pdurlej/platform

Fork 0

fix(ci): harden workflow output handling #774

Merged

pdurlej merged 1 commit from codex/issues/729-ci-pipefail-output-guard into main

2026-06-10 21:39:03 +02:00

codex commented

2026-06-10 20:45:00 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Forgejo workflow outputs and deploy-host shell blocks should behave predictably on Forgejo runners. This keeps CI/deploy trust-boundary work from silently masking pipe failures or writing step outputs through a GitHub-only path.

What changed

Added set -euo pipefail to deploy-host run blocks in platformctl-auto-apply.yml and release-root-promote.yml, including the manual exit-code block whose commands are already guarded by if ...; then.
Replaced bare $GITHUB_OUTPUT writes with ${FORGEJO_OUTPUT:-$GITHUB_OUTPUT} in the four affected workflows.
Added a workflow linter finding for bare $GITHUB_OUTPUT output redirections, with coverage for quoted, unquoted, and braced variants.

Why it changed

Issue #729 identified two related CI footguns: masked pipeline failures on trusted deploy-host jobs and GitHub-specific output paths in Forgejo workflows.

Files touched

.forgejo/workflows/platformctl-auto-apply.yml
.forgejo/workflows/release-root-promote.yml
.forgejo/workflows/base-is-main.yml
.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml
.forgejo/workflows/merged-in-main-audit.yml
control-plane/platformctl/ci/lint_workflows.py
control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py

Relevant context

Issue #729 scope and acceptance criteria.
contexts/security-policy/MAP.md: workflow/deploy-runner trust-boundary changes route as class/security-sensitive and tier/full.
Advisory scout pass: Ollama GLM, Ollama DeepSeek, and AntiGravity reviewed a sanitized packet. Consensus: use Forgejo output fallback; guard the manual exit-code block against premature errexit. The final diff keeps the captured commands inside if ...; then constructs.

Runtime evidence

No runtime mutation. No deploy, no runner restart, no secret reads in repo output, no workflow dispatch.

Known constraints

This is policy and workflow hygiene, not proof that deploy-host runtime credentials are configured.
The linter guards output redirections, not arbitrary read-only references to $GITHUB_OUTPUT.

Explicit out-of-scope

Changing $GITHUB_ENV / $GITHUB_PATH behavior.
Running platformctl auto-apply or release-root promotion.
Modifying runner configuration, Infisical, SSH, or deployment hosts.

Requested decision

Run full canary 3+3 and merge if the workflow lint/test evidence holds.

Merge blockers

Any regression in Forgejo workflow lint.
Any finding that Plan apply health can bypass its manual exit-code output before exiting.
Any remaining bare $GITHUB_OUTPUT write in .forgejo/workflows.

Spec sources read

Forgejo issue #729: task scope, allowed paths, acceptance criteria.
contexts/security-policy/MAP.md: security-sensitive routing for workflow/deploy-runner trust-boundary changes.
.forgejo/workflows/platformctl-auto-apply.yml: target deploy-host and output writes.
.forgejo/workflows/release-root-promote.yml: target deploy-host shell block.
.forgejo/workflows/base-is-main.yml: target output writes.
.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml: target output writes.
.forgejo/workflows/merged-in-main-audit.yml: target output writes.
control-plane/platformctl/ci/lint_workflows.py: lint insertion point.
control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py: lint contract tests.

Verification

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py -> 7 passed.
PYTHONPATH=control-plane python3 control-plane/platformctl/ci/lint_workflows.py --markdown /tmp/729-workflow-lint.md --json /tmp/729-workflow-lint.json -> 0 findings.
git diff --check -> passed.
rg -n --pcre2 '(?<!FORGEJO_OUTPUT:-)\$GITHUB_OUTPUT|\$\{GITHUB_OUTPUT\}' .forgejo/workflows -> no matches.
rg -n 'set -eu$|set -u$' .forgejo/workflows/platformctl-auto-apply.yml .forgejo/workflows/release-root-promote.yml -> no matches.

