pdurlej/platform

Fork 0

docs(ci): add Forgejo runner hardening audit #685

Merged

pdurlej merged 1 commit from codex/675-runner-hardening-audit into main

2026-06-02 10:34:15 +02:00

codex commented

2026-06-02 10:31:39 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Summary

Adds a read-only Forgejo runner hardening audit for #675 and records the current rs2000 Docker runner risk as explicit, test-backed evidence.

This intentionally does not remove the Docker socket, restart runners, change Infisical tokens, or mutate RS2000. It turns the current risk into a deterministic report and documents the safe next sequence: build/apply separation first, then socket removal/proxy or build-only runner.

What changed

Added platformctl.ci.runner_hardening_audit with JSON/Markdown output.
Added tests proving the current versioned runner files report the expected privilege surface:
- raw Docker socket mount;
- docker:host label;
- Infisical Token Auth file path;
- persistent runner data mount.
Added runnerHardeningPolicy to .forgejo/ci-policy.yaml.
Updated docs/ci/runner-contract.md and runbooks/forgejo-actions-runner.md with the #675 hardening gate and audit command.

Canary Context Pack

Product story

The platform should stop treating the Forgejo Docker runner's host-compromise surface as implicit tribal knowledge. The operator and future agents need a boring, reproducible report before touching runner runtime or CI trust boundaries.

What changed

This PR adds read-only evidence and documentation only. The audit reports current runner hardening findings and can be run before/after later hardening PRs.

Why it changed

Issue #675 identified the Docker runner as a high-value privilege-escalation surface: raw Docker socket, persistent state, and Infisical token access on a runner that executes agent-authored workflow code.

Files touched

.forgejo/ci-policy.yaml
control-plane/platformctl/ci/runner_hardening_audit.py
control-plane/platformctl/tests/test_runner_hardening_audit.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
docs/ci/runner-contract.md
runbooks/forgejo-actions-runner.md

Relevant context

Forgejo issue #675
infra/forgejo-runner/docker-compose.yml
infra/forgejo-runner/config.yaml
docs/ci/runner-contract.md
runbooks/forgejo-actions-runner.md
.forgejo/ci-policy.yaml

Runtime evidence

No runtime mutation. No token access. No runner restart.

Local validation:

PYTHONPATH=. python3 -m pytest platformctl/tests/test_runner_hardening_audit.py platformctl/tests/test_forgejo_runner_infra.py platformctl/tests/test_forgejo_ci_scripts_contract.py
PYTHONPATH=control-plane python3 -m platformctl.ci.runner_hardening_audit --repo-root . --format json
PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json

Results:

targeted pytest: 52 passed
runner hardening audit: 4 expected findings, no secret values in output
platformctl validate all --json: exitCode 0

Note: uv currently panicked locally in macOS system-configuration before Python startup, so validation was rerun with the system Python already carrying the repo dependencies. The observed failure was in uv, not in the tests.

Known constraints

The audit intentionally reports current high/critical findings. It is evidence for #675, not a merge-blocking default check yet.

Explicit out-of-scope

No Docker socket removal.
No socket proxy deployment.
No build-only runner creation.
No Infisical token rotation or ACL change.
No Forgejo runner restart.
No runtime apply.
Does not close #675.

Requested decision

Merge if the read-only audit and documented hardening sequence are useful as the first safe artifact for #675.

Merge blockers

Any raw secret value in audit output.
Any runtime mutation path.
Any claim that #675 is fully remediated.

Spec sources read

Forgejo issue #675 — scope and risk framing.
infra/forgejo-runner/docker-compose.yml — current versioned runner compose shape.
infra/forgejo-runner/config.yaml — current runner container mount allowlist.
docs/ci/runner-contract.md — CI trust boundary contract.
runbooks/forgejo-actions-runner.md — runner operations/runbook context.
.forgejo/ci-policy.yaml — existing CI policy structure.

