Repository navigation
ci(fast-mlsirm): retain per-target release license verification - #2628
2 commits merged into
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - name: Select reviewed license bundle for sdist consumer target | ||
| working-directory: sdist-consumer/source | ||
| shell: bash | ||
| run: bash tools/select_third_party_license.sh "${{ matrix.target }}" |
There was a problem hiding this comment.
🔍 Older release commits need helper coverage
The new steps run helpers from release_commit, including the unpacked sdist. Check that supported older commits contain both helpers and package them in the sdist; the protected control checkout does not supply them.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
중앙 self-hosted 전환 감사에서 추가 caller 경계를 확인했습니다. 현재 main 4e32b99ec79b6565800d1081f60acfea368adecd의 fast-mlsirm-publish-pypi.yml:1087은 release-dependency-license-strix-gate.yml@b6cebb36dc11afe409a7fee8a3262827255c029c를 고정하며, 그 callee에는 ubuntu-24.04 job 4개가 있습니다. 현재 main callee의 self-hosted 설정만 세면 이 transitive 경로를 놓칩니다. 이 PR의 기존 publisher writer 경계를 존중하여 공유 파일은 수정하지 않았습니다. 기존 release HOLD와 provider credential 거부를 보존하면서, 검토된 self-hosted callee의 input/output·secret 계약을 대조한 후 immutable pin 및 caller regression을 함께 수리해 주세요. 현재 main callee도 provider secrets 계약이 남아 있어 단순 pin 치환을 실제 release 또는 gateway-only 완료로 인정하지 않습니다. 감사 파일: /Users/seonghobae/.hermes/cache/scratch/dynamic-hosted-audit-20261013/result-ko.json. Hosted-only retirement나 HOLD를 PASS로 기록하지 않았습니다. |
1 participant
The centralized fast-mlsirm publisher omitted four release-owner license steps from fast-mlsirm #2177. Carry over target-specific reviewed bundle selection before each native and sdist-consumer build, then require the built wheel license bytes to match the selected source before capturing artifacts.
The release matrix remains disabled and publication remains fail-closed. No rights HOLD, dependency verdict, credential boundary or source selection authority changes.
Validation: regression test fails on the previous producer and all six self-hosted workflow contracts pass with fatal warnings after repair. actionlint passes after ignoring only the existing intentional constant-false release conditions; diff checks pass. Fresh Trivy vulnerability DB and exact-tree fixable HIGH/CRITICAL scan are in progress; findings are not accepted as infrastructure failures.
Fresh exact-head Trivy audit at
230db49939376c879804ba1f28bd0a26c4f7fc34completed with exit 1. Two fixable findings remain in the unchangedscripts/ci/noema-document-reader/package-lock.json: HIGHCVE-2026-104850in@modelcontextprotocol/sdk1.30.0 (fixed 1.31.0), and CRITICALCVE-2026-90711inproxy-addr2.0.7 (fixed 2.0.8). The lockfile blob isfe692cdf0e5cda1df8b6dcadfdb3a163d47f2555on both current base and head. These are pre-existing source findings, not infrastructure failures, and are not suppressed by this PR.