From ee45732adf1b4e43c414efe1b7b74287ee56ea09 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 14 Oct 2026 01:09:36 +0900 Subject: [PATCH 1/2] ci: adopt authenticated central tool-bootstrap supplier af81ef49 --- .gitattributes | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/docs-quality.yml | 2 +- .../central-tool-bootstrap-supplier.md | 11 ++ README.md | 11 +- scripts/effective_ci_source.py | 10 +- .../commit.object | 29 ----- tests/fixtures/central-ci/README.md | 18 ++-- .../.github.tree | Bin 191 -> 191 bytes .../commit.object | 23 ++++ .../root.tree | Bin 1987 -> 1987 bytes .../tepp-documentation-quality.yml | 12 +++ .../tepp-rust-foundation-ci.yml | 99 ++++++++++++++++++ .../workflows.tree | Bin 2919 -> 2978 bytes .../quality/test_reusable_supplier_callers.py | 2 +- 15 files changed, 174 insertions(+), 47 deletions(-) create mode 100644 CHANGELOG.d/central-tool-bootstrap-supplier.md delete mode 100644 tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object rename tests/fixtures/central-ci/{9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de => af81ef49683809ce8b302e078455e3960cf0acd1}/.github.tree (67%) create mode 100644 tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object rename tests/fixtures/central-ci/{9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de => af81ef49683809ce8b302e078455e3960cf0acd1}/root.tree (90%) rename tests/fixtures/central-ci/{9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de => af81ef49683809ce8b302e078455e3960cf0acd1}/tepp-documentation-quality.yml (50%) rename tests/fixtures/central-ci/{9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de => af81ef49683809ce8b302e078455e3960cf0acd1}/tepp-rust-foundation-ci.yml (67%) rename tests/fixtures/central-ci/{9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de => af81ef49683809ce8b302e078455e3960cf0acd1}/workflows.tree (92%) diff --git a/.gitattributes b/.gitattributes index fd0f26ca4..fd32226c7 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,3 @@ # This raw signed Git object is immutable binary evidence, not editable text. # Its exact bytes (including signature whitespace) are authenticated by Git OID. -tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object binary +tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object binary diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e10ad41b1..b321c1211 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,6 @@ concurrency: jobs: foundation: name: TEPP Rust Foundation supplier - uses: ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml@9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de + uses: ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml@af81ef49683809ce8b302e078455e3960cf0acd1 permissions: contents: read diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 7d9cc3ef4..59838806f 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -34,6 +34,6 @@ concurrency: jobs: documentation: name: TEPP Documentation supplier - uses: ContextualWisdomLab/.github/.github/workflows/tepp-documentation-quality.yml@9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de + uses: ContextualWisdomLab/.github/.github/workflows/tepp-documentation-quality.yml@af81ef49683809ce8b302e078455e3960cf0acd1 permissions: contents: read diff --git a/CHANGELOG.d/central-tool-bootstrap-supplier.md b/CHANGELOG.d/central-tool-bootstrap-supplier.md new file mode 100644 index 000000000..439957800 --- /dev/null +++ b/CHANGELOG.d/central-tool-bootstrap-supplier.md @@ -0,0 +1,11 @@ +# Adopt authenticated central tool bootstrap + +- Pin both TEPP reusable CI callers to central supplier commit + `af81ef49683809ce8b302e078455e3960cf0acd1`. +- Regenerate the six offline Git-object fixtures from that exact central commit + and update caller/workflow SHA-256 bindings and the signed-object attribute. +- Preserve five-gate custody and corruption/ref/allowlist rejection controls; + private Python environments and hash-verified Rustup are supplier-owned. +- This source adoption does not establish native bootstrap, hosted CI, runner + access, GitHub App approval, or release acceptance. Rust/library source is + unchanged. diff --git a/README.md b/README.md index 59f8d354e..617e200f9 100644 --- a/README.md +++ b/README.md @@ -152,9 +152,14 @@ general filesystem I/O deadline. See `.github/workflows/ci.yml` dispatches the reviewed central workflow `ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml` -at `9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de`. Executable jobs remain owned by -that supplier; frozen files under `tests/fixtures/central-ci/` are evidence only, -not workflows installed in `.github/workflows/`. +at `af81ef49683809ce8b302e078455e3960cf0acd1`. The documentation caller +`.github/workflows/docs-quality.yml` uses the same pin for +`tepp-documentation-quality.yml`. These suppliers provision private Python +environments across all five jobs and hash-verify official Rustup 1.29.1 in the +three Rust jobs. Executable jobs remain supplier-owned; frozen files under +`tests/fixtures/central-ci/` are evidence only, not installed workflows. +Local source-custody tests do not establish native runner bootstrap, hosted +execution, or GitHub App approval. `scripts/effective_ci_source.py` resolves the caller and supplier offline for the workspace, coverage diagnostics, and shared-runner contract checks. It verifies diff --git a/scripts/effective_ci_source.py