fix: suppression 门改独立 reusable + dep-review/diff-coverage 钉源改 ciw-ref 输入（ADR-0036 修订/0039/0043，.github #87/#90） - #36
Merged
Conversation
… 输入（ADR-0036 修订/0039/0043） v1.5.1 re-pin 激活实测暴露三问题（.github #87/#90）： 1. suppression-budget job 内嵌 check.yml → 整 workflow action 解析故障 （Unable to resolve harden-runner；v1.5.0 同文件无此 job 正常——Use-up-Plan PR#52/#53/#54 二分实证）。改为独立 suppression-budget.yml（test-integrity.yml 同构模式），判定语义不变（ADR-0036 修订：分发载体变更）。 2. dep-review.yml policy/supply-chain job 用 github.workflow_ref 解析自身 ref—— #21 已实证该变量在 reusable 上下文=caller 自身 ref，policy job 实际检出 caller 仓而 fail-closed（Use-up-Plan PR#52 实证 exit 2）。改 ciw-ref 显式 输入（40 位 SHA fail-closed 校验，= uses pin）。 3. diff-coverage.yml toolref 同款 workflow_ref 依赖——同改 ciw-ref（预防性， 该 workflow 尚无 caller，未实测暴露）。
|
Warning Review limit reached
Next review available in: 22 minutes Limit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Comment |
Comment on lines
+66
to
+75
| - name: Checkout 检测器与 policy（CI-Workflows 同 ref，不取 caller 仓内副本） | ||
| if: github.event_name == 'pull_request' | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: Cloudbird-Software/CI-Workflows | ||
| ref: ${{ inputs.detector-ref }} | ||
| path: ciw-sup | ||
| persist-credentials: false | ||
|
|
||
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 |
PR Summary by QodoFix reusable workflow pinning and split suppression-budget into standalone workflow
AI Description
Diagram
High-Level Assessment
Files changed (5)
|
Code Review by Qodo
1. Broken checkout outputs
|
Comment on lines
-51
to
-52
| echo "repo=$repo" >> "$GITHUB_OUTPUT" | ||
| echo "ref=$ref" >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
1. Broken checkout outputs 🐞 Bug ≡ Correctness
In dep-review.yml the policy job removed the repo/ref outputs from step self, but the
subsequent actions/checkout still reads ${{ steps.self.outputs.repo }} and `${{
steps.self.outputs.ref }}`, causing checkout to fail or resolve incorrectly.
Agent Prompt
## Issue description
`dep-review.yml` policy job’s `self` step now only validates `ciw-ref` and no longer writes `repo` / `ref` to `$GITHUB_OUTPUT`, but the following checkout still references `steps.self.outputs.repo/ref`.
## Issue Context
This will break `policy` job deterministically (checkout receives empty outputs), preventing policy parsing and breaking downstream jobs that rely on policy outputs.
## Fix Focus Areas
- .github/workflows/dep-review.yml[42-61]
## Suggested change
Either:
1) Update the checkout step to use the fixed repo and the validated input:
- `repository: Cloudbird-Software/CI-Workflows`
- `ref: ${{ inputs.ciw-ref }}`
OR
2) Restore writing `repo` and `ref` outputs in step `self` (and keep the checkout referencing those outputs).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+61
to
+64
| run: | | ||
| set -eu | ||
| [ -n "$DETECTOR_REF" ] || { echo "::error::suppression-budget detector-ref 输入为空——检测器来源未钉（ADR-0036 fail-closed）"; exit 1; } | ||
| echo "检测器来源 = CI-Workflows@$DETECTOR_REF（须与 uses: 的 pin 同值）" |
There was a problem hiding this comment.
2. Unpinned detector-ref allowed 🐞 Bug ⛨ Security
suppression-budget.yml claims detector-ref must be a 40-hex commit SHA, but the guard only checks non-empty, allowing branch/tag refs that defeat the intended pinning of detector/policy to an immutable revision.