Closes #729

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Forgejo workflow outputs and deploy-host shell blocks should behave predictably on Forgejo runners. This keeps CI/deploy trust-boundary work from silently masking pipe failures or writing step outputs through a GitHub-only path. ### What changed - Added `set -euo pipefail` to deploy-host run blocks in `platformctl-auto-apply.yml` and `release-root-promote.yml`, including the manual exit-code block whose commands are already guarded by `if ...; then`. - Replaced bare `$GITHUB_OUTPUT` writes with `${FORGEJO_OUTPUT:-$GITHUB_OUTPUT}` in the four affected workflows. - Added a workflow linter finding for bare `$GITHUB_OUTPUT` output redirections, with coverage for quoted, unquoted, and braced variants. ### Why it changed Issue #729 identified two related CI footguns: masked pipeline failures on trusted deploy-host jobs and GitHub-specific output paths in Forgejo workflows. ### Files touched - `.forgejo/workflows/platformctl-auto-apply.yml` - `.forgejo/workflows/release-root-promote.yml` - `.forgejo/workflows/base-is-main.yml` - `.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml` - `.forgejo/workflows/merged-in-main-audit.yml` - `control-plane/platformctl/ci/lint_workflows.py` - `control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py` ### Relevant context - Issue #729 scope and acceptance criteria. - `contexts/security-policy/MAP.md`: workflow/deploy-runner trust-boundary changes route as `class/security-sensitive` and `tier/full`. - Advisory scout pass: Ollama GLM, Ollama DeepSeek, and AntiGravity reviewed a sanitized packet. Consensus: use Forgejo output fallback; guard the manual exit-code block against premature `errexit`. The final diff keeps the captured commands inside `if ...; then` constructs. ### Runtime evidence No runtime mutation. No deploy, no runner restart, no secret reads in repo output, no workflow dispatch. ### Known constraints - This is policy and workflow hygiene, not proof that deploy-host runtime credentials are configured. - The linter guards output redirections, not arbitrary read-only references to `$GITHUB_OUTPUT`. ### Explicit out-of-scope - Changing `$GITHUB_ENV` / `$GITHUB_PATH` behavior. - Running platformctl auto-apply or release-root promotion. - Modifying runner configuration, Infisical, SSH, or deployment hosts. ### Requested decision Run full canary 3+3 and merge if the workflow lint/test evidence holds. ### Merge blockers - Any regression in Forgejo workflow lint. - Any finding that `Plan apply health` can bypass its manual exit-code output before exiting. - Any remaining bare `$GITHUB_OUTPUT` write in `.forgejo/workflows`. ## Spec sources read - Forgejo issue #729: task scope, allowed paths, acceptance criteria. - `contexts/security-policy/MAP.md`: security-sensitive routing for workflow/deploy-runner trust-boundary changes. - `.forgejo/workflows/platformctl-auto-apply.yml`: target deploy-host and output writes. - `.forgejo/workflows/release-root-promote.yml`: target deploy-host shell block. - `.forgejo/workflows/base-is-main.yml`: target output writes. - `.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml`: target output writes. - `.forgejo/workflows/merged-in-main-audit.yml`: target output writes. - `control-plane/platformctl/ci/lint_workflows.py`: lint insertion point. - `control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py`: lint contract tests. ## Verification - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py` -> 7 passed. - `PYTHONPATH=control-plane python3 control-plane/platformctl/ci/lint_workflows.py --markdown /tmp/729-workflow-lint.md --json /tmp/729-workflow-lint.json` -> 0 findings. - `git diff --check` -> passed. - `rg -n --pcre2 '(?<!FORGEJO_OUTPUT:-)\$GITHUB_OUTPUT|\$\{GITHUB_OUTPUT\}' .forgejo/workflows` -> no matches. - `rg -n 'set -eu$|set -u$' .forgejo/workflows/platformctl-auto-apply.yml .forgejo/workflows/release-root-promote.yml` -> no matches. Closes #729

codex added the

class/security-sensitive

tier/full

labels

2026-06-10 20:45:00 +02:00

codex added 1 commit

2026-06-10 20:45:00 +02:00

fix(ci): harden workflow output handling

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 20s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 19s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 18s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 5m5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