b/scripts/effective_ci_source.py index c024c882d..376a63ce7 100644 --- a/scripts/effective_ci_source.py +++ b/scripts/effective_ci_source.py @@ -9,11 +9,11 @@ import hashlib from pathlib import Path -SUPPLIER_PIN = "9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de" -CALLER_SHA256 = "4cdbacc6c531bba1fcb0632e9a4ea88ec9814820bb4e8c45447d57bc046201e3" -SUPPLIER_SHA256 = "0baf1384a6f66b357bba6cf74b384ecae447767f512eb2c90bb50849c74a7160" -DOCUMENTATION_CALLER_SHA256 = "99ed24d9ce64a4232dcb29e05ddcdedac659c37f5c8b4230386f57435b3bd1f2" -DOCUMENTATION_SUPPLIER_SHA256 = "76d5f64f05fbf953c8c96b6bf8129880a904498b1bbce355567108975bfb00aa" +SUPPLIER_PIN = "af81ef49683809ce8b302e078455e3960cf0acd1" +CALLER_SHA256 = "25620560899a0f07cbc9cc2bf281aec8642e64563e86e36b38fc34594d8c9813" +SUPPLIER_SHA256 = "3a441902290088d0b6f884057c84dba5ab5b3ba4c7e2b27319b2ddfea6153ec8" +DOCUMENTATION_CALLER_SHA256 = "5abad50bcb37f4881d3ef38ccce4cb5d6420c0ef90012dfab022b58213c6df02" +DOCUMENTATION_SUPPLIER_SHA256 = "d1d62e9ba4ff5ecc0ef499061dae5ea84b05db4a5d94f42b0290d83b8f5885d5" FIXTURE_PATH = Path("tests/fixtures/central-ci") / SUPPLIER_PIN diff --git a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object b/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object deleted file mode 100644 index 472c79b81..000000000 --- a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object +++ /dev/null @@ -1,29 +0,0 @@ -tree 4ff36024d1d2eaa390f25bfc6500d47d4f948fc7 -parent 29c14c67fd2a49e3719bfc0d3c1b9cad9531e33f -author Seongho Bae 1791897957 +0900 -committer GitHub 1791897957 +0900 -gpgsig -----BEGIN PGP SIGNATURE----- - - wsFcBAABCAAQBQJqzjFlCRC1aQ7uu5UhlAAAqvUQAIfR+9SpUHwEO2LPMrNMDMz2 - 1t4NhE8/PYR1hD3kJ+aD9at4U3/kK1VpkNVr/Xdx7WFuraVokPRYNkriWb0h9PA8 - RzvltffN6G0YxI+LGGUwATL7jMrtV1WHpUMYpxxmOzGw6ORvgEfZvKkXknCs7ajk - uHZj1VBMs0LIUSqNLvResOy+Z01QIrMa8+RU7LqoOAnhigtXpKIq2lXa4NSmPNVs - UwaF/nltlPGubAko00PKWcTtCyshUDG5ZPqnHodkAyPeQMmYgc4fC6aIbXqI5UUp - iQSNhGAzgMnCIRwyJ7nnPyixuMbXEhTGtr7N7V/2adw9q//P7cy0DX8nhw9wspLj - SHZbDtufesE4/anHA/nG/kIEQgPh8RpJYnhxsIL00XJGd6fVF8I0MV9qio+SHsHX - +Xmgmq3IhqJfUvUDthsGN2Y9RbORT1hQjexf4AeMm1yp3ntYpq970nGggdvswvPl - p/42ME+8FxN3E7txCXmiSTCWcH9Oh9T5dcFalrsQJ1Ed9frgtHA2bAAWOZaeDfsk - M1bx7MFxGTyhCahFqdZ9ouaqLdD5olbts7PelqaTA7LlRxZ9qIrP2fEZ/WEAdIG1 - sFcCpEVhSQIb1iNPPhpfkUzeKsqvVRiA5ABrSxX+9XJQkpAnsx9+59NHtudrrkAn - MBKC64VrwSQj6DSlsVOe - =D1OS - -----END PGP SIGNATURE----- - - -ci(tepp): centralize reusable foundation and documentation workloads (#2635) - -* ci(tepp): add reviewed reusable foundation and documentation suppliers - -* fix(tepp): fail closed on committed documentation whitespace - -* fix(ci): validate existing scoped K-CSAP runner list without weakening isolation \ No newline at end of file diff --git a/tests/fixtures/central-ci/README.md b/tests/fixtures/central-ci/README.md index 026f11b39..fa9370d51 100644 --- a/tests/fixtures/central-ci/README.md +++ b/tests/fixtures/central-ci/README.md @@ -1,18 +1,24 @@ # Authenticated central CI evidence These non-executable fixtures preserve raw Git objects from central commit -`9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de`. Both consumer callers use that +`af81ef49683809ce8b302e078455e3960cf0acd1`. Both consumer callers use that same immutable pin. `scripts/effective_ci_source.py` authenticates the commit, root tree, `.github` tree, workflow tree, and the selected workflow blob before checking its independent SHA-256 digest and its exact consumer caller digest. Only the Rust foundation and documentation workflow names are admitted. There is no Git metadata requirement or network fallback. -The documentation workflow is the original 649-byte blob -`8a0ad78cd8687b2b8b0f1437e230b04e95e4aea3`, SHA-256 -`76d5f64f05fbf953c8c96b6bf8129880a904498b1bbce355567108975bfb00aa`. -It reuses the existing commit and three authenticated trees, without modifying -their bytes. The signed `commit.object` retains its exact binary attribute. +The foundation workflow is the original 16,776-byte blob +`36c063a0a480064d1f445f69aa1dcd4c2d9bd617`, SHA-256 +`3a441902290088d0b6f884057c84dba5ab5b3ba4c7e2b27319b2ddfea6153ec8`. +The documentation workflow is the original 1,275-byte blob +`d28d4c0be766912ebcaa9ce14791238cb27730c4`, SHA-256 +`d1d62e9ba4ff5ecc0ef499061dae5ea84b05db4a5d94f42b0290d83b8f5885d5`. +All six files were regenerated from the actual central Git objects at this pin; +no signature or workflow bytes were reconstructed or normalized. The signed +`commit.object` retains its exact-path binary attribute. The supplier provisions +private Python environments for all five jobs and hash-verifies official +Rustup 1.29.1 before Rust toolchain installation in the three Rust jobs. Caller tests extract the actual top-level job IDs from each authenticated supplier body: `repository-contracts`, `rust-quality`, `production-coverage`, diff --git a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/.github.tree b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/.github.tree similarity index 67% rename from tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/.github.tree rename to tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/.github.tree index 5abadb48ac87a9a46138525d57ce89a2486743c7..2d611b6e4e80be2a77f5380cabb89e484307f8df 100644 GIT binary patch delta 27 lcmV+$0ObF_0lxu|s}zEu9o)0W<9@Ca59R6d){OG)yY9s65I_I` delta 27 jcmdnbxSw&tY7t>EBe#;m+$U 1791906853 +0900 +committer GitHub 1791906853 +0900 +gpgsig -----BEGIN PGP SIGNATURE----- + + wsFcBAABCAAQBQJqzlQlCRC1aQ7uu5UhlAAAVhQQADKdcP/gr66arzQALhCgZxSJ + h9z5uwMl+SFeLpydWHUP1KnB6Iq73J+pwK3LXshl0/WW/8retiTFSdFtX40BWlZZ + EinJDxZD+I3uqSsK20PTW3Aa9KL5JbGQYj2KSDqZLXJrsruQQPyxmSLPfhF/JSL7 + f1Wk7TQ/rbzJPaNiiIC31YiYuGmv0soH0aF6oO4t5sUFvf87nnNYlNudU7To/96f + 2TagqhZLMlZ5tYloXqNAVib7IYurAdNdrEeXfVu0LhNfM6qreRqsF4nPi8WGJN5d + hTALU/ZKtoxK5/5hRZ+b+bS705+G6YvufAYMeZhlkYVSNikhoOYx8MHKDHVggskY + 5YINISf0hW7bvkQeyVLAYq/WixDbYQkGHWxvz+n6hAS1AdLt9Z1xBMw2/MUNr8Je + K7Sz68cyq4qE/mulmcTxMSeZxYT6hK6Dz/evIxEjTmNJAZLy6gEEuAZSPBX3y0D8 + U4hUAA0u7nuVk8vm2zSkdlTrTfZv53WxB1O8J78qoKcpqeUk/jhSjPdkjDLw8g6a + j10HngpRUpgL2C6Ht0GKIHa2aSsLkyM67dRXYSKbkukIGEXLAxPzN4yFHu55x74E + 9qmyrgTA/ooodhHS9SXPjSV2SY3SNYEfqNQ6sC/F98kUSRNuRYmjmh6NwXBLDquW + rP4MTY68jLLd2LOzUCei + =VILy + -----END PGP SIGNATURE----- + + +ci(tepp): bootstrap supplier Rust and Python tools (#2641) \ No newline at end of file diff --git a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/root.tree b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/root.tree similarity index 90% rename from tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/root.tree rename to tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/root.tree index 58b83f813af9f7e6f3316bec3dd91a7df035ec59..dd8e724cbc89a286ae4bf6042bfc774e99c889e1 100644 GIT binary patch delta 78 zcmV-U0I~nW55o_TS`mJ6Ed`kD_-EE=(H)dCcR3{4p=yzN@BKJ*8O k`0BW4jVb1{R|8lC6n)RTmwCD>;2R?dJgyi6b&z!GO?z7+`Tzg` delta 78 zcmV-U0I~nW55o_TS`?UL0EB+fkoEA$kphi<)~7s)8!fSJ)dCc#3%qw6b|SvLJ~8ri ky%Ky+sK#BhR|8lC6wfoXk=aoNvTmBbqi=WrFH&XVAB&YF2LJ#7 diff --git a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/tepp-documentation-quality.yml b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-documentation-quality.yml similarity index 50% rename from tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/tepp-documentation-quality.yml rename to tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-documentation-quality.yml index 8a0ad78cd..d28d4c0be 100644 --- a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/tepp-documentation-quality.yml +++ b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-documentation-quality.yml @@ -20,6 +20,18 @@ jobs: with: persist-credentials: false fetch-depth: 2 + - name: Set up pinned Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: '3.12' + - name: Create private Python environment + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -m venv "${RUNNER_TEMP:?}/tepp-python-venv" + printf 'VIRTUAL_ENV=%s\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_PATH:?}" + export PATH="${RUNNER_TEMP}/tepp-python-venv/bin:${PATH}" + python3 -m pip --version - name: Validate documentation run: python3 scripts/validate_documentation.py - name: Reject whitespace errors diff --git a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/tepp-rust-foundation-ci.yml b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml similarity index 67% rename from tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/tepp-rust-foundation-ci.yml rename to tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml index 190eaf8fc..36c063a0a 100644 --- a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/tepp-rust-foundation-ci.yml +++ b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml @@ -27,6 +27,18 @@ jobs: uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87 with: persist-credentials: false + - name: Set up pinned Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: '3.12' + - name: Create private Python environment + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -m venv "${RUNNER_TEMP:?}/tepp-python-venv" + printf 'VIRTUAL_ENV=%s\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_PATH:?}" + export PATH="${RUNNER_TEMP}/tepp-python-venv/bin:${PATH}" + python3 -m pip --version - name: Install pinned Python quality dependency run: python3 -m pip install --disable-pip-version-check --no-deps --require-hashes -r requirements-quality.txt - name: Exercise repository tooling with branch coverage @@ -59,6 +71,35 @@ jobs: uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87 with: persist-credentials: false + - name: Set up pinned Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: '3.12' + - name: Create private Python environment + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -m venv "${RUNNER_TEMP:?}/tepp-python-venv" + printf 'VIRTUAL_ENV=%s\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_PATH:?}" + export PATH="${RUNNER_TEMP}/tepp-python-venv/bin:${PATH}" + python3 -m pip --version + - name: Bootstrap hash-verified Rustup + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + rustup_init="${RUNNER_TEMP:?}/rustup-init-1.29.1" + curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ + --output "$rustup_init" \ + https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init + printf '%s %s\n' \ + dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 \ + "$rustup_init" | sha256sum --check --strict + chmod 0755 "$rustup_init" + RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \ + "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path + rm -f -- "$rustup_init" + printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}" + "$HOME/.cargo/bin/rustup" --version - name: Install pinned Rust toolchain run: rustup toolchain install 1.98.0 --profile minimal --component clippy --component rustfmt - name: Restore pinned Rust quality tools @@ -102,6 +143,35 @@ jobs: uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87 with: persist-credentials: false + - name: Set up pinned Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: '3.12' + - name: Create private Python environment + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -m venv "${RUNNER_TEMP:?