Agent Prompt
## Issue description
`suppression-budget.yml`’s `detector-ref` input is intended to be a pinned 40-hex commit SHA, but the workflow only checks that it’s non-empty.
## Issue Context
Allowing non-SHA refs (branches/tags) undermines the “tool/policy/workflow are pinned together” guarantee and can allow drift or intentional weakening by changing the ref.
## Fix Focus Areas
- .github/workflows/suppression-budget.yml[24-74]
## Suggested change
Replace the non-empty check with a strict SHA check, consistent with other workflows:
```bash
if ! [[ "$DETECTOR_REF" =~ ^[0-9a-f]{40}$ ]]; then
echo "::error::detector-ref must be a 40-hex SHA"; exit 1
fi
```
(Optionally also require it to equal the caller’s `uses:` pin if you can pass that value explicitly.)
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+45
to
+48
| - name: Harden Runner (egress audit) | ||
| if: github.event_name == 'pull_request' | ||
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85b0992719546e2c # v2.21.0 | ||
| with: |
There was a problem hiding this comment.
3. Harden-runner pin inconsistent 🐞 Bug ⛨ Security
suppression-budget.yml pins step-security/harden-runner to a different commit hash than other workflows (and commonly-used v2.21.0 pin), risking action resolution failures or running an unintended revision.
Agent Prompt
## Issue description
Workflows in this repo pin `step-security/harden-runner` to differing commit SHAs while claiming the same version (v2.21.0).
## Issue Context
Inconsistent pins can:
- break workflow execution if a SHA is invalid/unreachable,
- or silently run a different revision than intended.
## Fix Focus Areas
- .github/workflows/suppression-budget.yml[45-50]
- .github/workflows/dep-review.yml[42-45]
- .github/workflows/diff-coverage.yml[59-62]
## Suggested change
Verify the correct commit SHA for v2.21.0 (or whichever version you intend) and update all workflows to use the same validated SHA + matching comment.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+9
to
+11
| ciw-ref: | ||
| type: string | ||
| default: '' |
There was a problem hiding this comment.
4. Readme omits new inputs 🐞 Bug ⚙ Maintainability
dep-review.yml and diff-coverage.yml now require a ciw-ref input (empty defaults fail-closed), but the README workflow table does not document this, likely causing callers to omit it and break pipelines unexpectedly.
Agent Prompt
## Issue description
The reusable workflows `dep-review.yml` and `diff-coverage.yml` now define a `ciw-ref` input that must be provided (empty default will fail validation), but the README’s workflow table doesn’t mention this requirement.
## Issue Context
Callers following README guidance may omit `ciw-ref` and experience fail-closed errors.
## Fix Focus Areas
- README.md[9-18]
- .github/workflows/dep-review.yml[2-12]
- .github/workflows/diff-coverage.yml[20-33]
## Suggested change
Update the README rows for `dep-review.yml` and `diff-coverage.yml` to explicitly state `ciw-ref` is required (= caller `uses:` pin SHA), similar to the `check.yml` row.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
