separately to both base-image adapters, preserving the selected Docker context and every workflow/job/status name. Follow-up35f595ffixes the regression reported in Library run 722: caller-selected folders remain confined at the CLI boundary, while ComfyUI’s existing fixed-recipe generated payload still scans its original complete checkout/history and binds the source decision in its receipt. No mitigation or security bypass was added.Validation: 54 rule/security/reporting tests passed. The final combined branch (
5299688) completed 127 focused local cases with eight Windows symlink skips, including native-Gitleaks payload regressions and CLI path rejection. Platform checks cover 377 files, 199 YAML files, 28 Kustomize roots, 77 Core tests and 10 RKE2 guards; base-image source tests passed 35 cases. Harbor’s two contract scripts and all 24 tests passed. Exact-head hosted checks, builds and live acceptance remain required.Merge and delivery checklist, after required approvals and successful current checks:
The owner selected checkout-based adapters for this batch. Restore the security-image path later after a reviewed rebuild, updated payload bindings and hosted acceptance; channel promotion cannot replace an embedded v1.33.0 payload. This preparation made no credential reads or live deployments. The owner merged #103 and v1.39.0 is published; channel promotion and deployment acceptance are separate gates.
Batch procedure.
Source review at
34f0c57756: the changed-file inventory is limited to rules.lock.json and docs/security.md. I inspected both complete files at this head. The lock retains canonical-rules-v1, the official Semgrep security-audit endpoint and 225-rule count, changing the pinned full-content digest; the added security documentation records a rule-ID/all-fields comparison with the previously verified pack, identifies only metadata.semgrep.dev.rule.path additions equal to the IDs, and explicitly retains fail-closed scanner behavior and caller adoption requirements. A live official registry sample also shows the reported metadata path. No code, policy, UDS deployment, gateway or routing resources are changed, so there is no UDS ownership/admission boundary to validate here. This approves the source change, not the release or merge: Workflow acceptance, Repository security and Library checks are still pending at this head. I did not independently reproduce the complete 225-rule pack comparison from the private retained payload; the documented comparison and new digest still require the hosted exact-head scan/verification. Do not promote the library or consumer images until those required gates and separate release evidence complete.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
New commits pushed, approval review dismissed automatically according to repository settings
Source review of current head
ab0004bd5a: inspected all seven changed files, including both reusable base-image workflows, container.py, and the selected-context test. Both workflows now pass --source-checkout source; container.build scans the complete checkout and reads its mitigation policy before preparing the curated image context, while the image scan remains scoped to the built image. The test asserts the full-checkout source scan and excluded file from the Docker context. This is source-only approval, not successful CI, image approval, publication, or merge authorization. This change does not alter UDS packages, admission, gateways or routing.Actions run 709 (API 7288) fails before checkout: executing startup jobs 9157/9158 report runner Docker 'No such image' for the pinned security image. Legacy/image wrapper jobs 9155/9156 have no persisted logs (.MISSING), not an authenticated-log failure. Workflow acceptance run 707 and Repository security run 708 likewise fail during job-container creation; Library checks run 710 were pending at review. No source, image, Semgrep, or security scan pass is established. Identify the affected runner/service and restore the pinned job image (operator-preferred runner restart where authorized), rerun the existing exact-head checks, and inspect fresh jobs and artifacts; do not bypass any gate. The preinstalled image still embeds v1.33.0 and needs separate reviewed rebuild/adoption, not a channel-only upgrade. The PR's earlier approval was bound to an older SHA, so this approval is expressly bound to this head.
CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.
Refresh reviewed Semgrep registry metadata checksumto Repair shared source scans and refresh reviewed Semgrep metadataOwner priority, confirmed 2026-10-15: complete the RKE2 and UDS Core updates first; finish SeaweedFS integration required by Harbor next; deploy Harbor; then handle the remaining applications. This workflow batch is the shared prerequisite and still gets ONE numbered release and ONE stable-v1 promotion.
Platform #128 now integrates #126 in 7914cfc, resolving the Core documentation overlaps while preserving init v0.86.0. Its local source validator, all 77 Core tests and 10 RKE2 guard tests pass. Merge platform #126 before #128 after the library promotion and fresh owning checks. This merges source only; protected Core/RKE2 delivery and live acceptance remain separate.
