Repository navigation
ci: Add protected PAPER executor grant workflow - #720
Conversation
|
@codex review Please review exact head f256e2f against main for this bounded protected Actions definition. Authority t1320s7720=A permits Draft publication only; retain t1319s7706 four-permission scope and #719 lineage. Check fixed recipient/project/bootstrap mappings, required Environment approval, fail-closed behavior, redaction, cross-writer drift/CAS and restart/no-retry behavior. Leave this PR OPEN and Draft. No grant dispatch, setIamPolicy, IAM/Secret/config change, scheduler apply, PAPER start, deployment, labels or merge is authorized by this request. Local full suite: 3324 passed, 1 skipped, 431 subtests passed; focused 119 passed; Ruff, central documentation check, shell contracts and Node review contracts passed. Bootstrap effective authority and protected mapping adoption remain NOT_PROVEN. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f256e2fd7c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please re-review exact Draft head 458bbf1. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Pigbibi
added
the
agent-approved
What changed
Add a protected, manual-only Actions definition to unblock the PAPER scheduler
IAM executor grant route. Authority t1320s7720=A permits this Draft definition;
t1319s7706 retains the exact four-permission/project/recipient scope and #719
lineage. The existing scheduler IAM grant route remains unchanged.
The new script creates only one fixed custom role with iam.roles.get,
resourcemanager.projects.getIamPolicy, iam.roles.create and
resourcemanager.projects.setIamPolicy, bound only to the existing scheduler
executor. It uses fresh role/policy reads, etag CAS, additive-only bindings,
fixed diagnostics, readback and no write retries. It shares the existing IAM
workflow concurrency group and stops on collisions, drift or unknown outcomes.
How verified
431 subtests passed; two deprecation warnings.
11 Node review contracts passed.
Scope and risk
Definition only: ZERO grant/dry-run dispatches, setIamPolicy, IAM/Secret changes,
PAPER starts or deployment. Leave Draft OPEN. Merge under C and a separate owner
run card are prerequisites to any grant run. An input card reference is not
authorization; the required Environment reviewer verifies exact scope/revision.
Reuse the existing longbridge-paper Environment (read-only query confirms a
required reviewer and branch policy). This workflow checks reviewer protection
before cloud auth, requires protected main/first attempt/exact SHA, defaults to
dry-run, and runs a read-only plan immediately before apply.
No new production principal is proposed. No compatible authorized bootstrap
identity has yet been proved. Protected PAPER_IAM_BOOTSTRAP_SERVICE_ACCOUNT and
PAPER_IAM_BOOTSTRAP_WIF_PROVIDER must identify an existing authorized bootstrap;
missing mappings block. PAPER_IAM_GRANT_RECIPIENT must match the existing
GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT and the approved PAPER project. No mapping
or WIF change is made here. A later run must prove narrow bootstrap WIF trust
and effective authority. The four permissions themselves confer project IAM
powers; the script does not sandbox a compromised executor. Partial or ambiguous
writes require fresh readback and a new scoped card before another attempt.
AI assistance
Authored with OpenAI Codex; model/version follows the configured host.
Publication scan
publication-check/2.0-advisory build 83d9d1130377: findings=1499; matching_lines=1488. Complete tracked candidate plus explicit new files; advisory. Matches include fake fixtures, workflow token-permission syntax and pre-existing tree content. No credential introduced by this diff. First 20 matches (shared-masked):
PROJECT = "<PROJECT_ID>""IAM_MODE": "apply", "GCP_PROJECT_ID": <PROJECT_ID>,"PAPER_SCHEDULER_GET_PROJECT_ID": <PROJECT_ID>,("PAPER_IAM_GRANT_RECIPIENT", "<EMAIL>"),id-token: <REDACTED>[Cloud Scheduler access control](https://<PROJECT_ID>/scheduler/docs/access-control)TELEGRAM_TOKEN=<<HOST>>/.env.example @<PROJECT_ID>/.github/CODEOWNERS @<PROJECT_ID>/.github/workflows/ @<PROJECT_ID>/application/account_new_risk_gate_support.py @<PROJECT_ID>/application/durable_execution_commands.py @<PROJECT_ID>/application/execution_receipt_adapter.py @<PROJECT_ID>/application/execution_service.py @<PROJECT_ID>/application/execution_state.py @<PROJECT_ID>/application/longbridge_execution.py @<PROJECT_ID>/application/paper_execution_command_consumer.py @<PROJECT_ID>/application/paper_strategy_risk_state.py @<PROJECT_ID>/runtime_execution_policy.py @<PROJECT_ID>/scripts/execution_report_heartbeat.py @<PROJECT_ID>Review finding repairs
AI: Codex (gpt-6.1-sol). Preserve Draft-only scope and all existing execution
gates. Remove protected mappings from job-level env; a first action reads and
masks named Environment/repository variables before exporting them to later
steps. Exact permission membership/cardinality now accepts arbitrary response
order while rejecting duplicates, additions and malformed values. Fresh role
snapshots normalize only permission ordering, preserving drift detection.