randypanding
added a commit
that referenced
this pull request
Aug 26, 2026
对近一周（#21..#124）全部 PR 复盘后的机械债清理：仅删除 AST 级验证 「全仓零引用」的未用导入/未用名，不改任何判定逻辑、阈值、白名单或 policy 数据。逐文件出处： - pipeline/adversary/cnb_bridge.py：删未用 `from typing import Any`（#73/#74） - pipeline/adversary/golden_set.py：删未用 `from typing import Any`（#80/#82/#83） - pipeline/adversary/holdout_registry.py：删未用 `from typing import Any`（#81/#82） - pipeline/adversary/e2e/e2e-runner.py：删未用 `from typing import Any`（#89） - pipeline/adversary/llm_verifier.py：删未用 `import math`；可选库导入行去掉 未用名 extract_score（call_verifier/create_openai_client 均在用，保留）（#72/#76） - pipeline/entropy/tests/test_e2e.py：删未用 `import sys`（#56） - pipeline/selftest-c/tests/test_registry.py：删未用 `import copy`（#103） - pipeline/trust-gate/tests/test_adjudicate.py：删未用 `import copy`（#63） - pipeline/trust-gate/tests/test_cli.py：from-import 去掉未用名 PREDICATES/UNLOCK_STATE（保留 trust_gate 可导入性冒烟导入与 noqa 惯例）（#63） - scripts/dep-supply-chain-check.py：删未用 `import copy`（#36/#43） 刻意不动（已核验非死代码）：各模块 `from __future__ import annotations`； fuzz/sast/symbolic 的 `_yamlmini` 双模式导入守卫（noqa F401，保证包路径）； golden_set 等 try-import yaml 的环境 fail-closed 守卫；org-gate / suppression-gate / adversary-gate 等关卡 workflow 与 policy/suppressions.yaml 基线数据——门语义一概不变。 验证： - py_compile 全部 scripts/pipeline *.py 通过；bash -n 全部 *.sh 通过 - workflows/policy/pipeline 共 62 个 YAML 解析通过 - scripts/test-integrity-fixtures/run.sh、scripts/suppression-budget-selftest.sh 通过 - python -m unittest：trust-gate test_adjudicate+test_cli 17 例、 selftest-c tests.test_registry 14 例、entropy tests.test_e2e 10 例——全绿 Co-authored-by: randypanding <randypanding@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
摘要
v1.5.1 re-pin 激活（各业务仓 repin/ciw-v1.5.1 PR 系列）实测暴露三个问题，本 PR 一并修复：
1. suppression-budget job 内嵌 check.yml 触发平台 action 解析故障（#87）
Use-up-Plan PR#52 实测：
check / check与check / suppression-budget双双Unable to resolve action step-security/harden-runner@05e3...（2-3s 即败，多次 rerun 确定性复现）。二分定位（PR#53=v1.5.0 通过 1m14s、PR#54=v1.3.1 通过 1m24s）：job 加进 check.yml 即故障，同内容独立文件无此问题（test-integrity.yml 同构模式全组织在跑）。根因属 GitHub Actions 平台行为，未继续深挖——按实证可行的载体落地。处置：check.yml 回退到 v1.5.0 内容（flaky-retry/ciw-ref 保留）；新增独立
suppression-budget.yml（test-integrity.yml 同构：detector-ref 钉源、执法前 44 断言自测、非 PR 事件 n/a-success、ADR 逃生门）。判定语义与 ADR-0036 原设计一致，分发载体变更记为 ADR-0036 修订（agent-registry 另行 PR）。2. dep-review.yml 的 workflow_ref 钉源是潜伏 bug（#90）
policy/supply-chain job 用
github.workflow_ref解析「本 workflow 被 caller 钉住的 ref」——但 #21（ADR-0043）已实测该变量在 reusable 上下文解析为 caller 自身的 workflow ref。v1.5.1 激活时实证：policy job 检出的是 caller 仓（Use-up-Plan@repin 分支），找不到判定脚本 → fail-closed exit 2（PR#52）。该 workflow 自 #15 合入以来首次被 caller 消费，bug 即刻暴露。处置：新增
ciw-ref输入（40 位 SHA fail-closed 校验，与 caller uses pin 同值），policy/脚本/workflow 三耦合改走显式输入（ADR-0043 教训：reusable 上下文唯一可靠机制）。3. diff-coverage.yml 同款 workflow_ref 依赖（预防性）
toolref 步骤同款问题（该 workflow 尚无 caller，未被暴露）。同改 ciw-ref。
变更文件
.github/workflows/check.yml.github/workflows/suppression-budget.yml.github/workflows/dep-review.yml.github/workflows/diff-coverage.ymlREADME.md验证
C1：.github/ 路径，ADR-0036（修订）/0039/0043 既有背书 + 本 PR 记录实证。