33e9282316

patchwarden commented

2026-06-10 20:54:53 +02:00

First-time contributor

Patchwarden PR sanity

Status: advisory_findings
PR: 774
Commit: 33e928231652c583079a855880b63cd37e64dede
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — .forgejo/workflows/base-is-main.yml
- Evidence: .forgejo/workflows/base-is-main.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — .forgejo/workflows/merged-in-main-audit.yml
- Evidence: .forgejo/workflows/merged-in-main-audit.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — .forgejo/workflows/platformctl-auto-apply.yml
- Evidence: .forgejo/workflows/platformctl-auto-apply.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — .forgejo/workflows/release-root-promote.yml
- Evidence: .forgejo/workflows/release-root-promote.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.
info sensitive-path-touched Sensitive path touched — .forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml
- Evidence: .forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium set -e in Plan apply health may bypass exit_code output on unexpected failures
- Evidence: In .forgejo/workflows/platformctl-auto-apply.yml, the 'Plan apply health' step changes from set -utoset -euo pipefail(line 176). This adds errexit to a step that writesexit_code output before exiting. If any intermediate command f
- Next: Verify that all commands between the initial module check and the final exit_code write are either: (a) inside conditional constructs that suppress errexit (if/while/&&/||), or (b) explicitly handled with ||true or explicit exit codes. Consider adding a trap to write exit_code on ERR if the step mus

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high Linter bypass via single-angle redirect to bare GITHUB_OUTPUT
- Evidence: control-plane/platformctl/ci/lint_workflows.py introduces BARE_GITHUB_OUTPUT_REDIRECT_RE with pattern r">>\s*['"]?(?:$GITHUB_OUTPUT\b|${GITHUB_OUTPUT})['"]?"; it requires >>, so echo foo > "$GITHUB_OUTPUT"orecho foo > $GITH`
- Next: Expand the regex to match both overwrite and append redirects, e.g. r">>?\s*['\"]?(?:\$GITHUB_OUTPUT\b|\$\{GITHUB_OUTPUT\})['\"]?" or r"(>|>>)\s*...", and add a contract test for the single-> case.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `774` - Commit: `33e928231652c583079a855880b63cd37e64dede` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/base-is-main.yml` - Evidence: `.forgejo/workflows/base-is-main.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/merged-in-main-audit.yml` - Evidence: `.forgejo/workflows/merged-in-main-audit.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/platformctl-auto-apply.yml` - Evidence: `.forgejo/workflows/platformctl-auto-apply.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/release-root-promote.yml` - Evidence: `.forgejo/workflows/release-root-promote.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml` - Evidence: `.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** set -e in Plan apply health may bypass exit_code output on unexpected failures - Evidence: `In .forgejo/workflows/platformctl-auto-apply.yml, the 'Plan apply health' step changes from `set -u` to `set -euo pipefail` (line 176). This adds errexit to a step that writes `exit_code` output before exiting. If any intermediate command f` - Next: Verify that all commands between the initial module check and the final exit_code write are either: (a) inside conditional constructs that suppress errexit (if/while/&&/||), or (b) explicitly handled with ||true or explicit exit codes. Consider adding a trap to write exit_code on ERR if the step mus ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Linter bypass via single-angle redirect to bare GITHUB_OUTPUT - Evidence: `control-plane/platformctl/ci/lint_workflows.py introduces BARE_GITHUB_OUTPUT_REDIRECT_RE with pattern `r">>\s*['\"]?(?:\$GITHUB_OUTPUT\b|\$\{GITHUB_OUTPUT\})['\"]?"`; it requires `>>`, so `echo foo > \"$GITHUB_OUTPUT\"` or `echo foo > $GITH` - Next: Expand the regex to match both overwrite and append redirects, e.g. `r">>?\s*['\"]?(?:\$GITHUB_OUTPUT\b|\$\{GITHUB_OUTPUT\})['\"]?"` or `r"(>|>>)\s*..."`, and add a contract test for the single-`>` case. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.