Refs #675

Canary status: missing — fire canary 3+3 manually before merge ## Summary Adds a read-only Forgejo runner hardening audit for #675 and records the current rs2000 Docker runner risk as explicit, test-backed evidence. This intentionally does not remove the Docker socket, restart runners, change Infisical tokens, or mutate RS2000. It turns the current risk into a deterministic report and documents the safe next sequence: build/apply separation first, then socket removal/proxy or build-only runner. ## What changed - Added `platformctl.ci.runner_hardening_audit` with JSON/Markdown output. - Added tests proving the current versioned runner files report the expected privilege surface: - raw Docker socket mount; - `docker:host` label; - Infisical Token Auth file path; - persistent runner data mount. - Added `runnerHardeningPolicy` to `.forgejo/ci-policy.yaml`. - Updated `docs/ci/runner-contract.md` and `runbooks/forgejo-actions-runner.md` with the #675 hardening gate and audit command. ## Canary Context Pack ### Product story The platform should stop treating the Forgejo Docker runner's host-compromise surface as implicit tribal knowledge. The operator and future agents need a boring, reproducible report before touching runner runtime or CI trust boundaries. ### What changed This PR adds read-only evidence and documentation only. The audit reports current runner hardening findings and can be run before/after later hardening PRs. ### Why it changed Issue #675 identified the Docker runner as a high-value privilege-escalation surface: raw Docker socket, persistent state, and Infisical token access on a runner that executes agent-authored workflow code. ### Files touched - `.forgejo/ci-policy.yaml` - `control-plane/platformctl/ci/runner_hardening_audit.py` - `control-plane/platformctl/tests/test_runner_hardening_audit.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `docs/ci/runner-contract.md` - `runbooks/forgejo-actions-runner.md` ### Relevant context - Forgejo issue #675 - `infra/forgejo-runner/docker-compose.yml` - `infra/forgejo-runner/config.yaml` - `docs/ci/runner-contract.md` - `runbooks/forgejo-actions-runner.md` - `.forgejo/ci-policy.yaml` ### Runtime evidence No runtime mutation. No token access. No runner restart. Local validation: ```bash PYTHONPATH=. python3 -m pytest platformctl/tests/test_runner_hardening_audit.py platformctl/tests/test_forgejo_runner_infra.py platformctl/tests/test_forgejo_ci_scripts_contract.py PYTHONPATH=control-plane python3 -m platformctl.ci.runner_hardening_audit --repo-root . --format json PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json ``` Results: - targeted pytest: 52 passed - runner hardening audit: 4 expected findings, no secret values in output - `platformctl validate all --json`: exitCode 0 Note: `uv` currently panicked locally in macOS `system-configuration` before Python startup, so validation was rerun with the system Python already carrying the repo dependencies. The observed failure was in `uv`, not in the tests. ### Known constraints The audit intentionally reports current high/critical findings. It is evidence for #675, not a merge-blocking default check yet. ### Explicit out-of-scope - No Docker socket removal. - No socket proxy deployment. - No build-only runner creation. - No Infisical token rotation or ACL change. - No Forgejo runner restart. - No runtime apply. - Does not close #675. ### Requested decision Merge if the read-only audit and documented hardening sequence are useful as the first safe artifact for #675. ### Merge blockers - Any raw secret value in audit output. - Any runtime mutation path. - Any claim that #675 is fully remediated. ## Spec sources read - Forgejo issue #675 — scope and risk framing. - `infra/forgejo-runner/docker-compose.yml` — current versioned runner compose shape. - `infra/forgejo-runner/config.yaml` — current runner container mount allowlist. - `docs/ci/runner-contract.md` — CI trust boundary contract. - `runbooks/forgejo-actions-runner.md` — runner operations/runbook context. - `.forgejo/ci-policy.yaml` — existing CI policy structure. Refs #675

codex added this to the 10 - Improvements milestone

2026-06-02 10:31:39 +02:00

codex added the

class/security-sensitive

tier/full

kind/ops

safety:no-prod-mutation

domain:ci

labels

2026-06-02 10:31:39 +02:00

codex added 1 commit

2026-06-02 10:31:39 +02:00

docs(ci): add Forgejo runner hardening audit

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

canary-required / collect-diff (pull_request) Successful in 3s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 39s

Details

python-ci / Python 3.12 (pull_request) Successful in 40s

Details

python-ci / Python 3.13 (pull_request) Successful in 40s

Details

workflow-lint / lint (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 12s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m47s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

cfa7392f97

pdurlej merged commit e2c5f8d2f2 into main

2026-06-02 10:34:15 +02:00

pdurlej referenced this pull request from a commit

2026-06-02 10:34:15 +02:00

Merge pull request 'docs(ci): add Forgejo runner hardening audit' (#685) from codex/675-runner-hardening-audit into main

pdurlej deleted branch codex/675-runner-hardening-audit

2026-06-02 10:34:15 +02:00

codex commented

2026-06-02 10:40:14 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 685
Commit: cfa7392f97ddaaba7807240ef975e5bcdc2eeb00
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: NOT_OK
blocker Empty diff prevents evidence-based review
- Evidence: Diff section is empty despite PR claiming changes to 6+ files including control-plane/platformctl/ci/runner_hardening_audit.py, tests, and policy files
- Next: Re-push or rebase to ensure diff content is available for review; cannot verify any claims without concrete diff evidence
high Canary status explicitly missing
- Evidence: PR description states: 'Canary status: missing — fire canary 3+3 manually before merge'
- Next: Fire canary 3+3 before merge as PR itself requests; do not merge without canary validation

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `685` - Commit: `cfa7392f97ddaaba7807240ef975e5bcdc2eeb00` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`blocker`** Empty diff prevents evidence-based review - Evidence: `Diff section is empty despite PR claiming changes to 6+ files including control-plane/platformctl/ci/runner_hardening_audit.py, tests, and policy files` - Next: Re-push or rebase to ensure diff content is available for review; cannot verify any claims without concrete diff evidence - **`high`** Canary status explicitly missing - Evidence: `PR description states: 'Canary status: missing — fire canary 3+3 manually before merge'` - Next: Fire canary 3+3 before merge as PR itself requests; do not merge without canary validation ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.