The full library run 722 exposed a regression in the new selected-context check: ComfyUI intentionally builds a curated payload outside its source checkout. The correction is being validated; this PR is not ready to merge until that fix and the exact-head hosted gates pass.
Blocking regression discovered after my earlier source approval on this same SHA: pipeline/container.py build() rejects a selected context outside its scanned checkout with
require(source == checkout or checkout in source.parents, ...). ComfyUI deliberately builds its curated payload outside the source checkout (kiyi's comment #6568 reports the full Library run 722 exposed this), so the new invariant fails before source scanning, although the caller can supply a separate complete checkout. The new test in tests/test_base_images.py exercises only a nested tools/main-runner context and misses the supported external-payload case. Preserve full-checkout source/history scanning and the separate curated Docker context, but make the relationship check compatible with the external selected context without allowing a caller to evade source-security gates. Add a regression for that layout and rerun relevant local tests and exact-head Library/required hosted checks. I inspected the live head and run 710/API 7289 job 9159; its bounded diagnostic excerpt is truncated and does not show the precise failing assertion, so this review does not claim that particular traceback was independently captured. Other exact-head contexts are also failed, including pre-checkout pinned security-image startup reported in my prior review; no security or acceptance gate is waived. This new finding supersedes my prior source-only approval as a merge-readiness assessment. No UDS deployment, admission, gateway or route resource is changed here. No merge or promotion authorized.Blocking at
35f595ff76: the regression identified in my prior review remains in the exact-head source.pipeline/container.pystill executesrequire(source == checkout or checkout in source.parents, 'Container build context must stay within the scanned checkout')beforebuild()and therefore beforescan(checkout, ...). A supported ComfyUI call with an independently curated build context outside the complete source checkout is rejected even when--source-checkoutpoints to the intended full Git tree. The newly addedtest_selected_context_cli_rejects_an_unrelated_checkout_before_scanningexplicitly codifies that rejection rather than covering the supported external-curated-context layout. Kiyi's comment #6568 reports the failing full Library run 722; I have not reproduced that run's traceback locally. Please allow the reviewed external-curated-context case while still binding the full original checkout to source/history and mitigation-policy scans; add a positive regression for the separated paths plus a negative case demonstrating that an unrelated checkout cannot bypass security. Retain both base-image adapters' full-checkout scanning, selected Docker context, image scan, and all required gates. Re-run relevant tests and exact-head hosted checks after the correction. This PR changes workflow-library scanning only, not UDS packaging, admission, gateway or routing resources, so there is no new UDS runtime ownership boundary to test. The changed Semgrep digest still needs verified exact-head hosted evidence; I have not independently reproduced the private 225-rule comparison. At review time Workflow acceptance, Repository security, Library checks and Security image compatibility are pending (security-image run 7311 has a running startup job); none is claimed passed. This review is not merge, promotion, or a scan waiver.Fresh source review of all seven changed files at
35f595ff76; this supersedes my mistaken change request #1213 on the same SHA. The containment require is in the CLI'sbuild-kind=applicationbranch only, after thepython-payloadbranch dispatches its fixed recipe, and is no longer insidecontainer.build(). Thus it does not reject the internal generated external-context call that caused the ComfyUI regression; I had conflated those entrypoints. The application CLI still rejects a selected folder outside its declared checkout before creating outputs (negative test), while both base-image adapters pass the complete checkout separately from their selected Docker context. Inbuild()the source gate and mitigation policy usesource_checkoutbefore the context is copied or the image built; the selected context remains the image build input, and the signed receipt binds the source decision. The existing nested-context mock test verifies scan checkout versus image context. A dedicated positive regression for the external generated-payload layout would improve coverage, but its absence alone is not evidence of a remaining source defect; please consider adding one separately. The Semgrep lock retains canonical-rules-v1 and all-field hashing, updating the reviewed 225-rule checksum only. I have not independently reproduced the private old/new rule-pack comparison; hosted exact-head security evidence remains necessary. Workflow acceptance and Repository security succeeded at this SHA, and Security image compatibility run 7311 completed successfully; Library checks run 7312 remained running at review time and are NOT claimed passed. No UDS package, deployment policy, admission, gateway or route changes; no new UDS runtime boundary. This is source-only approval, not merge, image publication, release/promotion authorization or a waiver of any required CI gate.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.