pdurlej/platform

Fork 0

fix(ci): allow runner proxy exec API #693

Merged

pdurlej merged 1 commit from codex/688-runner-proxy-exec into main

2026-06-02 13:48:15 +02:00

codex commented

2026-06-02 13:42:22 +02:00

Collaborator

Canary status: missing — Forgejo PR checks must run before merge.

Summary

This aligns the versioned Forgejo runner socket-proxy config with the live #688 hotfix caught by the runtime smoke.

Enables EXEC=1 on docker-socket-proxy so runner jobs can start Docker exec sessions.
Adds runner infra coverage for the required proxy API category.
Adds an audit regression test so missing EXEC=1 is reported as a high-severity finding.

Canary Context Pack

Product story

#688 needs the runner to stop mounting the raw Docker socket while preserving normal CI job execution.

What changed

The socket proxy now explicitly permits Docker exec lifecycle APIs and the audit catches that category if it is removed.

Why it changed

A live smoke PR failed after #691 because docker-socket-proxy returned 403 on POST /exec/.../start; the live runtime was hotfixed with EXEC=1, and this PR makes the repo source of truth match.

Files touched

infra/forgejo-runner/docker-compose.yml
control-plane/platformctl/ci/runner_hardening_audit.py
control-plane/platformctl/tests/test_forgejo_runner_infra.py
control-plane/platformctl/tests/test_runner_hardening_audit.py

Relevant context

#688 operator-approved pending runtime applies batch
PR #691 runner socket proxy hardening

Runtime evidence

Live runner proxy was hotfixed with EXEC=1 after the smoke failure. Final smoke remains part of #688 after this repo fix lands.

Known constraints

No raw socket mount is restored. Dangerous proxy categories remain disabled: AUTH=0, SECRETS=0, SYSTEM=0.

Explicit out-of-scope

No broader runner isolation, no token rotation, no deploy runner split, no runtime mutation from this PR.

Requested decision

Approve and merge after green checks so #688 can continue with a clean source-of-truth config.

Merge blockers

Any failed CI check or evidence that EXEC=1 reintroduces dangerous API categories.

Spec sources read

infra/forgejo-runner/docker-compose.yml — proxy env contract
control-plane/platformctl/ci/runner_hardening_audit.py — existing audit behavior
control-plane/platformctl/tests/test_forgejo_runner_infra.py — runner infra assertions
control-plane/platformctl/tests/test_runner_hardening_audit.py — audit regression tests

Validation

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_runner_infra.py control-plane/platformctl/tests/test_runner_hardening_audit.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py — 54 passed
PYTHONPATH=control-plane python3 -m platformctl.ci.runner_hardening_audit --repo-root . --format markdown --fail-on critical — passed
PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json — exitCode 0

Refs #688

Canary status: missing — Forgejo PR checks must run before merge. ## Summary This aligns the versioned Forgejo runner socket-proxy config with the live #688 hotfix caught by the runtime smoke. - Enables `EXEC=1` on `docker-socket-proxy` so runner jobs can start Docker exec sessions. - Adds runner infra coverage for the required proxy API category. - Adds an audit regression test so missing `EXEC=1` is reported as a high-severity finding. ## Canary Context Pack ### Product story #688 needs the runner to stop mounting the raw Docker socket while preserving normal CI job execution. ### What changed The socket proxy now explicitly permits Docker exec lifecycle APIs and the audit catches that category if it is removed. ### Why it changed A live smoke PR failed after #691 because `docker-socket-proxy` returned 403 on `POST /exec/.../start`; the live runtime was hotfixed with `EXEC=1`, and this PR makes the repo source of truth match. ### Files touched - `infra/forgejo-runner/docker-compose.yml` - `control-plane/platformctl/ci/runner_hardening_audit.py` - `control-plane/platformctl/tests/test_forgejo_runner_infra.py` - `control-plane/platformctl/tests/test_runner_hardening_audit.py` ### Relevant context - #688 operator-approved pending runtime applies batch - PR #691 runner socket proxy hardening ### Runtime evidence Live runner proxy was hotfixed with `EXEC=1` after the smoke failure. Final smoke remains part of #688 after this repo fix lands. ### Known constraints No raw socket mount is restored. Dangerous proxy categories remain disabled: `AUTH=0`, `SECRETS=0`, `SYSTEM=0`. ### Explicit out-of-scope No broader runner isolation, no token rotation, no deploy runner split, no runtime mutation from this PR. ### Requested decision Approve and merge after green checks so #688 can continue with a clean source-of-truth config. ### Merge blockers Any failed CI check or evidence that `EXEC=1` reintroduces dangerous API categories. ## Spec sources read - `infra/forgejo-runner/docker-compose.yml` — proxy env contract - `control-plane/platformctl/ci/runner_hardening_audit.py` — existing audit behavior - `control-plane/platformctl/tests/test_forgejo_runner_infra.py` — runner infra assertions - `control-plane/platformctl/tests/test_runner_hardening_audit.py` — audit regression tests ## Validation - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_runner_infra.py control-plane/platformctl/tests/test_runner_hardening_audit.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` — 54 passed - `PYTHONPATH=control-plane python3 -m platformctl.ci.runner_hardening_audit --repo-root . --format markdown --fail-on critical` — passed - `PYTHONPATH=control-plane python3 -m platformctl.cli validate all --json` — exitCode 0 Refs #688

codex added 1 commit

2026-06-02 13:42:22 +02:00

fix(ci): allow runner proxy exec API

python-ci / Python 3.12 (pull_request) Successful in 40s

Details

python-ci / Python 3.13 (pull_request) Successful in 40s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 38s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 44s

Details

ca5ac80a74

codex commented

2026-06-02 13:46:30 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 693
Commit: ca5ac80a741f592ce6859673eb44da55569a953e
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: Ollama response had no message.content.
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `693` - Commit: `ca5ac80a741f592ce6859673eb44da55569a953e` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: Ollama response had no message.content. - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.