}/tepp-python-venv" + printf 'VIRTUAL_ENV=%s\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_PATH:?}" + export PATH="${RUNNER_TEMP}/tepp-python-venv/bin:${PATH}" + python3 -m pip --version + - name: Bootstrap hash-verified Rustup + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + rustup_init="${RUNNER_TEMP:?}/rustup-init-1.29.1" + curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ + --output "$rustup_init" \ + https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init + printf '%s %s\n' \ + dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 \ + "$rustup_init" | sha256sum --check --strict + chmod 0755 "$rustup_init" + RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \ + "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path + rm -f -- "$rustup_init" + printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}" + "$HOME/.cargo/bin/rustup" --version - name: Install pinned Rust toolchain with LLVM tools run: rustup toolchain install 1.98.0 --profile minimal --component llvm-tools-preview - name: Install pinned nightly with LLVM tools @@ -237,6 +307,35 @@ jobs: uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87 with: persist-credentials: false + - name: Set up pinned Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: '3.12' + - name: Create private Python environment + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -m venv "${RUNNER_TEMP:?}/tepp-python-venv" + printf 'VIRTUAL_ENV=%s\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "${RUNNER_TEMP}/tepp-python-venv" >>"${GITHUB_PATH:?}" + export PATH="${RUNNER_TEMP}/tepp-python-venv/bin:${PATH}" + python3 -m pip --version + - name: Bootstrap hash-verified Rustup + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + rustup_init="${RUNNER_TEMP:?}/rustup-init-1.29.1" + curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ + --output "$rustup_init" \ + https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init + printf '%s %s\n' \ + dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 \ + "$rustup_init" | sha256sum --check --strict + chmod 0755 "$rustup_init" + RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \ + "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path + rm -f -- "$rustup_init" + printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}" + "$HOME/.cargo/bin/rustup" --version - name: Install pinned Rust toolchain run: rustup toolchain install 1.98.0 --profile minimal - name: Run live-sqlx PostgreSQL integration diff --git a/tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/workflows.tree b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/workflows.tree similarity index 92% rename from tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/workflows.tree rename to tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/workflows.tree index e3c77e7007f5e6fc50cc975aad2eeb4ade7109f6..318fcc6dcc0c570d62e18a8b5d060d879c8fd332 100644 GIT binary patch delta 116 zcmV-)0E_?U7NQrh+6olXjZ6#YW|1zus+{3Rkt2+}1 delta 57 zcmV-90LK5K7v~nR+6okk3fGL-XnQM*4-_}zFtARQ Date: Wed, 14 Oct 2026 02:16:07 +0900 Subject: [PATCH 2/2] ci: adopt corrected private Rust supplier 3136c940 --- .gitattributes | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/docs-quality.yml | 2 +- .../central-tool-bootstrap-supplier.md | 15 +-- README.md | 8 +- scripts/check_workspace_contract.py | 6 +- scripts/effective_ci_source.py | 8 +- .../.github.tree | Bin 0 -> 191 bytes .../commit.object | 29 ++++++ .../root.tree | Bin 1987 -> 1987 bytes .../tepp-documentation-quality.yml | 0 .../tepp-rust-foundation-ci.yml | 86 ++++++++++-------- .../workflows.tree | Bin 2978 -> 3039 bytes tests/fixtures/central-ci/README.md | 16 +++- .../.github.tree | Bin 191 -> 0 bytes .../commit.object | 23 ----- tests/quality/test_effective_ci_source.py | 24 +++++ .../quality/test_reusable_supplier_callers.py | 2 +- 18 files changed, 137 insertions(+), 86 deletions(-) create mode 100644 tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/.github.tree create mode 100644 tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/commit.object rename tests/fixtures/central-ci/{af81ef49683809ce8b302e078455e3960cf0acd1 => 3136c940235a3762b804bd99eb20fbe129e70c06}/root.tree (90%) rename tests/fixtures/central-ci/{af81ef49683809ce8b302e078455e3960cf0acd1 => 3136c940235a3762b804bd99eb20fbe129e70c06}/tepp-documentation-quality.yml (100%) rename tests/fixtures/central-ci/{af81ef49683809ce8b302e078455e3960cf0acd1 => 3136c940235a3762b804bd99eb20fbe129e70c06}/tepp-rust-foundation-ci.yml (81%) rename tests/fixtures/central-ci/{af81ef49683809ce8b302e078455e3960cf0acd1 => 3136c940235a3762b804bd99eb20fbe129e70c06}/workflows.tree (82%) delete mode 100644 tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/.github.tree delete mode 100644 tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object diff --git a/.gitattributes b/.gitattributes index fd32226c7..afd23daee 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,3 @@ # This raw signed Git object is immutable binary evidence, not editable text. # Its exact bytes (including signature whitespace) are authenticated by Git OID. -tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object binary +tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/commit.object binary diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b321c1211..430956e45 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,6 @@ concurrency: jobs: foundation: name: TEPP Rust Foundation supplier - uses: ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml@af81ef49683809ce8b302e078455e3960cf0acd1 + uses: ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml@3136c940235a3762b804bd99eb20fbe129e70c06 permissions: contents: read diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 59838806f..f1f58b234 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -34,6 +34,6 @@ concurrency: jobs: documentation: name: TEPP Documentation supplier - uses: ContextualWisdomLab/.github/.github/workflows/tepp-documentation-quality.yml@af81ef49683809ce8b302e078455e3960cf0acd1 + uses: ContextualWisdomLab/.github/.github/workflows/tepp-documentation-quality.yml@3136c940235a3762b804bd99eb20fbe129e70c06 permissions: contents: read diff --git a/CHANGELOG.d/central-tool-bootstrap-supplier.md b/CHANGELOG.d/central-tool-bootstrap-supplier.md index 439957800..b9dd4a41d 100644 --- a/CHANGELOG.d/central-tool-bootstrap-supplier.md +++ b/CHANGELOG.d/central-tool-bootstrap-supplier.md @@ -1,11 +1,14 @@ # Adopt authenticated central tool bootstrap -- Pin both TEPP reusable CI callers to central supplier commit - `af81ef49683809ce8b302e078455e3960cf0acd1`. +- Pin both TEPP reusable CI callers to corrected protected central supplier + `3136c940235a3762b804bd99eb20fbe129e70c06`. - Regenerate the six offline Git-object fixtures from that exact central commit and update caller/workflow SHA-256 bindings and the signed-object attribute. -- Preserve five-gate custody and corruption/ref/allowlist rejection controls; - private Python environments and hash-verified Rustup are supplier-owned. +- Replace obsolete cached-tool restore labels with actual private-root locked + install argv and the correct LLVM plugin version probe; preserve pin, coverage, + PostgreSQL, five-gate and corruption/ref/allowlist rejection policy. +- Private Python environments, exclusive Cargo/Rustup namespaces and hash-verified + Rustup are supplier-owned; no cached executable restore or cache-hit install skip. - This source adoption does not establish native bootstrap, hosted CI, runner - access, GitHub App approval, or release acceptance. Rust/library source is - unchanged. + access, GitHub App approval, or release acceptance. Rust/library source and + numerical thresholds are unchanged. diff --git a/README.md b/README.md index 617e200f9..029738483 100644 --- a/README.md +++ b/README.md @@ -152,11 +152,15 @@ general filesystem I/O deadline. See `.github/workflows/ci.yml` dispatches the reviewed central workflow `ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml` -at `af81ef49683809ce8b302e078455e3960cf0acd1`. The documentation caller +at `3136c940235a3762b804bd99eb20fbe129e70c06`. The documentation caller `.github/workflows/docs-quality.yml` uses the same pin for `tepp-documentation-quality.yml`. These suppliers provision private Python environments across all five jobs and hash-verify official Rustup 1.29.1 in the -three Rust jobs. Executable jobs remain supplier-owned; frozen files under +three Rust jobs. Each Rust job owns fresh Cargo/Rustup namespaces; quality tools +are installed with explicit private roots and locked version pins, never restored +from cached executable archives or skipped on cache hits. The LLVM plugin version +probe includes its required `llvm-cov` argv. Executable jobs remain supplier-owned; +frozen files under `tests/fixtures/central-ci/` are evidence only, not installed workflows. Local source-custody tests do not establish native runner bootstrap, hosted execution, or GitHub App approval. diff --git a/scripts/check_workspace_contract.py b/scripts/check_workspace_contract.py index a0bd5bc28..1a0f7b631 100644 --- a/scripts/check_workspace_contract.py +++ b/scripts/check_workspace_contract.py @@ -89,10 +89,12 @@ "cargo llvm-cov --workspace --all-features", "python3 scripts/check_docstrings.py", "python3 scripts/check_coverage.py", - "Restore pinned Rust quality tools", + 'cargo install cargo-nextest --root "$CARGO_HOME" --locked --version "$CARGO_NEXTEST_VERSION"', + 'cargo install cargo-deny --root "$CARGO_HOME" --locked --version "$CARGO_DENY_VERSION"', "Verify pinned Rust quality tool versions", - "Restore pinned cargo-llvm-cov", + 'cargo install cargo-llvm-cov --root "$CARGO_HOME" --locked --version "$CARGO_LLVM_COV_VERSION"', "Verify pinned cargo-llvm-cov version", + '"$CARGO_HOME/bin/cargo-llvm-cov" llvm-cov --version', ) ACTION_PATTERN = re.compile(r"^\s*uses:\s*([^\s#]+)@([^\s#]+)", re.MULTILINE) diff --git a/scripts/effective_ci_source.py b/scripts/effective_ci_source.py index 376a63ce7..7e1785c53 100644 --- a/scripts/effective_ci_source.py +++ b/scripts/effective_ci_source.py @@ -9,10 +9,10 @@ import hashlib from pathlib import Path -SUPPLIER_PIN = "af81ef49683809ce8b302e078455e3960cf0acd1" -CALLER_SHA256 = "25620560899a0f07cbc9cc2bf281aec8642e64563e86e36b38fc34594d8c9813" -SUPPLIER_SHA256 = "3a441902290088d0b6f884057c84dba5ab5b3ba4c7e2b27319b2ddfea6153ec8" -DOCUMENTATION_CALLER_SHA256 = "5abad50bcb37f4881d3ef38ccce4cb5d6420c0ef90012dfab022b58213c6df02" +SUPPLIER_PIN = "3136c940235a3762b804bd99eb20fbe129e70c06" +CALLER_SHA256 = "4d89992569e0de28dccdcf1912ff9ecb5b74e7c024408c35676ec5c518f71e9d" +SUPPLIER_SHA256 = "c0022bb22b8ebf0f70c65251f3902773f6d323fcdde62d042e17fc5ddccfd01a" +DOCUMENTATION_CALLER_SHA256 = "ba28bb65d86519fce5957cd4cf06cfb276ae637c7087a844e9e7e1c5c935b808" DOCUMENTATION_SUPPLIER_SHA256 = "d1d62e9ba4ff5ecc0ef499061dae5ea84b05db4a5d94f42b0290d83b8f5885d5" FIXTURE_PATH = Path("tests/fixtures/central-ci") / SUPPLIER_PIN diff --git a/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/.github.tree b/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/.github.tree new file mode 100644 index 0000000000000000000000000000000000000000..b534c89c6349d5c0d07b75bfe44b79b52c1c3fc0 GIT binary patch literal 191 zcmXpsFfcPQQE>KmarF=Pa}5e+Xs(Ra@`~zurI-J_dgZl?2mfC8K5Gb3m6%+TnV*-F znOCA$nV6fy5Oww$lj`Xzs~7xQ(^qh%oVzr0p_+*S5GX)Y7BjF-czdf}bV-Z7Lw)?3 z_iTdtqN?5y6-A|ad8tLZnYoGSsl^OkAHBXwYcrP?TAy>d>TeXQ=(MI3qOLr@C_61D dzr2{Cf>%l6{E14Hue&pn8w-r0=g3W+1prY 1791910983 +0900 +committer GitHub 1791910983 +0900 +gpgsig -----BEGIN PGP SIGNATURE----- + + wsFcBAABCAAQBQJqzmRHCRC1aQ7uu5UhlAAAV0AQAF2i+mQUNqh8wvcjGJI+R9dh + VQDRIfXDEDFAi5zNWqhEwC9sibKcon6PaUB43QPkB+kCU4d9SizIlgbGq/RGiFx+ + UtChXueMh8pMBDaCqqV4aXk2qzE7gtdsgSD4FesvyOnaHtyjyIjVifgsJ0ScnPjH + wxUovsYr2aP4XgN8dRRpt0BGmVJKLRSeuLIfjZ3kPDhuAf1zZoALkOWGfhGNwk/r + f6JdwrB1NWrChzg1sA6rzrl7rEyg7d/W2qG7/zgbPkh2xCY1rSdHbRqZ5xO3CGEZ + in3Y0VveJP+Pp/3nleqCA4yzldy4QMa+iLw/9LcCGtzOJj2dkqAdYJv2D1Xv3Nux + d+dIhxNqX96LbchTs4gjTUXk7dP3E1SjLZsriYLbsWohdHpV2T/ISWQtJ9d3fWJT + K0fENXRXiV1cQ3RDFcBlFIavr0e4GQ/rax7pp96XWikIFgNE8nX0xhiDU/EfI1HB + 7iaa4PQ/Qxpjmlivo0IY5KoyzhQC4mwlKwTWX2+lAmPcTmIsfFnmenvVYfG8X2fs + ODoZUbP+TCt/YDz69MkTCnevC3fVw2zVEq3g4mbCPxj/S3B4DT1TZ9emiLrCkCl3 + FY2R2dfZ5Rz2mfbMQIiMsQYtD9QhJ7eEGRu+Ly7s+3GKknV8kymlQeMesJuuSiYm + 4U+GjyQXm4d5YmMopT8o + =o03p + -----END PGP SIGNATURE----- + + +fix(tepp): isolate Rust tool state per job and verify plugin consumers (#2644) + +* fix(tepp): isolate supplier Rust homes from persistent runner state + +* fix(tepp): invoke llvm-cov plugin with its required subcommand + +* fix(tepp): remove unauthenticated executable cache restoration \ No newline at end of file diff --git a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/root.tree b/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/root.tree similarity index 90% rename from tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/root.tree rename to tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/root.tree index dd8e724cbc89a286ae4bf6042bfc774e99c889e1..bfdcc27a0c4598161fa4b500792977cbe244b516 100644 GIT binary patch delta 78 zcmV-U0I~nW55o_TS`?hUKD+$4{l|81%T@MwV*~;bsm!r%)dCbUAE%?nzCUC@RG(Fp kfDhI%y{w+IR|8lC6h{@b>rE3KWp0fo1Ru_cI{OhWkgq%mJ6Ed`kD_-EE=(H)dCcR3{4p=yzN@BKJ*8O k`0BW4jVb1{R|8lC6n)RTmwCD>;2R?dJgyi6b&z!GO?z7+`Tzg` diff --git a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-documentation-quality.yml b/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-documentation-quality.yml similarity index 100% rename from tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-documentation-quality.yml rename to tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-documentation-quality.yml diff --git a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml b/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-rust-foundation-ci.yml similarity index 81% rename from tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml rename to tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-rust-foundation-ci.yml index 36c063a0a..b9e420e5c 100644 --- a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/tepp-rust-foundation-ci.yml +++ b/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/tepp-rust-foundation-ci.yml @@ -86,7 +86,10 @@ jobs: - name: Bootstrap hash-verified Rustup shell: bash --noprofile --norc -e -o pipefail {0} run: | - rustup_init="${RUNNER_TEMP:?}/rustup-init-1.29.1" + # Fresh namespaces prevent reuse of persistent HOME state, not whole-VM isolation. + rust_root="$(mktemp -d "${RUNNER_TEMP:?}/tepp-rust-XXXXXXXXXX")" + export CARGO_HOME="$rust_root/.cargo" RUSTUP_HOME="$rust_root/.rustup" + rustup_init="$rust_root/rustup-init-1.29.1" curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ --output "$rustup_init" \ https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init @@ -94,31 +97,31 @@ jobs: dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 \ "$rustup_init" | sha256sum --check --strict chmod 0755 "$rustup_init" - RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \ - "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path + "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path rm -f -- "$rustup_init" - printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}" - printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}" - "$HOME/.cargo/bin/rustup" --version + "$CARGO_HOME/bin/rustup" --version + printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$RUSTUP_HOME" "$CARGO_HOME" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "$CARGO_HOME" >>"${GITHUB_PATH:?