test(ci): exercise released gates on live pull requests #17

Merged

gitchegumi merged 1 commit from kiyi/live-workflow-acceptance into main

2026-09-05 00:33:21 -05:00

kiyi commented

2026-09-05 00:22:42 -05:00

Member

The suite verifies caller SHA and removal of persisted Git authentication; checks that scan workflows have no privileged secret references; checks the live PR environment for delivery credentials; and runs all five released build/publish/deploy guards against the actual PR event, including a main-ref claim. Disposable Git fixtures prove clean acceptance, working-tree and deleted-history synthetic secret rejection, output/report redaction, missing-Gitleaks failure and version mismatch rejection. Only a sanitized summary is uploaded.

Validation: all 12 live acceptance cases passed in run 63 (52s). Repository security passed (1m26s), and Library checks / tests (pull_request) passed (1m59s). Python syntax, YAML, PR-only trigger and all five guard locations were also checked locally.

This tests the released workflow wiring and guards, not malicious-author trust approvals or isolation between shared runner hosts. No application build, publication, deployment, real credential or CTI_Scripts remediation is involved.

Add a PR-only live acceptance suite for the remaining checks in #1 and #3. It checks out the v1.2.1 release separately and executes its existing gate scripts without modifying the released implementation. The suite verifies caller SHA and removal of persisted Git authentication; checks that scan workflows have no privileged secret references; checks the live PR environment for delivery credentials; and runs all five released build/publish/deploy guards against the actual PR event, including a main-ref claim. Disposable Git fixtures prove clean acceptance, working-tree and deleted-history synthetic secret rejection, output/report redaction, missing-Gitleaks failure and version mismatch rejection. Only a sanitized summary is uploaded. Validation: all 12 live acceptance cases passed in [run 63](https://git.gitchegumi.com/Homelab/workflows/actions/runs/63/jobs/0) (52s). Repository security passed (1m26s), and Library checks / tests (pull_request) passed (1m59s). Python syntax, YAML, PR-only trigger and all five guard locations were also checked locally. This tests the released workflow wiring and guards, not malicious-author trust approvals or isolation between shared runner hosts. No application build, publication, deployment, real credential or CTI_Scripts remediation is involved.

kiyi added 1 commit

2026-09-05 00:22:42 -05:00

test(ci): exercise released gates on live pull requests

Workflow acceptance / acceptance (pull_request) Successful in 52s

Details

Repository security / security-1 (pull_request) Successful in 1m26s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 1m59s

Details

919ddb4e1a

Prove synthetic secret rejection and redaction, missing-tool failures, caller identity and PR release-guard isolation using the pinned v1.2.1 implementation. Retain only a sanitized acceptance summary.

kiyi commented

2026-09-05 00:24:22 -05:00

Author

Member

Live acceptance run 63 passed all 12 cases in 52 seconds against the released v1.2.1 implementation. The workflow-acceptance summary artifact was retained.

Verified clean-source acceptance; synthetic working-tree and deleted-history secret rejection; console/report redaction; missing-Gitleaks failure; wrong-version rejection; correct PR checkout with no persisted Git authentication; scan wiring/live environment without delivery secrets; and PR rejection by all five released build/publish/deploy guards, including attempts using a main-ref value. Synthetic fixtures existed only in temporary local Git repositories inside the job. No real credentials were used and no publishing/deployment ran.

This is workflow-level PR isolation evidence. It does not claim a malicious-author/fork approval test or host isolation for the shared runner; ephemeral CI/deploy separation remains the planned Kubernetes migration. The regular source scan and library regression checks are still running/queued.

The branch rule currently also requires Library checks / tests (push), which this PR cannot report because push tests target main. It should require Library checks / tests (pull_request) instead.

[Live acceptance run 63](https://git.gitchegumi.com/Homelab/workflows/actions/runs/63/jobs/0) passed all 12 cases in 52 seconds against the released v1.2.1 implementation. The workflow-acceptance summary artifact was retained. Verified clean-source acceptance; synthetic working-tree and deleted-history secret rejection; console/report redaction; missing-Gitleaks failure; wrong-version rejection; correct PR checkout with no persisted Git authentication; scan wiring/live environment without delivery secrets; and PR rejection by all five released build/publish/deploy guards, including attempts using a main-ref value. Synthetic fixtures existed only in temporary local Git repositories inside the job. No real credentials were used and no publishing/deployment ran. This is workflow-level PR isolation evidence. It does not claim a malicious-author/fork approval test or host isolation for the shared runner; ephemeral CI/deploy separation remains the planned Kubernetes migration. The regular source scan and library regression checks are still running/queued. The branch rule currently also requires `Library checks / tests (push)`, which this PR cannot report because push tests target main. It should require `Library checks / tests (pull_request)` instead.

kiyi referenced this pull request

2026-09-05 00:24:55 -05:00

Add secret scanning for commits and Forgejo Actions #1

kiyi referenced this pull request

2026-09-05 00:25:23 -05:00

Establish versioned workflows reusable across organizations #3

kiyi commented

2026-09-05 00:28:16 -05:00

Author

Member

Final validation: all checks are successful, including the source security scan and library regression suite. The branch rule now correctly requires Library checks / tests (pull_request); the previously noted push-context mismatch is resolved. Issues #1 and #3 both have 5/5 acceptance items checked and linked live evidence. This PR is ready for review and requires one approval before merge.

portegumi approved these changes

2026-09-05 00:30:54 -05:00

portegumi left a comment

The PR-only acceptance workflow exercises the published v1.2.1 implementation at exact commit 62ddd420fbebc3eb05405fa9dcf553f538377557, keeps both checkouts credential-unpersisted, uses the unprivileged ci runner role, and uploads only the sanitized summary. The live exact-head run passed all 12 cases: checkout identity, scan wiring and credential environment, rejection by all five build/publish/deploy guards even with a forged main ref, clean secret-scan acceptance, working-tree and deleted-history synthetic-secret rejection, redaction, missing-tool failure, and version-mismatch rejection. The retained secret-gate hash exactly matches the released script; the 48 KB job log contains all 12 PASS records and no synthetic AWS-token pattern. Local verification passed all 41 Python 3.12 tests, 16 scaffold cases, syntax checks, merge simulation, and git diff --check. The hosted security artifact reports five exact mitigations, zero blockers, and zero scanner errors, and all four hosted checks are green. The stated exclusions for malicious-author approval and shared-host isolation are accurate. No blocking findings.

The PR-only acceptance workflow exercises the published `v1.2.1` implementation at exact commit `62ddd420fbebc3eb05405fa9dcf553f538377557`, keeps both checkouts credential-unpersisted, uses the unprivileged `ci` runner role, and uploads only the sanitized summary. The live exact-head run passed all 12 cases: checkout identity, scan wiring and credential environment, rejection by all five build/publish/deploy guards even with a forged main ref, clean secret-scan acceptance, working-tree and deleted-history synthetic-secret rejection, redaction, missing-tool failure, and version-mismatch rejection. The retained secret-gate hash exactly matches the released script; the 48 KB job log contains all 12 PASS records and no synthetic AWS-token pattern. Local verification passed all 41 Python 3.12 tests, 16 scaffold cases, syntax checks, merge simulation, and `git diff --check`. The hosted security artifact reports five exact mitigations, zero blockers, and zero scanner errors, and all four hosted checks are green. The stated exclusions for malicious-author approval and shared-host isolation are accurate. No blocking findings.