ci: adopt verified central Rust and Python bootstrap supplier by seonghobae · Pull Request #763 · ContextualWisdomLab/TEPP

seonghobae · 2026-10-13T16:15:33Z

Both central callers now pin protected af81ef49683809ce8b302e078455e3960cf0acd1. Authenticated commit/tree/blob evidence exported from actual central Git objects and caller/supplier SHA256 constants refreshed, with exact-path signed-object binary attribute. No executable jobs duplicated or thresholds changed. Parent inspected 15-path pin/evidence delta and reran full182 quality tests with100%statement/branchcoverage, actionlint and committeddiffcheck. Native runner>=2.327.1 readiness, bootstrap execution, cleanjobcustody, actualActions gate results and formal App approval remain incomplete. Source adoption uses user infrastructure exception only; no VM/registration/restart or inference credential mutation.

Summary by CodeRabbit

개선 사항
- CI 및 문서 품질 검사가 새 중앙 워크플로 버전을 사용하도록 갱신했습니다.
- Rust 도구를 검증된 버전으로 격리된 환경에 설치하고, 도구 버전을 확인하도록 변경했습니다.
- CI 워크플로와 공급자 정보의 무결성 검사를 강화했습니다.
- 중앙 워크플로의 변경 사항과 로컬 검증 범위를 문서화했습니다.

coderabbitai · 2026-10-13T16:15:53Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 7b78ed91-bfb8-4ec5-999f-67259360f0fc

📥 Commits

Reviewing files that changed from the base of the PR and between ee45732 and 7f642fe.

📒 Files selected for processing (16)

.gitattributes
.github/workflows/ci.yml
.github/workflows/docs-quality.yml
CHANGELOG.d/central-tool-bootstrap-supplier.md
README.md
scripts/check_workspace_contract.py
scripts/effective_ci_source.py
tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/.github.tree
tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/commit.object
tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/root.tree
tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-documentation-quality.yml
tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-rust-foundation-ci.yml
tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/workflows.tree
tests/fixtures/central-ci/README.md
tests/quality/test_effective_ci_source.py
tests/quality/test_reusable_supplier_callers.py

 ______________________________________________________
< This code is a locked door with the key taped to it. >
 ------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 24e13c85-c66b-401e-9e57-6f3f863efd66

📥 Commits

Reviewing files that changed from the base of the PR and between 956fa27 and ee45732.

📒 Files selected for processing (15)

.gitattributes
.github/workflows/ci.yml
.github/workflows/docs-quality.yml
CHANGELOG.d/central-tool-bootstrap-supplier.md
README.md
scripts/effective_ci_source.py
tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object
tests/fixtures/central-ci/README.md
tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/.github.tree
tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object
tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/root.tree
tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-documentation-quality.yml
tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml
tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/workflows.tree
tests/quality/test_reusable_supplier_callers.py

💤 Files with no reviewable changes (1)

tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

중앙 CI 공급자 커밋을 새 SHA로 갱신했습니다. 새 커밋의 워크플로와 Git 객체 fixture를 추가하고, 호출자 핀, SHA-256 값, 테스트 및 문서를 함께 갱신했습니다.

Changes: 중앙 CI 공급자 갱신

Layer / File(s)	Summary
공급자 워크플로 및 fixture 갱신 `tests/fixtures/central-ci/...`	새 커밋의 객체와 재사용 워크플로 fixture를 추가했습니다. 워크플로에는 Python 3.12 가상 환경 설정과 세 Rust 작업의 Rustup 1.29.1 다운로드·SHA-256 검증 설정이 포함됩니다.
호출자 핀 및 무결성 값 갱신 `.github/workflows/ci.yml`, `.github/workflows/docs-quality.yml`, `scripts/effective_ci_source.py`, `tests/quality/test_reusable_supplier_callers.py`, `.gitattributes`	두 CI 호출자의 공급자 커밋 참조, 고정 SHA-256 값, 테스트 기대값을 새 값으로 바꿨습니다. `commit.object`의 `binary` 경로도 새 fixture로 변경했습니다.
저장소 문서 갱신 `README.md`, `CHANGELOG.d/central-tool-bootstrap-supplier.md`	새 커밋 핀과 공급자 워크플로 설정을 기록했습니다. 로컬 소스 검증만으로 호스팅 실행이나 GitHub App 승인이 성립하지 않는다는 설명도 포함했습니다.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to ee457

No identified issue blocks merging after normal checks. Hosted CI execution and runner readiness remain to be confirmed.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		PR 제목은 중앙 Rust 및 Python 부트스트랩 공급자 채택을 명확히 설명하며, CI 공급자 커밋 핀 변경과 문서화라는 주요 변경 사항에 부합합니다.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Devin Review found 1 potential issue.

devin-ai-integration · 2026-10-13T16:17:05Z

+          RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \
+            "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path
+          rm -f -- "$rustup_init"
+          printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}"
+          printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}"


🟨 Rust jobs reuse persistent tool state

On a reused runner, rustup-init installs into $HOME/.cargo and $HOME/.rustup, preserving state across jobs. A previous job can change the binaries or toolchains that later Rust checks execute.

Was this helpful? React with 👍 or 👎 to provide feedback.

seonghobae · 2026-10-13T16:21:44Z

The returned security finding is valid for reused/persistent runners: af81 supplier bootstraps and caches Rust state in HOME. Native clean-job lifecycle is still unaccepted. Adoption remains BLOCKED; no infrastructure bypass will waive this source/security defect. A central successor is implementing exclusive job-private Cargo/Rustup state and consistent cache/consumer paths with sentinel/negative tests. Source readiness and whole-VM isolation remain separate obligations.

seonghobae · 2026-10-13T17:26:41Z

Successor7f642fe2 replaces af81 with corrected protectedcentral3136c940. ActualGitcommit/tree/blobs exported and authenticated for both suppliers; exactcaller/digest/attribute bindings refreshed. Two obsolete cached-restore title assertions now enforce real private-root+locked+version-bound tool argv and requiredLLVMplugin token;13 independent mutation controls reject changes. Parent inspected delta and reran exactcurrent182qualitytests/100%statement+branchcoverage/actionlint/committeddiffcheck PASS. Centralprivate-Rust source independently ACCEPTed after cache restoration removed. No Rust/library/lockfile or numerical/PostgreSQL threshold changes. User infrastructure exception integrates source only. TEPPgroup admission remains HELD; nativecustody/isolation/Node24runnerreadiness/actualActions and formalAppapproval remain incomplete.

ci: adopt authenticated central tool-bootstrap supplier af81ef49

ee45732

devin-ai-integration Bot reviewed Oct 13, 2026

View reviewed changes

ci: adopt corrected private Rust supplier 3136c940

7f642fe

seonghobae merged commit 4156aff into main Oct 13, 2026
0 of 7 checks passed

Navigation Menu

Repository navigation

ci: adopt verified central Rust and Python bootstrap supplier - #763

ci: adopt verified central Rust and Python bootstrap supplier#763
seonghobae merged 2 commits into
mainfrom
ci/tepp-bootstrap-supplier-pin-20261014

seonghobae commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Oct 13, 2026

Uh oh!

seonghobae commented Oct 13, 2026

Uh oh!

seonghobae commented Oct 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seonghobae commented Oct 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Oct 13, 2026

Uh oh!

seonghobae commented Oct 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Oct 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading