Report safe channel Git rejections and retain failure evidence #95

Merged

gitchegumi merged 1 commit from kiyi/channel-push-diagnostics into main

2026-10-13 18:15:27 -05:00

kiyi commented

2026-10-13 18:08:37 -05:00

Member

Run 618 failed while pushing the immutable workflow snapshot, before its canary or stable-tag update. The generic Git exception hid the rejection reason and left no early failure artifact. Refs #93.

Report a fixed failure category for authentication, authorization, protected tags, remote hooks, stale leases or transport errors, with a server-log fallback for unknown rejections. Raw Git stdout/stderr, refs, credential arguments and environment values remain withheld. Print the requested version and snapshot stage, retain public failure evidence even before the normal audit exists, and preserve an audit already written before a later Git failure. The change neither diagnoses run 618’s underlying rejection nor alters authentication, tag permissions, atomic publication, scan names or workflow/job names.

The runbook now gives the exact publication/promotion order, Settings > Tags location, empty-allowlist denial semantics, and fresh-dispatch recovery. Verify the automatic token’s actual authenticated principal before changing protection rules; commit authorship is not that identity. After this fix is reviewed/merged and main checks pass, a fresh promotion from main may still select the already-published v1.36.0; no new numbered release is required solely to exercise this diagnostic.

Validation: full source suite passed (369 tests, one local native-Trivy integration skip), all 14 channel cases passed, YAML/Bash scaffold and 16 mocked cases passed, Ruff default/E/W/D checks and native staged Gitleaks 8.30.1 passed. Includes synthetic credential-withholding cases, failure-artifact/audit preservation, native Git atomic update and stale-lease rejection. No live tag/rule changes or promotion dispatch occurred.

Run [618](https://git.gitchegumi.com/Homelab/workflows/actions/runs/618/jobs/0/attempt/1) failed while pushing the immutable workflow snapshot, before its canary or stable-tag update. The generic Git exception hid the rejection reason and left no early failure artifact. Refs #93. Report a fixed failure category for authentication, authorization, protected tags, remote hooks, stale leases or transport errors, with a server-log fallback for unknown rejections. Raw Git stdout/stderr, refs, credential arguments and environment values remain withheld. Print the requested version and snapshot stage, retain public failure evidence even before the normal audit exists, and preserve an audit already written before a later Git failure. The change neither diagnoses run 618’s underlying rejection nor alters authentication, tag permissions, atomic publication, scan names or workflow/job names. The runbook now gives the exact publication/promotion order, Settings > Tags location, empty-allowlist denial semantics, and fresh-dispatch recovery. Verify the automatic token’s actual authenticated principal before changing protection rules; commit authorship is not that identity. After this fix is reviewed/merged and main checks pass, a fresh promotion from main may still select the already-published v1.36.0; no new numbered release is required solely to exercise this diagnostic. Validation: full source suite passed (369 tests, one local native-Trivy integration skip), all 14 channel cases passed, YAML/Bash scaffold and 16 mocked cases passed, Ruff default/E/W/D checks and native staged Gitleaks 8.30.1 passed. Includes synthetic credential-withholding cases, failure-artifact/audit preservation, native Git atomic update and stale-lease rejection. No live tag/rule changes or promotion dispatch occurred.

kiyi added 1 commit

2026-10-13 18:08:37 -05:00

Report safe channel Git rejection diagnostics and retain failure evidence

Workflow acceptance / acceptance (pull_request) Successful in 1m46s

Details

Repository security / security-1 (pull_request) Successful in 5m38s

Details

Library checks / tests (pull_request) Successful in 6m0s

Details

30a67f5360

kiyi referenced this pull request

2026-10-13 18:09:07 -05:00

Add a shared workflow release channel with centralized upgrades and rollback #93

portegumi reviewed

2026-10-13 18:11:57 -05:00

portegumi left a comment

Reviewed the three changed files at 30a67f5360. The Git wrapper classifies captured failures into fixed messages without emitting raw stdout/stderr or credential-bearing arguments; the CLI retains an already-written audit and writes a bounded failure record when staging fails. The added tests cover withholding, early/late artifacts, atomic publication, and stale leases, and the runbook correctly treats run 618's actual rejection as undiagnosed. No source-level blocker identified. This is a COMMENT, not an approval: Workflow acceptance has succeeded, but exact-head Library checks and Repository security are still running. Do not change tag protection or retry promotion solely on this diagnostic; establish the automatic token's authenticated identity and review the rejection evidence first. Approval/merge readiness requires successful exact-head checks and a fresh review.

Reviewed the three changed files at 30a67f536046959cd46c8a1de9ddb375b8edd5ac. The Git wrapper classifies captured failures into fixed messages without emitting raw stdout/stderr or credential-bearing arguments; the CLI retains an already-written audit and writes a bounded failure record when staging fails. The added tests cover withholding, early/late artifacts, atomic publication, and stale leases, and the runbook correctly treats run 618's actual rejection as undiagnosed. No source-level blocker identified. This is a COMMENT, not an approval: Workflow acceptance has succeeded, but exact-head Library checks and Repository security are still running. Do not change tag protection or retry promotion solely on this diagnostic; establish the automatic token's authenticated identity and review the rejection evidence first. Approval/merge readiness requires successful exact-head checks and a fresh review.