ci: block fork runs from privileged enclave builds - #33
Merged
Merged
Conversation
nickpell
requested review from
peterldowns
and
a balanced review from Copilot
September 23, 2026 16:13
7 tasks
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The critical EIF workflow guard can still permit privileged fork-triggered execution.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
What changed in this PR
Restricts privileged Docker/EIF builds to same-repository runs and disables Go caching.
Changes:
- Adds repository-origin guards to Docker and EIF jobs.
- Disables
setup-gocaching in Docker builds.
| File | Review |
|---|---|
.github/workflows/eif-build.yml |
Critical: The guard does not propagate the original Go run’s repository, allowing a skipped Docker job to trigger EIF. |
.github/workflows/docker.yml |
Adds source-repository gating and disables Go caching. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
nickpell
added a commit
to cloudx-io/openauction
that referenced
this pull request
Sep 23, 2026
## Summary - Require the triggering Go run's head repository to match this repository before Docker Build runs the enclave job. Fork PRs no longer build images; PRs from this repo and pushes to main retain their existing build and publication behavior. Docker workflow_dispatch remains available. - Add the same repository check to Build EIF as defence in depth. Keep its main-branch, success, skip-marker, and manual-dispatch behavior. Related security hardening: cloudx-io/openarbiter#33. The two changes can merge independently. ## Notes for reviewers Commit [93b30e5](93b30e5) intentionally added Docker validation after Go runs on all branches. #61 kept PR builds while restricting publication. This change narrows that validation to branches in this repository because fork code must not run in the privileged workflow context. The EIF condition checks the immediate upstream Docker run. The existing Docker-to-EIF publication and commit-metadata handoff is unchanged. This follows the scope documented in cloudx-io/openarbiter#21. PR-triggered workflow_run jobs use the workflow definitions on main. CI before merge therefore does not exercise these new Docker and EIF guards; the first main push after merge must verify the full chain. ## Pre-merge checklist - [x] Workflow lint passes: mise run //:ratchet:lint and actionlint 1.7.12 on both changed workflows (shellcheck and pyflakes disabled; no run scripts changed). - [x] Gate dry-run passes for 192 event combinations, covering same-repo and fork sources (including forks named main), missing source metadata, success/failure/cancellation/skips, branch filters, PCR skip markers, and supported dispatch paths. - [x] Diff contains only the two workflow changes and related comments. - [x] PR CI checks pass: Ratchet Lint, lint, and test on the current PR commit. ## Post-deploy/apply verification - [ ] After merge, the next push to main completes Go successfully, then Docker Build publishes the image for the built commit. - [ ] Build EIF succeeds for that chain, publishes the EIF, and completes the PCR update job. - [ ] The follow-up `[skip-build] Update PCR measurements` commit appears on main with the expected validation/pcrs.json entry. Its Build EIF run is skipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related security hardening: cloudx-io/openauction#73. The two changes can merge independently.
Notes for reviewers
#1 adopted openauction's CI structure. #21 preserved build-only PR validation while restricting publication. This change narrows that validation to branches in this repository because fork code must not run in the privileged workflow context.
The EIF condition checks the immediate upstream Docker run. The existing Docker-to-EIF publication and commit-metadata handoff is unchanged. This follows the scope documented in #21.
PR-triggered workflow_run jobs use the workflow definitions on main. CI before merge therefore does not exercise these new Docker and EIF guards; the first main push after merge must verify the full chain.
Pre-merge checklist
Post-deploy/apply verification
2e1f7fd1ab3a9fd36b388b2dba9c33afb2a421d0. Docker logs confirm the2e1f7fd1ab3a9fd36b388b2dba9c33afb2a421d0image manifest was pushed.2e1f7fd1ab3a9fd36b388b2dba9c33afb2a421d0, and pushed PCR-update commit 0762c0e. All three committed PCR measurements match the EIF build log.[skip-build] Update PCR measurementscommit appears on main with the expected validation/pcrs.json entry. Its Build EIF run is skipped. Evidence: PCR-update commit 0762c0e is on main and contains the matching measurements; its Go and Docker Build workflows succeeded, and Build EIF concludedskippedwith both jobs skipped.