feat(ISSUE-263): W4-C2/W4-C3 red team pipeline (check run writeback + EXPECTED_SKIP) - #88
Merged
Merged
Conversation
…KIP 派生） W4-C2（.github#283，INV-02/AC-4/AC-14）： - pipeline/adversary/check_run_writeback.py：红队 verdict 产出后，以 App 令牌 （单仓作用域、checks:write，1h 过期）向 spec PR 写回 check run （check 名 = "adversary"）；verdict→conclusion 映射（survived→success / insufficient→failure / no-attempts→neutral / 未知→failure fail-closed）； PR 定位确定性策略（优先 --spec-pr，否则按报告 target 路径匹配 open PR） - pipeline/adversary/tests/test-check-run-writeback.sh + tests/test_check_run_writeback_logic.py：W0-W4 自测（语法/schema/映射/截断/ 定位/环境缺失，零网络零凭据） W4-C3（.github#284，AC-14/AC-19）： - pipeline/adversary/expected_skip.py：开发路径豁免谓词由 diff 路径集确定性派生 （禁人工打标）；specs/** 实质变更 → EXPECTED_SKIP=False（必须含 adversary check）；dev 路径 → EXPECTED_SKIP=True；owner 登记豁免清单（reference-level tweaks，C1 路径 ADR-0032） - pipeline/adversary/fixtures/expected_skip/exemptions.json：豁免清单样例 - pipeline/adversary/tests/test-expected-skip.sh：E0-E7 自测（零网络） 注：.github/workflows/adversary.yml / adversary-gate.yml 因当前 cloudbrid-agent App 无 workflows 权限未推（待权限到位后补推）；pipeline 代码已推。 Relates to Cloudbird-Software/.github#283 Relates to Cloudbird-Software/.github#284
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
W4-C2/W4-C3: 红队 pipeline 代码（check run 写回 + EXPECTED_SKIP 确定性派生）
变更内容
pipeline/adversary/check_run_writeback.py— W4-C2：红队 verdict 写回 spec PR check run--spec-pr，否则按报告 target 路径匹配 open PR）pipeline/adversary/expected_skip.py— W4-C3：开发路径豁免谓词由 diff 路径集确定性派生（禁人工打标）EXPECTED_SKIP=False；dev 路径 →EXPECTED_SKIP=Trueexemption_sha可追溯pipeline/adversary/tests/—test-check-run-writeback.sh（W0-W4）+test_check_run_writeback_logic.py+test-expected-skip.sh（E0-E7），零网络零凭据阻塞
.github/workflows/adversary.yml（dispatch 白名单扩展 + writeback job）与.github/workflows/adversary-gate.yml因当前 cloudbrid-agent App 无 workflows 权限未推，已本地完整实现于w4-c2/ciw-repo/.github/workflows/，待权限到位后补推。AC 覆盖
Card: Cloudbird-Software/.github#283
Card: Cloudbird-Software/.github#284