Repository navigation
ci: admit a hosted form for the release jobs with protected credentials - #771
Conversation
Teach preflight the hosted release/notify-hub form while retaining the legacy isolated form and pin the hosted released-archive comparison contract. Add negative rows for missing environment, wrong runners, credential sharing, and archive-contract mutations.
Keep the workflow snippet byte-faithful in the hosted admission rows so the candidate/control proof exercises the real release text.
Keep the synthetic hosted release fixture byte-faithful to the reviewed released-archive step contract.
Keep isolated runner diagnostics and prebuilt contract text byte-compatible while admitting the paired hosted release form.
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 3 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Adds a hosted release form to the preflight: release and notify-hub may run on ubuntu-24.04 instead of the isolated GKP labels, but only as a matched pair, and the legacy form stays a valid exact contract. Adds release_credential_findings, which refuses the protected release environment or any release credential on every job other than release and notify-hub, with _job_environment_is matching the environment name by exact literal comparison. Defines a hosted prebuilt step list that replaces the glibc floor check with a comparison against the sha256-pinned v1.10.0 release archive, and keeps both the hosted and legacy step lists closed to extra or reordered steps.
Worth a look
- Release environment check is case-sensitive despite GitHub environment names being case-insensitive —
scripts/ci_preflight.py:2394· Escalate · high- NOT verified (no proof, no reproducing execution) — needs human review
- Flow-mapping or expression environment bypasses the protected release environment check —
scripts/ci_preflight.py:2382· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Self-hosted/larger runner refusal test is vacuous because only one job is mutated —
scripts/test_ci_preflight.py:1782· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 902 functions depend on the 874 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
ci_workflow_findings()— 82 callers, 24 callees - worse:
_job_values()— 31 callers, 3 callees - worse:
_job_block()— 18 callers, 3 callees - worse:
runner_findings()— 2 callers, 26 callees - worse:
_holds_credentials()— 4 callers, 7 callees
Verification — 902 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 902 function(s) in the blast radius were not formally verified this run
· 1 grounded finding(s) anchored inline below; 4 more finding(s) on lines outside this diff (see the check run).
| @@ -2828,7 +2869,7 @@ def visit(name: str, inputs: dict[str, str], multiplier: int, stack: tuple[str, | |||
|
|
|||
|
|
|||
| def runner_findings(workflows: dict[str, str]) -> list[str]: | |||
There was a problem hiding this comment.
runner_findings()
fans out to 26 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
Plain merge of main into this branch. Main now has #771 (ci: admit a hosted form for the release jobs with protected credentials), which changes scripts/ci_preflight.py and scripts/test_ci_preflight.py. This branch changes neither file, so the merge has no conflict and the resulting tree is this branch's previous tree plus exactly that change. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The release and notify-hub jobs hold release credentials, so the preflight rules require them to run where nothing else runs. This change keeps that guarantee in a second, hosted form instead of skipping it.
A release job may now run on the GitHub-hosted
ubuntu-24.04runner only when:releaseenvironment,Both release jobs must use the same form. The existing isolated-runner form keeps every finding it had before, byte for byte. The prebuilt archive contract follows the chosen form.
Tests: the old isolated form passes; the hosted form with all three conditions passes; the hosted form without the environment, with a self-hosted label, or beside a credentialed job is refused; the whole
test_ci_preflight.pymodule passes, and the same module against the previous rules fails only on the new hosted-form rows.This change touches only
scripts/ci_preflight.pyand its tests; the workflow change that uses the hosted form follows separately.🤖 Generated with Claude Code