}" - name: Install pinned Rust toolchain run: rustup toolchain install 1.98.0 --profile minimal --component clippy --component rustfmt - - name: Restore pinned Rust quality tools - id: rust-tools-cache - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 - with: - path: | - ~/.cargo/bin/cargo-nextest - ~/.cargo/bin/cargo-deny - key: ${{ runner.os }}-${{ runner.arch }}-tepp-rust-tools-nextest-${{ env.CARGO_NEXTEST_VERSION }}-deny-${{ env.CARGO_DENY_VERSION }} - name: Install pinned Rust quality tools - if: steps.rust-tools-cache.outputs.cache-hit != 'true' run: | - cargo install cargo-nextest --locked --version "$CARGO_NEXTEST_VERSION" - cargo install cargo-deny --locked --version "$CARGO_DENY_VERSION" + cargo install cargo-nextest --root "$CARGO_HOME" --locked --version "$CARGO_NEXTEST_VERSION" + cargo install cargo-deny --root "$CARGO_HOME" --locked --version "$CARGO_DENY_VERSION" - name: Verify pinned Rust quality tool versions run: | - cargo nextest --version | grep -F "$CARGO_NEXTEST_VERSION" - cargo deny --version | grep -F "$CARGO_DENY_VERSION" + test -x "${CARGO_HOME:?}/bin/cargo-nextest" + test -x "$CARGO_HOME/bin/cargo-deny" + version="$("$CARGO_HOME/bin/cargo-nextest" --version)" + case "$version" in + "cargo-nextest $CARGO_NEXTEST_VERSION"|"cargo-nextest $CARGO_NEXTEST_VERSION "*) ;; + *) echo "Unexpected cargo-nextest version: $version" >&2; exit 1 ;; + esac + version="$("$CARGO_HOME/bin/cargo-deny" --version)" + case "$version" in + "cargo-deny $CARGO_DENY_VERSION"|"cargo-deny $CARGO_DENY_VERSION "*) ;; + *) echo "Unexpected cargo-deny version: $version" >&2; exit 1 ;; + esac - name: Check formatting run: cargo fmt --all -- --check - name: Run Clippy @@ -158,7 +161,10 @@ jobs: - name: Bootstrap hash-verified Rustup shell: bash --noprofile --norc -e -o pipefail {0} run: | - rustup_init="${RUNNER_TEMP:?}/rustup-init-1.29.1" + # Fresh namespaces prevent reuse of persistent HOME state, not whole-VM isolation. + rust_root="$(mktemp -d "${RUNNER_TEMP:?}/tepp-rust-XXXXXXXXXX")" + export CARGO_HOME="$rust_root/.cargo" RUSTUP_HOME="$rust_root/.rustup" + rustup_init="$rust_root/rustup-init-1.29.1" curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ --output "$rustup_init" \ https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init @@ -166,27 +172,25 @@ jobs: dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 \ "$rustup_init" | sha256sum --check --strict chmod 0755 "$rustup_init" - RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \ - "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path + "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path rm -f -- "$rustup_init" - printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}" - printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}" - "$HOME/.cargo/bin/rustup" --version + "$CARGO_HOME/bin/rustup" --version + printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$RUSTUP_HOME" "$CARGO_HOME" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "$CARGO_HOME" >>"${GITHUB_PATH:?}" - name: Install pinned Rust toolchain with LLVM tools run: rustup toolchain install 1.98.0 --profile minimal --component llvm-tools-preview - name: Install pinned nightly with LLVM tools run: rustup toolchain install nightly-2026-08-21 --profile minimal --component llvm-tools-preview - - name: Restore pinned cargo-llvm-cov - id: llvm-cov-cache - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 - with: - path: ~/.cargo/bin/cargo-llvm-cov - key: ${{ runner.os }}-${{ runner.arch }}-tepp-cargo-llvm-cov-${{ env.CARGO_LLVM_COV_VERSION }} - name: Install cargo-llvm-cov - if: steps.llvm-cov-cache.outputs.cache-hit != 'true' - run: cargo install cargo-llvm-cov --locked --version "$CARGO_LLVM_COV_VERSION" + run: cargo install cargo-llvm-cov --root "$CARGO_HOME" --locked --version "$CARGO_LLVM_COV_VERSION" - name: Verify pinned cargo-llvm-cov version - run: cargo llvm-cov --version | grep -F "$CARGO_LLVM_COV_VERSION" + run: | + test -x "${CARGO_HOME:?}/bin/cargo-llvm-cov" + version="$("$CARGO_HOME/bin/cargo-llvm-cov" llvm-cov --version)" + case "$version" in + "cargo-llvm-cov $CARGO_LLVM_COV_VERSION"|"cargo-llvm-cov $CARGO_LLVM_COV_VERSION "*) ;; + *) echo "Unexpected cargo-llvm-cov version: $version" >&2; exit 1 ;; + esac - name: Generate exact line coverage with region diagnostics id: line-report # mlx_native_receipt is excluded exactly like sqlx_live.rs: it is a @@ -322,7 +326,10 @@ jobs: - name: Bootstrap hash-verified Rustup shell: bash --noprofile --norc -e -o pipefail {0} run: | - rustup_init="${RUNNER_TEMP:?}/rustup-init-1.29.1" + # Fresh namespaces prevent reuse of persistent HOME state, not whole-VM isolation. + rust_root="$(mktemp -d "${RUNNER_TEMP:?}/tepp-rust-XXXXXXXXXX")" + export CARGO_HOME="$rust_root/.cargo" RUSTUP_HOME="$rust_root/.rustup" + rustup_init="$rust_root/rustup-init-1.29.1" curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ --output "$rustup_init" \ https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init @@ -330,12 +337,11 @@ jobs: dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 \ "$rustup_init" | sha256sum --check --strict chmod 0755 "$rustup_init" - RUSTUP_HOME="$HOME/.rustup" CARGO_HOME="$HOME/.cargo" \ - "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path + "$rustup_init" -y --default-toolchain none --profile minimal --no-modify-path rm -f -- "$rustup_init" - printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$HOME/.rustup" "$HOME/.cargo" >>"${GITHUB_ENV:?}" - printf '%s/bin\n' "$HOME/.cargo" >>"${GITHUB_PATH:?}" - "$HOME/.cargo/bin/rustup" --version + "$CARGO_HOME/bin/rustup" --version + printf 'RUSTUP_HOME=%s\nCARGO_HOME=%s\n' "$RUSTUP_HOME" "$CARGO_HOME" >>"${GITHUB_ENV:?}" + printf '%s/bin\n' "$CARGO_HOME" >>"${GITHUB_PATH:?}" - name: Install pinned Rust toolchain run: rustup toolchain install 1.98.0 --profile minimal - name: Run live-sqlx PostgreSQL integration diff --git a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/workflows.tree b/tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/workflows.tree similarity index 82% rename from tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/workflows.tree rename to tests/fixtures/central-ci/3136c940235a3762b804bd99eb20fbe129e70c06/workflows.tree index 318fcc6dcc0c570d62e18a8b5d060d879c8fd332..f98dde54f0bc5665d3453d0c35876f535a880acf 100644 GIT binary patch delta 92 zcmV-i0Hgn+7vC4Kkq9<%bzyR0ZggpGWi4}IZe(I_cr9{uZggpFWi4ZAE_rQi0DgyH y`RfRC=^RT->YKmarF=Pa}5e+Xs(Ra@`~zurI-J_dgZl?2mfC8K5Gb3m6%+TnV*-F znOCA$nV6fy;QjbTOyylICcpW&jRkLAQrb{nuV!KZ1PTz9#SCl{-rlMgUD9IjP#?eM zJ)5AusH!(aMNw&9UTTqUW^Q77YB59CN3UxB8AzWj8p=hNHW?*NK|P4NH# diff --git a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object b/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object deleted file mode 100644 index 6a0eb173c..000000000 --- a/tests/fixtures/central-ci/af81ef49683809ce8b302e078455e3960cf0acd1/commit.object +++ /dev/null @@ -1,23 +0,0 @@ -tree 597386fe8d2c3c3b6653d251ea37643e4f670559 -parent f52a0d71b3ce2b60d738f4326f0f9906af9ea1b9 -author Seongho Bae 1791906853 +0900 -committer GitHub 1791906853 +0900 -gpgsig -----BEGIN PGP SIGNATURE----- - - wsFcBAABCAAQBQJqzlQlCRC1aQ7uu5UhlAAAVhQQADKdcP/gr66arzQALhCgZxSJ - h9z5uwMl+SFeLpydWHUP1KnB6Iq73J+pwK3LXshl0/WW/8retiTFSdFtX40BWlZZ - EinJDxZD+I3uqSsK20PTW3Aa9KL5JbGQYj2KSDqZLXJrsruQQPyxmSLPfhF/JSL7 - f1Wk7TQ/rbzJPaNiiIC31YiYuGmv0soH0aF6oO4t5sUFvf87nnNYlNudU7To/96f - 2TagqhZLMlZ5tYloXqNAVib7IYurAdNdrEeXfVu0LhNfM6qreRqsF4nPi8WGJN5d - hTALU/ZKtoxK5/5hRZ+b+bS705+G6YvufAYMeZhlkYVSNikhoOYx8MHKDHVggskY - 5YINISf0hW7bvkQeyVLAYq/WixDbYQkGHWxvz+n6hAS1AdLt9Z1xBMw2/MUNr8Je - K7Sz68cyq4qE/mulmcTxMSeZxYT6hK6Dz/evIxEjTmNJAZLy6gEEuAZSPBX3y0D8 - U4hUAA0u7nuVk8vm2zSkdlTrTfZv53WxB1O8J78qoKcpqeUk/jhSjPdkjDLw8g6a - j10HngpRUpgL2C6Ht0GKIHa2aSsLkyM67dRXYSKbkukIGEXLAxPzN4yFHu55x74E - 9qmyrgTA/ooodhHS9SXPjSV2SY3SNYEfqNQ6sC/F98kUSRNuRYmjmh6NwXBLDquW - rP4MTY68jLLd2LOzUCei - =VILy - -----END PGP SIGNATURE----- - - -ci(tepp): bootstrap supplier Rust and Python tools (#2641) \ No newline at end of file diff --git a/tests/quality/test_effective_ci_source.py b/tests/quality/test_effective_ci_source.py index 065b50ea9..e638db382 100644 --- a/tests/quality/test_effective_ci_source.py +++ b/tests/quality/test_effective_ci_source.py @@ -71,6 +71,7 @@ def test_caller_identity_rejects_pin_dispatch_and_job_drift(self) -> None: original = path.read_text(encoding="utf-8") variants = ( original.replace(source.SUPPLIER_PIN, "a" * 40), + original.replace(source.SUPPLIER_PIN, "af81ef49683809ce8b302e078455e3960cf0acd1"), original.replace(" foundation:", " foundation:\n if: false"), original.replace("contents: read", "contents: write"), original.replace("cancel-in-progress:", "removed-concurrency:"), @@ -98,6 +99,22 @@ def test_supplier_weakenings_are_rejected_by_custody(self) -> None: ("cwlab-ci-isolated", "privileged"), ("x64,", ""), ) + install_controls = tuple( + (command, command.replace(before, after)) + for command in workspace.REQUIRED_CI_SNIPPETS + if command.startswith("cargo install ") + for before, after in ( + ('--root "$CARGO_HOME"', '--root "$HOME/.cargo"'), + ("--locked", "--force"), + ('--version "$CARGO_', '--version "OTHER_'), + (command.split()[2], "unreviewed-tool"), + ) + ) + plugin_control = ( + '"$CARGO_HOME/bin/cargo-llvm-cov" llvm-cov --version', + '"$CARGO_HOME/bin/cargo-llvm-cov" --version', + ) + changes += install_controls + (plugin_control,) with tempfile.TemporaryDirectory() as directory: root = Path(directory) fixture = self.copy_evidence(root) @@ -109,6 +126,12 @@ def test_supplier_weakenings_are_rejected_by_custody(self) -> None: path.write_text(original.replace(before, after), encoding="utf-8") with self.assertRaisesRegex(ValueError, "blob Git object mismatch"): source.effective_ci_source(root) + if (before, after) in install_controls + (plugin_control,): + with mock.patch.object(workspace, "effective_ci_source", return_value=original.replace(before, after)): + self.assertIn( + f"CI workflow is missing required command: {before}", + workspace._validate_ci_contract(ROOT), + ) path.write_text(original, encoding="utf-8") self.assertEqual(workspace._validate_ci_contract(root), ["rust-toolchain.toml is missing", "deny.toml is missing"]) @@ -158,6 +181,7 @@ def test_documentation_evidence_and_caller_controls(self) -> None: original = path.read_text(encoding="utf-8") for text in ( original.replace(source.SUPPLIER_PIN, "a" * 40), + original.replace(source.SUPPLIER_PIN, "af81ef49683809ce8b302e078455e3960cf0acd1"), original.replace(" documentation:", " documentation:\n if: false"), original.replace("contents: read", "contents: write"), original + "\n extra-job:\n runs-on: ubuntu-latest\n", diff --git a/tests/quality/test_reusable_supplier_callers.py b/tests/quality/test_reusable_supplier_callers.py index fd22e9211..797b2645d 100644 --- a/tests/quality/test_reusable_supplier_callers.py +++ b/tests/quality/test_reusable_supplier_callers.py @@ -8,7 +8,7 @@ ROOT = Path(__file__).parents[2] -EXPECTED_SHA = "af81ef49683809ce8b302e078455e3960cf0acd1" +EXPECTED_SHA = "3136c940235a3762b804bd99eb20fbe129e70c06" EXPECTED_CALLERS = { ".github/workflows/ci.yml": { "job": "foundation",