Skip to content

Commit 8e08199

Browse files
hyperpolymathhyperpolymath
authored
Merge branch 'main' into arena/4cfe4690-echidna
2 parents 2f9cab2 + c7c57cf commit 8e08199

25 files changed

Lines changed: 1735 additions & 14 deletions

‎.github/rulesets/README.adoc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,30 @@ POSTed is the protection equivalent of a check that cannot fail.
142142
Conversely, do not infer that the estate is protected because a ruleset exists.
143143
A ruleset with `enforcement: disabled` is inert, and a `pull_request` rule with
144144
`allowed_merge_methods: []` can never be satisfied at all.
145+
146+
== Live snapshot and drift check (ultraplan Phase 0.5, #416)
147+
148+
`live/` holds one JSON file per ruleset that GitHub actually enforces on
149+
hyperpolymath/echidna, keyed by ruleset `id`. Volatile fields (timestamps,
150+
`node_id`, `_links`) are removed so that diffs show only real changes.
151+
152+
The top-level `*.json` files in this directory are historical payloads from
153+
before the snapshot existed. Some no longer match what is enforced (for example
154+
`base.json` names contexts that no live ruleset requires). Do not apply them
155+
without first checking `live/`.
156+
157+
Check for drift against live state (needs repository administration read):
158+
159+
[source,bash]
160+
----
161+
GH_TOKEN=<token-with-admin-read> python3 scripts/ci/check-ruleset-drift.py
162+
----
163+
164+
Exit 0 means no drift, 1 means drift, 2 means the rulesets could not be read.
165+
After an intentional change in the GitHub UI, regenerate the snapshot with
166+
`--write` and commit the diff. Do not regenerate it to silence an unexpected
167+
change.
168+
169+
Not yet automated: the check does not run in CI. The default Actions token
170+
probably cannot read rulesets, so a dedicated read-only secret is needed first.
171+
That secret is an owner action. Until it exists, run the check by hand.

‎.github/rulesets/live/Branch-Floor.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"bypass_actors": [],
3+
"conditions": {
4+
"ref_name": {
5+
"exclude": [],
6+
"include": [
7+
"~DEFAULT_BRANCH"
8+
]
9+
}
10+
},
11+
"enforcement": "active",
12+
"id": 23869567,
13+
"name": "Branch-Floor",
14+
"rules": [
15+
{
16+
"type": "deletion"
17+
},
18+
{
19+
"type": "non_fast_forward"
20+
}
21+
],
22+
"target": "branch"
23+
}

‎.github/rulesets/live/Immutable-Tags.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"bypass_actors": [
3+
{
4+
"actor_id": 5,
5+
"actor_type": "RepositoryRole",
6+
"bypass_mode": "always"
7+
},
8+
{
9+
"actor_id": 2538504,
10+
"actor_type": "Integration",
11+
"bypass_mode": "always"
12+
}
13+
],
14+
"conditions": {
15+
"ref_name": {
16+
"exclude": [],
17+
"include": [
18+
"~ALL"
19+
]
20+
}
21+
},
22+
"enforcement": "active",
23+
"id": 18111018,
24+
"name": "Immutable-Tags",
25+
"rules": [
26+
{
27+
"type": "deletion"
28+
},
29+
{
30+
"type": "non_fast_forward"
31+
},
32+
{
33+
"type": "update"
34+
},
35+
{
36+
"type": "creation"
37+
},
38+
{
39+
"type": "required_signatures"
40+
}
41+
],
42+
"target": "tag"
43+
}

‎.github/rulesets/live/Require-Signed-Commits.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"bypass_actors": [],
3+
"conditions": {
4+
"ref_name": {
5+
"exclude": [],
6+
"include": [
7+
"~DEFAULT_BRANCH"
8+
]
9+
}
10+
},
11+
"enforcement": "disabled",
12+
"id": 23852649,
13+
"name": "Require-Signed-Commits",
14+
"rules": [
15+
{
16+
"type": "required_signatures"
17+
}
18+
],
19+
"target": "branch"
20+
}

‎.github/rulesets/live/Secret-Scan-Floor.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"bypass_actors": [
3+
{
4+
"actor_id": 5,
5+
"actor_type": "RepositoryRole",
6+
"bypass_mode": "always"
7+
}
8+
],
9+
"conditions": {
10+
"ref_name": {
11+
"exclude": [],
12+
"include": [
13+
"~DEFAULT_BRANCH"
14+
]
15+
}
16+
},
17+
"enforcement": "active",
18+
"id": 24309043,
19+
"name": "Secret-Scan-Floor",
20+
"rules": [
21+
{
22+
"parameters": {
23+
"do_not_enforce_on_create": false,
24+
"required_status_checks": [
25+
{
26+
"context": "scan / gitleaks",
27+
"integration_id": 15368
28+
}
29+
],
30+
"strict_required_status_checks_policy": false
31+
},
32+
"type": "required_status_checks"
33+
}
34+
],
35+
"target": "branch"
36+
}

