Skip to content

Commit 7fa26e0

Browse files
joshavantjoshavant
committed
ci: remove security guard rollout floor
1 parent 0cdce79 commit 7fa26e0

2 files changed

Lines changed: 4 additions & 90 deletions

File tree

‎.github/workflows/security-sensitive-guard.yml‎

Lines changed: 0 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,6 @@ permissions:
99
pull-requests: write
1010
issues: write
1111

12-
env:
13-
# Temporary rollout bridge for PRs opened before this workflow's script landed.
14-
# Remove once the pre-rollout PR set has drained.
15-
OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA: 5d9c010628ea4de3492a12e32f9be5b8c5dfa9ed
16-
1712
concurrency:
1813
group: security-sensitive-guard-${{ github.event.pull_request.number }}
1914
cancel-in-progress: true
@@ -24,40 +19,13 @@ jobs:
2419
runs-on: ubuntu-24.04
2520
timeout-minutes: 5
2621
steps:
27-
- name: Check security-sensitive guard rollout eligibility
28-
id: rollout
29-
env:
30-
GH_TOKEN: ${{ github.token }}
31-
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
32-
run: |
33-
status="$(
34-
gh api \
35-
"repos/${GITHUB_REPOSITORY}/compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}" \
36-
--jq '.status'
37-
)"
38-
case "$status" in
39-
ahead|identical)
40-
echo "ready=true" >> "$GITHUB_OUTPUT"
41-
;;
42-
behind|diverged)
43-
echo "ready=false" >> "$GITHUB_OUTPUT"
44-
echo "::notice::Skipping security-sensitive guard for a PR base that predates rollout commit ${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}."
45-
;;
46-
*)
47-
echo "Unexpected compare status for security-sensitive guard rollout: $status" >&2
48-
exit 1
49-
;;
50-
esac
51-
5222
- name: Check out trusted base workflow scripts
53-
if: steps.rollout.outputs.ready == 'true'
5423
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5524
with:
5625
ref: ${{ github.workflow_sha }}
5726
persist-credentials: false
5827

5928
- name: Detect security-sensitive changes
60-
if: steps.rollout.outputs.ready == 'true'
6129
env:
6230
GITHUB_TOKEN: ${{ github.token }}
6331
OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant
@@ -72,40 +40,13 @@ jobs:
7240
runs-on: ubuntu-24.04
7341
timeout-minutes: 5
7442
steps:
75-
- name: Check security-sensitive guard rollout eligibility
76-
id: rollout
77-
env:
78-
GH_TOKEN: ${{ github.token }}
79-
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
80-
run: |
81-
status="$(
82-
gh api \
83-
"repos/${GITHUB_REPOSITORY}/compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}" \
84-
--jq '.status'
85-
)"
86-
case "$status" in
87-
ahead|identical)
88-
echo "ready=true" >> "$GITHUB_OUTPUT"
89-
;;
90-
behind|diverged)
91-
echo "ready=false" >> "$GITHUB_OUTPUT"
92-
echo "::notice::Skipping security-sensitive guard for a PR base that predates rollout commit ${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}."
93-
;;
94-
*)
95-
echo "Unexpected compare status for security-sensitive guard rollout: $status" >&2
96-
exit 1
97-
;;
98-
esac
99-
10043
- name: Check out trusted base workflow scripts
101-
if: steps.rollout.outputs.ready == 'true'
10244
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
10345
with:
10446
ref: ${{ github.workflow_sha }}
10547
persist-credentials: false
10648

10749
- name: Enforce security-sensitive guard
108-
if: steps.rollout.outputs.ready == 'true'
10950
env:
11051
GITHUB_TOKEN: ${{ github.token }}
11152
OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant

‎test/scripts/security-sensitive-guard-workflow.test.ts‎

Lines changed: 4 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ const CODEOWNERS = ".github/CODEOWNERS";
88

99
type WorkflowStep = {
1010
env?: Record<string, string>;
11-
id?: string;
12-
if?: string;
1311
name?: string;
1412
run?: string;
1513
uses?: string;
@@ -24,7 +22,6 @@ type WorkflowJob = {
2422
};
2523

2624
type Workflow = {
27-
env?: Record<string, string>;
2825
jobs?: Record<string, WorkflowJob>;
2926
name?: string;
3027
permissions?: Record<string, string>;
@@ -80,40 +77,16 @@ describe("security-sensitive guard workflow", () => {
8077
const checkout = steps.find((step) => step.uses?.startsWith("actions/checkout@"));
8178

8279
expect(checkout?.uses).toBe("actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd");
83-
expect(checkout?.if).toBe("steps.rollout.outputs.ready == 'true'");
8480
expect(checkout?.with?.ref).toBe("${{ github.workflow_sha }}");
8581
expect(checkout?.with?.ref).not.toBe("${{ github.event.pull_request.base.sha }}");
8682
expect(checkout?.with?.["persist-credentials"]).toBe(false);
8783
expect(steps.at(-1)?.run).toBe("node scripts/github/security-sensitive-guard.mjs");
88-
expect(steps.at(-1)?.if).toBe("steps.rollout.outputs.ready == 'true'");
8984
}
90-
});
91-
92-
it("temporarily skips PR bases that predate the guard rollout commit", () => {
93-
const parsed = readWorkflow();
9485

95-
expect(parsed.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA).toBe(
96-
"5d9c010628ea4de3492a12e32f9be5b8c5dfa9ed",
97-
);
98-
99-
const jobs = parsed.jobs ?? {};
100-
for (const jobName of ["security-sensitive-guard-detect", "security-sensitive-guard"]) {
101-
const steps = jobs[jobName]?.steps ?? [];
102-
const rollout = steps.find(
103-
(step) => step.name === "Check security-sensitive guard rollout eligibility",
104-
);
105-
106-
expect(rollout?.id).toBe("rollout");
107-
expect(rollout?.env?.GH_TOKEN).toBe("${{ github.token }}");
108-
expect(rollout?.env?.PR_BASE_SHA).toBe("${{ github.event.pull_request.base.sha }}");
109-
expect(rollout?.run).toContain(
110-
"compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}",
111-
);
112-
expect(rollout?.run).toContain("ahead|identical)");
113-
expect(rollout?.run).toContain("behind|diverged)");
114-
expect(rollout?.run).toContain("ready=false");
115-
expect(rollout?.run).toContain("predates rollout commit");
116-
}
86+
expect(workflow).not.toContain("OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA");
87+
expect(workflow).not.toContain("Check security-sensitive guard rollout eligibility");
88+
expect(workflow).not.toContain("steps.rollout.outputs.ready");
89+
expect(workflow).not.toContain("/compare/");
11790
});
11891

11992
it("keeps detection separate from the final required check", () => {

0 commit comments

Comments
 (0)