ci: block fork runs from privileged enclave builds - #73
Merged
Merged
Conversation
nickpell
requested review from
peterldowns
and
a balanced review from Copilot
September 23, 2026 16:13
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The privileged workflow changes require post-merge validation on the default branch.
Review effort: Balanced
Findings: None
What changed in this PR
Hardens privileged Docker and EIF workflows against fork-triggered runs while preserving trusted and manual builds.
Changes:
- Adds same-repository gating to Docker and EIF jobs.
- Disables Go caching in the privileged Docker job.
| File | Description |
|---|---|
.github/workflows/eif-build.yml |
Adds defense-in-depth repository validation. |
.github/workflows/docker.yml |
Adds repository-origin gating and disables Go caching. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
7 tasks
nickpell
added a commit
to cloudx-io/openarbiter
that referenced
this pull request
Sep 23, 2026
## Summary - Require the triggering Go run's head repository to match this repository before Docker Build runs the enclave job. Fork PRs no longer build images; PRs from this repo and pushes to main retain their existing build and publication behavior. - Add the same repository check to Build EIF as defence in depth. Keep its main-branch, success, skip-marker, and manual-dispatch behavior. Related security hardening: cloudx-io/openauction#73. The two changes can merge independently. ## Notes for reviewers #1 adopted openauction's CI structure. #21 preserved build-only PR validation while restricting publication. This change narrows that validation to branches in this repository because fork code must not run in the privileged workflow context. The EIF condition checks the immediate upstream Docker run. The existing Docker-to-EIF publication and commit-metadata handoff is unchanged. This follows the scope documented in #21. PR-triggered workflow_run jobs use the workflow definitions on main. CI before merge therefore does not exercise these new Docker and EIF guards; the first main push after merge must verify the full chain. ## Pre-merge checklist - [x] Workflow lint passes: mise run //:ratchet:lint and actionlint 1.7.12 on both changed workflows (shellcheck and pyflakes disabled; no run scripts changed). - [x] Gate dry-run passes for 144 event combinations, covering same-repo and fork sources (including forks named main), missing source metadata, success/failure/cancellation/skips, branch filters, PCR skip markers, and supported dispatch paths. - [x] Diff contains only the two workflow changes and related comments. - [x] PR CI checks pass: Ratchet Lint, lint, and test on the current PR commit. ## Post-deploy/apply verification - [ ] After merge, the next push to main completes Go successfully, then Docker Build publishes the image for the built commit. - [ ] Build EIF succeeds for that chain, publishes the EIF, and completes the PCR update job. - [ ] The follow-up `[skip-build] Update PCR measurements` commit appears on main with the expected validation/pcrs.json entry. Its Build EIF run is skipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related security hardening: cloudx-io/openarbiter#33. The two changes can merge independently.
Notes for reviewers
Commit 93b30e5 intentionally added Docker validation after Go runs on all branches. #61 kept PR builds while restricting publication. This change narrows that validation to branches in this repository because fork code must not run in the privileged workflow context.
The EIF condition checks the immediate upstream Docker run. The existing Docker-to-EIF publication and commit-metadata handoff is unchanged. This follows the scope documented in cloudx-io/openarbiter#21.
PR-triggered workflow_run jobs use the workflow definitions on main. CI before merge therefore does not exercise these new Docker and EIF guards; the first main push after merge must verify the full chain.
Pre-merge checklist
Post-deploy/apply verification
44684d4192229e7d776e61bde27e7bec109e8859. Docker logs confirm the44684d4192229e7d776e61bde27e7bec109e8859-arm64image manifest was pushed.44684d4192229e7d776e61bde27e7bec109e8859, and pushed PCR-update commit 72345ab. All three committed PCR measurements match the EIF build log.[skip-build] Update PCR measurementscommit appears on main with the expected validation/pcrs.json entry. Its Build EIF run is skipped. Evidence: PCR-update commit 72345ab is on main and contains the matching measurements; its Go and Docker Build workflows succeeded, and Build EIF concludedskippedwith both jobs skipped.