‎.github/rulesets/live/echidna-proof-stack-branch.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"bypass_actors": [
3+
{
4+
"actor_id": 5,
5+
"actor_type": "RepositoryRole",
6+
"bypass_mode": "always"
7+
}
8+
],
9+
"conditions": {
10+
"ref_name": {
11+
"exclude": [],
12+
"include": [
13+
"~DEFAULT_BRANCH"
14+
]
15+
}
16+
},
17+
"enforcement": "active",
18+
"id": 22415566,
19+
"name": "echidna-proof-stack-branch",
20+
"rules": [
21+
{
22+
"parameters": {
23+
"do_not_enforce_on_create": false,
24+
"required_status_checks": [
25+
{
26+
"context": "scan / gitleaks",
27+
"integration_id": 15368
28+
},
29+
{
30+
"context": "scan / rust-secrets",
31+
"integration_id": 15368
32+
},
33+
{
34+
"context": "scan / shell-secrets",
35+
"integration_id": 15368
36+
},
37+
{
38+
"context": "rust-ci / Cargo check + clippy + fmt",
39+
"integration_id": 15368
40+
},
41+
{
42+
"context": "rust-ci / Cargo test",
43+
"integration_id": 15368
44+
},
45+
{
46+
"context": "rust-ci / Cargo audit (security)",
47+
"integration_id": 15368
48+
},
49+
{
50+
"context": "rust-ci / llvm-cov line coverage",
51+
"integration_id": 15368
52+
},
53+
{
54+
"context": "CodeQL",
55+
"integration_id": 57789
56+
}
57+
],
58+
"strict_required_status_checks_policy": false
59+
},
60+
"type": "required_status_checks"
61+
}
62+
],
63+
"target": "branch"
64+
}

‎.github/workflows/boj-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ jobs:
2626
run: |
2727
# Send a secure trigger to boj-server to build this repository
2828
curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
29-
continue-on-error: true
29+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
3030
permissions:
3131
contents: read

‎.github/workflows/chapel-ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ jobs:
144144
runs-on: ubuntu-22.04
145145
timeout-minutes: 30
146146
needs: zig-ffi
147-
continue-on-error: true
147+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
148148
steps:
149149
- uses: actions/checkout@v7.0.1
150150

@@ -183,7 +183,7 @@ jobs:
183183
runs-on: ubuntu-22.04
184184
timeout-minutes: 30
185185
needs: [chapel-build, zig-ffi]
186-
continue-on-error: true
186+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
187187
steps:
188188
- uses: actions/checkout@v7.0.1
189189

‎.github/workflows/container-ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ jobs:
121121
if: >-
122122
github.event_name == 'schedule' ||
123123
(github.event_name == 'push' && contains(github.event.head_commit.modified, '.containerization/'))
124-
continue-on-error: true
124+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
125125
strategy:
126126
fail-fast: false
127127
matrix:

‎.github/workflows/live-provers.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ jobs:
134134
if: github.event_name != 'schedule'
135135
runs-on: ubuntu-latest
136136
timeout-minutes: 20
137-
continue-on-error: true
137+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
138138
steps:
139139
- name: Checkout
140140
uses: actions/checkout@v7.0.1
@@ -180,7 +180,7 @@ jobs:
180180
- name: Cache Cargo
181181
uses: Swatinem/rust-cache@v2.9.2
182182
- name: Provision ${{ matrix.backend }} (best-effort via apt / upstream release)
183-
continue-on-error: true
183+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
184184
run: |
185185
set -euo pipefail
186186
sudo apt-get update -qq || sudo apt-get update -qq --fix-missing
@@ -306,7 +306,7 @@ jobs:
306306
if: github.event_name == 'schedule' && github.event.schedule == '0 5 * * 0' || (github.event_name == 'workflow_dispatch' && (inputs.tier == '3' || inputs.tier == 'all'))
307307
runs-on: ubuntu-latest
308308
timeout-minutes: 20
309-
continue-on-error: true
309+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
310310
strategy:
311311
fail-fast: false
312312
matrix:
@@ -330,7 +330,7 @@ jobs:
330330
- name: Cache Cargo
331331
uses: Swatinem/rust-cache@v2.9.2
332332
- name: Provision ${{ matrix.backend }} (best-effort)
333-
continue-on-error: true
333+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
334334
run: |
335335
set -euo pipefail
336336
sudo apt-get update -qq || sudo apt-get update -qq --fix-missing
@@ -423,7 +423,7 @@ jobs:
423423
if: github.event_name == 'schedule' && github.event.schedule == '0 6 1 */3 *' || (github.event_name == 'workflow_dispatch' && (inputs.tier == '4' || inputs.tier == 'all'))
424424
runs-on: ubuntu-latest
425425
timeout-minutes: 20
426-
continue-on-error: true
426+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
427427
steps:
428428
- name: Checkout
429429
uses: actions/checkout@v7.0.1
@@ -443,7 +443,7 @@ jobs:
443443
if: github.event_name == 'schedule' && github.event.schedule == '0 6 1 */3 *' || (github.event_name == 'workflow_dispatch' && (inputs.tier == '4' || inputs.tier == 'all'))
444444
runs-on: ubuntu-latest
445445
timeout-minutes: 20
446-
continue-on-error: true
446+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
447447
strategy:
448448
fail-fast: false
449449
matrix:
@@ -460,7 +460,7 @@ jobs:
460460
- name: Cache Cargo
461461
uses: Swatinem/rust-cache@v2.9.2
462462
- name: Provision ${{ matrix.backend }} (best-effort, CUDA/OpenCL required)
463-
continue-on-error: true
463+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
464464
run: |
465465
case "${{ matrix.backend }}" in
466466
gpuverify)
@@ -473,5 +473,5 @@ jobs:
473473
;;
474474
esac
475475
- name: Run live version check (SKIP if binary absent)
476-
continue-on-error: true
476+
continue-on-error: true # allow-fail: issue=#416 expires=2026-11-30
477477
run: cargo test --test live_prover_suite --features live-provers -- --nocapture live_${{ matrix.backend }}_version

0 commit comments

Comments
 (0)