pdurlej/platform

Fork 0

fix(ci): guard apply workflow exit code output #655

Merged

pdurlej merged 1 commit from codex/207-apply-shell-exit-guard into main

2026-06-01 14:45:09 +02:00

codex commented

2026-06-01 08:38:20 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Hardens the manual apply workflow so early shell failures still produce a conservative exit_code for audit and evidence consumers.

Closes #207

Canary Context Pack

Product story

When apply fails, operators and agents need deterministic evidence. A missing steps.apply.outputs.exit_code should not create ambiguous audit output.

What changed

The Apply step now initializes overall=1 and registers a trap that writes exit_code on early EXIT/INT/TERM.
Normal successful apply paths still overwrite the output with the actual aggregate exit code.
Audit log finish normalizes missing or non-numeric exit_code to 1.
Workflow contract tests assert the guard and audit fallback.

Why it changed

Issue #207 identified that early shell failures could bypass the normal output write path and leave audit finish with null/empty exit code evidence.

Files touched

control-plane/forgejo-actions/apply.yaml
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

#207 SHELL-CRASH-DETECT-01
Existing apply workflow evidence/audit contract tests.

Runtime evidence

No production/runtime mutation. Local workflow contract tests and module validation only.

Known constraints

This does not change platformctl apply runtime semantics. It only hardens workflow evidence behavior around shell failure paths.

Explicit out-of-scope

No runtime apply.
No apply status artifact persistence changes.
No fsync/status permissions work.

Requested decision

Approve if early apply workflow failures now produce deterministic non-success evidence.

Merge blockers

Apply workflow can still emit empty/null exit_code for ordinary shell failure paths.
Audit log finish can still render invalid JSON when apply output is missing.

Spec sources read

https://git.pdurlej.com/pdurlej/platform/issues/207 — issue scope and acceptance criteria.
control-plane/forgejo-actions/apply.yaml — manual apply workflow.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py — workflow contract tests.

Validation

UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py -k 'apply_workflow' — 3 passed.
UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_pr_sanity.py — 70 passed.
PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json — exitCode 0.

Canary status: missing — fire canary 3+3 manually before merge ## Summary Hardens the manual `apply` workflow so early shell failures still produce a conservative `exit_code` for audit and evidence consumers. Closes #207 ## Canary Context Pack ### Product story When apply fails, operators and agents need deterministic evidence. A missing `steps.apply.outputs.exit_code` should not create ambiguous audit output. ### What changed - The `Apply` step now initializes `overall=1` and registers a trap that writes `exit_code` on early EXIT/INT/TERM. - Normal successful apply paths still overwrite the output with the actual aggregate exit code. - `Audit log finish` normalizes missing or non-numeric `exit_code` to `1`. - Workflow contract tests assert the guard and audit fallback. ### Why it changed Issue #207 identified that early shell failures could bypass the normal output write path and leave audit finish with null/empty exit code evidence. ### Files touched - `control-plane/forgejo-actions/apply.yaml` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - #207 SHELL-CRASH-DETECT-01 - Existing apply workflow evidence/audit contract tests. ### Runtime evidence No production/runtime mutation. Local workflow contract tests and module validation only. ### Known constraints This does not change `platformctl apply` runtime semantics. It only hardens workflow evidence behavior around shell failure paths. ### Explicit out-of-scope - No runtime apply. - No apply status artifact persistence changes. - No fsync/status permissions work. ### Requested decision Approve if early apply workflow failures now produce deterministic non-success evidence. ### Merge blockers - Apply workflow can still emit empty/null `exit_code` for ordinary shell failure paths. - Audit log finish can still render invalid JSON when apply output is missing. ## Spec sources read - `https://git.pdurlej.com/pdurlej/platform/issues/207` — issue scope and acceptance criteria. - `control-plane/forgejo-actions/apply.yaml` — manual apply workflow. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` — workflow contract tests. ## Validation - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py -k 'apply_workflow'` — 3 passed. - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_pr_sanity.py` — 70 passed. - `PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json` — exitCode 0.

codex added this to the 06 - Agent execution and CI governance milestone

2026-06-01 08:38:20 +02:00

codex added the

class/security-sensitive

label

2026-06-01 08:38:20 +02:00

codex added 1 commit

2026-06-01 08:38:20 +02:00

fix(ci): guard apply workflow exit code output

canary-required / collect-diff (pull_request) Successful in 6s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 28s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 29s

Details

python-ci / Python 3.11 (pull_request) Successful in 51s

Details

python-ci / Python 3.12 (pull_request) Successful in 54s

Details

python-ci / Python 3.13 (pull_request) Successful in 54s

Details

base-is-main / guard (pull_request) Successful in 2s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 6s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 7s

Details

canary-required / canary (pull_request) Successful in 17s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 27s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 7m13s

Details

2dcc595a4d

codex commented

2026-06-01 09:02:18 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 655
Commit: 2dcc595a4db9406b36377af84e0eef01459e487a
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: NOT_OK
medium overall reset to 0 before apply loop weakens early-exit guard
- Evidence: control-plane/forgejo-actions/apply.yaml: after initializing overall=1 and setting the trap, the script resets overall=0 before the apply loop. If the workflow is interrupted (SIGINT/SIGTERM) after this reset but before any apply command ru
- Next: Keep overall=1 until the apply loop completes, then set to 0 only if all apply commands exit with 0, or use a separate 'started' flag to prevent false zero exit codes on early termination.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high Audit finish step skipped when apply fails
- Evidence: control-plane/forgejo-actions/apply.yaml: The Apply step ends with exit $overall(line 175), and the immediately following Audit log finish step (line 180) has noif: always()orcontinue-on-error: trueon the Apply step. Whenoveral`
- Next: Add if: always() to the Audit log finish step (and the Upload apply evidence artifacts step) so the audit trail and evidence artifacts are emitted even when the Apply step fails.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `655` - Commit: `2dcc595a4db9406b36377af84e0eef01459e487a` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`medium`** overall reset to 0 before apply loop weakens early-exit guard - Evidence: `control-plane/forgejo-actions/apply.yaml: after initializing overall=1 and setting the trap, the script resets overall=0 before the apply loop. If the workflow is interrupted (SIGINT/SIGTERM) after this reset but before any apply command ru` - Next: Keep overall=1 until the apply loop completes, then set to 0 only if all apply commands exit with 0, or use a separate 'started' flag to prevent false zero exit codes on early termination. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Audit finish step skipped when apply fails - Evidence: `control-plane/forgejo-actions/apply.yaml: The Apply step ends with `exit $overall` (line 175), and the immediately following Audit log finish step (line 180) has no `if: always()` or `continue-on-error: true` on the Apply step. When `overal` - Next: Add `if: always()` to the Audit log finish step (and the Upload apply evidence artifacts step) so the audit trail and evidence artifacts are emitted even when the Apply step fails. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.