Validation: executed fail-before 4 failed / 23 passed; focused 130 passed;
full offline 3335 passed / 1 skipped + 431 subtests; Ruff, central documentation
check, diff check, 92 shell image-only cases, 9 lifecycle cases, tracked-source
checks and 11 Node contracts passed.
Runtime prerequisite: the workflow token's variable API read access is
NOT_PROVEN and may be unavailable with current permissions. Missing/unreadable
mappings fail closed before cloud authentication. No token permission or
Environment configuration change is included; organization-only variable
fallback is unsupported. This repair does not establish grant readiness.
No IAM/cloud/apply/PAPER or workflow dispatch; no merge, undraft or labels.
Central publication scan: publication-check/2.0-advisory, build 83d9d1130377; findings=1498; matching_lines=1487. Advisory full-tree results include existing content and fake fixtures; no credential introduced by this four-file repair.
First 20 shared-masked matches:
repo/.env.example:21:TELEGRAM_TOKEN=<<HOST>>repo/.github/CODEOWNERS:7:/.env.example @<PROJECT_ID>repo/.github/CODEOWNERS:8:/.github/CODEOWNERS @<PROJECT_ID>repo/.github/CODEOWNERS:9:/.github/workflows/ @<PROJECT_ID>repo/.github/CODEOWNERS:10:/application/account_new_risk_gate_support.py @<PROJECT_ID>repo/.github/CODEOWNERS:11:/application/durable_execution_commands.py @<PROJECT_ID>repo/.github/CODEOWNERS:12:/application/execution_receipt_adapter.py @<PROJECT_ID>repo/.github/CODEOWNERS:13:/application/execution_service.py @<PROJECT_ID>repo/.github/CODEOWNERS:14:/application/execution_state.py @<PROJECT_ID>repo/.github/CODEOWNERS:15:/application/longbridge_execution.py @<PROJECT_ID>repo/.github/CODEOWNERS:16:/application/paper_execution_command_consumer.py @<PROJECT_ID>repo/.github/CODEOWNERS:17:/application/paper_strategy_risk_state.py @<PROJECT_ID>repo/.github/CODEOWNERS:18:/runtime_execution_policy.py @<PROJECT_ID>repo/.github/CODEOWNERS:19:/scripts/execution_report_heartbeat.py @<PROJECT_ID>repo/.github/dot-review/review.cjs:106:const token = <REDACTED> core.getIDToken(audienceText); // Exact bytes; URL normalization may change an audience.repo/.github/dot-review/review.cjs:190:const <PROJECT_ID> = {...pr,head:{...pr.head,sha:pair.target},base:{...pr.base,sha:pair.base}};repo/.github/dot-review/review.cjs:191:const binding = {...b.binding({repository:trust.repo.full_name,pr:<PROJECT_ID>,policyCommit:trust.commit,files},trust.policySha),repo/.github/dot-review/test-review.cjs:81:const content='<PROJECT_ID> source\n', sourceSHA='d'.repeat(40);repo/.github/dot-review/test-review.cjs:82:const pr={number:7,changed_files:1,commits:1,title:'<PROJECT_ID> change',body:'<PROJECT_ID> body',repo/.github/dot-review/test-review.cjs:100:assert.equal(audience,'https://audience.example.test');return '<PROJECT_ID>-only';},summary};