Skip to content

feat(ISSUE-263): W4-C2/W4-C3 adversary pipeline — check_run_writeback + expected_skip - #87

Merged
cloudbrid-agent[bot] merged 1 commit into
mainfrom
w4-c2-w4-c3-pipeline
Aug 23, 2026
Merged

feat(ISSUE-263): W4-C2/W4-C3 adversary pipeline — check_run_writeback + expected_skip#87
cloudbrid-agent[bot] merged 1 commit into
mainfrom
w4-c2-w4-c3-pipeline

Conversation

@cloudbrid-agent

@cloudbrid-agent cloudbrid-agent Bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

W4-C2/W4-C3: adversary pipeline 代码(check_run_writeback + expected_skip)

Related: Cloudbird-Software/.github#283(W4-C2)、Cloudbird-Software/.github#284(W4-C3)

变更内容

  • pipeline/adversary/check_run_writeback.py(W4-C2 新增)
    • adversary 产出判定报告(adversary-report/v1)后,以 cloudbrid-agent App 令牌
      (checks:write,INV-02)在 spec PR head commit 创建 check run,使 verdict 成为合并阻断项
    • verdict → conclusion:survived→success / insufficient→failure / no-attempts→neutral / skip→success
    • fail-closed:未知 verdict / 报告缺失 / schema 不合 → failure(不放行)
  • pipeline/adversary/expected_skip.py(W4-C3 新增)
    • 开发路径豁免谓词由 diff 路径集确定性派生(AC-14 / DECISION-02,禁人工打标)
    • specs/** 为唯一受保护路径集合;含 specs/** 变更却走豁免 → 红(反向断言)
    • 支持 GitHub API 取 PR 文件列表 / stdin / 命令行三种输入

验证

  • py_compile 通过
  • check_run_writeback smoke test:survived→success(0) / insufficient→failure(1) ✓
  • expected_skip smoke test:纯开发路径→EXPECTED_SKIP(0) / specs/** 变更→must-run-adversary(1) ✓

说明

  • 本 PR 仅含 pipeline 代码(App 有 contents 写权);workflow 文件
    (adversary.yml / adversary-gate.yml / conductor.yml)因 App 无 workflows 权限,
    在本地保留于 w4-c3/,待权限到位后补推(见 .github PR 描述)。

@cloudbrid-agent
cloudbrid-agent Bot enabled auto-merge (squash) August 23, 2026 10:47
randypanding
randypanding previously approved these changes Aug 23, 2026

@randypanding randypanding left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Owner approve: W4-C2/C3 adversary pipeline

… + expected_skip

- pipeline/adversary/check_run_writeback.py: 红队 verdict 以 check run 写回 spec PR
  (W4-C2 .github#283,INV-02 checks:write;verdict → conclusion 映射:survived→success /
   insufficient→failure / no-attempts→neutral / skip→success;fail-closed)
- pipeline/adversary/expected_skip.py: 开发路径豁免谓词由 diff 路径集确定性派生
  (W4-C3 .github#284,AC-14 / DECISION-02;禁人工打标;specs/** 变更走豁免 → 红)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant